Otdfbt

I have upgraded into Ubuntu 18.04.2 LTS. I have worked primarily with Windows and secondarily with Ubuntu (14.04 and 16.04). I will work with Ubuntu 18.04 as my main Operational System (distribution). I want to ask if it is necessary to install an anti-virus and if the answer is affirmative what is the better choice (free of course:-)!).

This article suggests not to, but if nonetheless you wish to install AV software, ClamTK downloadable from the Ubuntu Software Centre will provide some peace of mind.

Alternatively as described here you can open a terminal and type:

sudo apt-get install clamtk

or load it through Synaptic Package Manager.

Based on my experience from using Ubuntu as my main operating system for more than 5 years and 18.04 for more than one year, you do not need anti-virus software at all. I don't use it and never had any problems so far. That said, you should always adhere to the usual safety rules: Do not open/download unknown files, install software from trusted sources, keep your system updated, etc....

EDIT: See this article for further information.

Anti-virus software does not just look for viruses.

You will also want to look at rkhunter which looks for root kits.

While Linux/Unix has little notion of viruses, that does not mean to say that software cannot be loaded on to these systems through known vulnerabilities and be executed. Anti-virus software can also look for these.

No, you need no anti-virus program.

There are a few, but they look for Windows viruses. For example clamav is useful when you run a e-mail server and want to filter e-mails with virus attachments. But it is not very useful for Linux malware.

For Linux there is little malware at all and most of it is not targeting your desktop computer. The most common problem is malware installed via remote access tools (usually due to weak passwords) like SSH. It tends to send spam mails and scan for other vulnerable systems trying not to be found.

When a malware gets root access, it may try to hide using a rootkit. You can use rkhunter to find common rootkits. The program runs fast, as the list is rather short. There are tools like debsums to check all system programs for integrity, too.

As an Ubuntu user, you will get most software from the trusted repository of your distribution and that will keep you safe. Be aware that there are some harmful things you can do when following different advise to "just copy this into your terminal" or add PPA repositories from people you do not know.

A stupid and harmful joke is that people suggest to run rm -rf /, what deletes all files on your computer. (This one may be prevented by now, but a slightly different variant will still do the same).

Other things include running things without really understanding them, when your system is slightly different than the author's system. For example some howto for copying an ubuntu image to a usb stick may include dd if=ubuntu.img of=/dev/sdb. This will run fine when you have one hard disk (sda) and the usb stick (sdb). But when you have a second hard disk, the usb stick will be sdc and your second hard disk is sdb and you will overwrite your data.

So do not run scripts, you do not understand how they work, if you are not sure that the author thought about things like this.

In summary:

• Use software from Ubuntu only (this is the default, if you do not add PPAs or download .deb packages or scripts)


• Do not use SSH unless you need to


• Use a good password, especially when allowing remote access


• Do not run random commands, that some stranger one the internet recommended, if you do not understand what they do.

My reply to answers like:

"From my personal experience you don't need an antivirus"

From a cyber-security defense focused company, our cyber-security experts do recommend to use antivirus for Linux or MacOS. Indeed, it is an internal requirement to have antivirus installed in our workstations.

These systems have less market (if we don't take into account Android) then, also a smaller target from the bad guys and, therefore, viruses (and malware) are less common, and by Unix stronger design, it is more difficult to develop virus/malware for GNU/Linux, but sometimes safe options are disabled (as memory randomization in Linux), and, there is no safe software.

Also, remember that we all use Web browsers, and there are many browser centered attacks.

It is easy to think that you are protected because you use a Unix, like GNU/Linux, BSD or MacOS. But this is very wrong. Indeed:

1. I had heard a similar answer from the MacOS community, and I have found myself bitcoin miners in MacOS laptops.




2. I have also seen also in other companies old unprotected GNU/Linux servers (no updates, not proper firewall rules on the server SW FW, no anti-virus/anti-malware) being victims of ransomware attacks, under bitcoins demands to be decrypted.




3. I have seen several cyber-security products packed into virtual appliances (used to distribute deployable VMs), and all come with ClamTk, a firewall, etc. If these guys include them, I tend to think there's a reason behind it.

So, my free advice: change your mindset, install ClamAV, ClamTk, check that your distro good firewall is enabled, and be careful on the Internet.

As already mentioned above you might not need one but you should get yourself a firewall, Ubuntu has one but it's not enabled by default. UFW or UncomplicatedFireWall is ubuntu's solution. Enable it with the command

$ sudo ufw enable

you can then enable logging if you want with the command

$ sudo ufw logging on

If for whatever reason 'ufw' is not installed you can install it using both snap and apt package managers.

To install type

$ sudo snap install ufw

As already mentioned not many viruses are built or targeted for Linux. You would not have to worry about a MITM attack. Your only real risk is if someone is targeting you.