I know that Linux is more secure than Windows and normally doesn’t need an antivirus, but know myself I’m gonna end up downloading something at some point from somewhere on the internet, and it would be good to be prepared. So, which antivirus would you recommend for Linux (Mint specifically) just to double up on security?
Micheal Bazzel recommend ClamAV, havent tried it though
Linux relases of commercial antivirus editors do catch linux malware binaries, and platform specitic threats. Like crypto miners, webshells on your selfhosted part of the Internet, javascript malware (pretty much living in the browser, OS agnostic)…
Install the apparmor profiles and extra profiles packages from the apt repository. They are sensible restrictions on common apps (web browsers) to prevent anything malicious from happening if they are ever hijacked. Make sure apparmor is enabled. This will do more to keep you secure than an antivirus.
If you insist on an AV, install ClamAV and have it scan weekly. It’s libre software and works well with Linux.
None at all tbh, at least if you use the PC alone and don’t share a lot of stuff with Windows devices. If you do, then maybe scan .exe or other files (e-mail attatchments, etc.) with ClamAV or similar to prevent spreading stuff.
You usually don’t need AV software because you install stuff differently than on Windows. You don’t hunt .exe-files from random internet sites, thats irresponsible even for Windows.
You install your apps directly from your software center (a frontend for Flatpaks and repo software), where they usually are pretty safe.
Also, sandboxing is a thing. The prefered way for most people (and often default) is via Flatpak, where apps are restricted on what they can access and do. You can lock them down even further if you want.
There are more ways of sandboxing, but those are not so relevant here right now.
Also:
- If you run a script, check it first. I have zero clue in regards of coding, but even I can usually guess what each line is supposed to do.
- Don’t add 3rd party repos if you can, use containers instead
- Go for the easiest route, guides for “Linux” aren’t noob friendly. In your case, search for “Mint” instead, most stuff is pretty easy there.
DISCLAIMER
I am not a computer security expert, merely a hobbyist having read some blogs from people who sounded smart. It is more than probable that I am mistaken in one or more parts of this post.Linux is not more secure than Windows. By default, it’s actually considerably more vulnerable than Windows. Source
In my opinion an antivirus doesn’t really solve your problem. What you actually want is sandboxing, which means restricting user and program privileges. I recommend getting familiar with SELinux (or alternatively AppArmor, although it isn’t nearly as effective) and bubblewrap (or alernatively Firejail, which requires root privileges to run and is thus a bigger threat vector than bubblewrap).
Aside from that just disable any service you aren’t using (like ssh), use a deny-all-allow-some firewall, and verify what you download. If the link says “100% REAL 1 MILLION FREE ROBUX DOWNLOAD CLICK HERE NOW”, then maybe don’t click there.
Because even an antivirus won’t help you if you download malware, which isn’t compiled by skids who lifted the code from some darknet hacker forum. Antivirus isn’t some magical tool which makes your computer inherently more secure. Meaning you can’t offload your responsibilty to a program running with kernel level privileges. Your computer, your responsibilty.
P.S: If you want a more secure computer, I’d recommend a minimal and/or rolling release distro (openSUSE, Arch, Void, Debian) or FreeBSD/OpenBSD (BSD variants mitigate many of Linux’s inherent flaws).
The best security is to limit your risk vector.
Like you said Anti-viruses aren’t some magic bullet, in university a bunch of us wrote Malware and wrecked each other’s lab computers or did things like having the whole Lab’s computers CD trays open at 10am every morning.
The AV didn’t pick up any of them and we barely knew what we were doing.
Afik, AV’s mostly scan for known threats
Old AV did. Modern AV (like, the last 10+ years) is behavioral. They still scan for signatures too, but they primarily work by analyzing software’s behavior for known or unusual techniques.
I’d be curious to rewrite some of the malware we made in class and see if AVs would pick it up now.
Most of them didn’t make any network calls etc. they would just mess with your files and system Things like Set background to Justin-Bieber, play Justin-Bieber randomly, we were very mature
Linux Antivirus is a very specific niche. It’s mostly there to scan for Windows viruses and malware. So your Linux mailserver for example (or storage system) filters those out before they appear on your employee’s computers.
What you’d instead do in Linux is harden your webserver and services, keep the webservices you host up to date and have some monitoring so you detect known rootkits or if your DNS server gets abused for a DDoS attack. And keep an eye on supply chain attacks if you’re a developer. Because that’s how attacks against Linux work. I’ve been scolded for saying this on Lemmy, but to this date, desktop computer malware isn’t really a thing with Linux. Attacks almost exclusively target webservers and Internet of Things devices, routers and so on.
So an Antivirus on a desktop computer isn’t going to do much, due to the lack of malware which works that way. And you’d still be vulnerable if someone hands you a malicious bash script to delete your home directory. It could however do something if you run Proton or Wine and run Windows programs in Linux.
If you want to do something for security, learn not to copy-paste stuff into the command line. Don’t run executables from random places of the internet. Try to rely on your distribution’s package repository. Do automatic updates, and generally do timely updates, especially with the webbrowser and stuff that’s reachable from outside. Set strong passwords. And don’t neglect your backups. Your harddisk is bound to fail anyway, eventually. I think that’s going to get you 99% of the way. Installing an antivirus is only the next 0.2%.
If you’re careful and only install from the repo, you generally don’t need an AV. But if you do, ClamAV is the main AV on Linux. Installation tutorial for Mint: https://idroot.us/install-clamav-linux-mint-22/
Doesn’t ClamAV only check for Windows viruses that are passing through a Linux server?
No. ClamAV can, for example scan Linux ELF executables and its database contains signatures for malware that could affect desktop Linux. The most common use case is servers that are distributing files, but it can be used to scan local files.
The local use case is fairly rare because malware targeting desktop Linux is rare. That’s partly because Linux users tend to have a better understanding of computers on average than Windows users, and partly because the sort of attack vectors that work well against Windows users don’t align with Linux workflows (e.g. if you want to execute a file sent as an email attachment, you’ll have to save it and set it executable first).
I run ClamAV regularly, and it has not found anything on my several systems in the last 20 years. Good to know we’re safe, or are we?
I’m more concerned about rogue browser extensions that may be innocent when you install them, but then change owners, and after an update that you don’t even notice are going to do bad things.
l have installed ClamTK, but just because my bank has explicitly written in its terms of use that “an antivirus program has to be installed on the PC used for online banking.”
So I installed one to comply. But that’s it…Just discovered that ClamTK is no longer maintained…
So I am also interested in alternatives to still be able to appease my bank.ClamAV is the one maintained these days.
Thanks! Seems that ClamTK has just been a GUI-Wrapper around ClamAV anyway…
And as I am only interested in installing, and not actually using, CLI-only is also fine!
