News for hackers. Stuff that matters.

A comment on Ask HN: What do you use to protect your Linux box from malware?.

Re:Ask HN: What do you use to protect your Linux box from ma... by harikb on Saturday January 11, 2020 @01:36AM (#22018541)
First, you have to understand that once infected, a system can never be fully cleaned. So you if you are not sure how your past usage has been and might have installed random software, you need to reinstall your system after backing up your non-system files. This is the only sure way. AV software claim to solve what-they-can in the best possible way for a person who doesn't have any other option. The very fact that you are using Linux, I assume you are step above the average AV customer base.

Once you have clean system, you have to follow a discipline - do not work as root, restrict ssh access to specific users, don't run unnecessary services. Far too many to list here. Unfortunately, that is how the world is. Be paranoid. May be even use a VM to run software you don't trust. Always install software using package managers or at least do basic sanity checks like checksums on anything you download.

There is no software that will run a scan and give you a green check. If there is one like that, I wouldn't trust it either.

[ Parent | on HN ]
Re:Ask HN: What do you use to protect your Linux box from ma... by rapnie on Saturday January 11, 2020 @01:53AM (#22018588)
Thank you for the info. I generally work according to the best-practices you outline.

> There is no software that will run a scan and give you a green check. If there is one like that, I wouldn't trust it either.

Are you advising against running ClamAV, chkrootkit and rkhunter? I know they won't give 100% guarantee, but something better than nothing, I thought.

I am most worried about my developer machine, as I have testdrived numerous OSS projects, with different stacks, package managers, etc. Fetched billions of npm packages, and browsed gazillion sites for tech advice (using FF, Privacy Badger, uBlock, but still).

A clean reinstall may be in order, but it'll cost so much time getting all config I now have in place again.

[ Parent | on HN ]
Re:Ask HN: What do you use to protect your Linux box from ma... by A_Parr on Saturday January 11, 2020 @02:58AM (#22018790)
ClamAV on Linux is mostly for checking for Windows malware in files that might end up on Windows.
[ Parent | on HN ]