An antivirus scanner for Linux servers with Windows clients

Heedful Helper

© Lead Image © 3dalia,

© Lead Image © 3dalia,

Article from Issue 178/2015

The Sophos Anti-Virus for Linux free antivirus scanner works unobtrusively in the background and targets mainly server operators and users who exchange files with Windows computers.

Newcomers in particular wonder about the security of the still unfamiliar Linux operating system. Can you really do without an antivirus scanner on Linux, and if so, should you do so? Can you really bank online without an antivirus scanner? The answer has not changed in recent years: Linux itself does not need an antivirus scanner.

Antivirus scanners for Linux typically target server installations, looking for infected files and attachments on mail and file servers. As services, they thus run in the background. Sophos Anti-Virus (SAV) for Linux is in this group of scanners; the application comprises a service with a toolset for the command line. Don't expect visual feedback unless the Sophos scanner discovers something on your disk or you are attempting to store an infected, or purportedly infected, file.

Sophos Anti-Virus

SAV is available for free from the Sophos website [1] in exchange for your email address. The installation package, sav-linux-free-9.9.tgz, weighs in at 423MB – antivirus programs are not exactly lightweight. To set up the application, unpack the archive and run the text-based installation routine as root:

$ sudo apt-get install linux-headers-amd64 build-essential
$ tar xzf sav-linux-free-9.9.tgz
$ sudo sophos-av/

The installation requires that you have the matching kernel headers and the most important build tools in place. DEB or RPM packages for a clean installation via your choice of package manager are not available at this time.

In the first step, the install wizard (Figure 1) tells you about the program. Pressing Enter takes you to the proprietary license; you can quit viewing the license by pressing Q, and accept by pressing Y. The installer then asks you whether you want the program to look for malware in the background, informs you of the file locations, and asks whether you really do want to use the "Free" version (i.e., do without support). You normally want to press Enter to keep the defaults; only in the case of the support question do you need to explicitly press F for the free version.

Figure 1: SAV for Linux installs in a terminal window with an installation script.

Finally, the installation routine, if needed, generates a kernel module to match your system's kernel, acting as the interface between the antivirus scanner and the system. Under normal circumstances, the installation will then complete without any trouble; in our lab with Ubuntu 14.04, Ubuntu 14.10, and Debian 7, I did not experience any issues. Although Sophos works on Debian  8, the service conflicts with systemd and cannot be controlled using the new init system.

Antivirus Scanner

Immediately after installing SAV, the antivirus scanner starts running in the background. Using either the savdstatus command from the Sophos archive or standard init commands, you can check the status. The init commands also let you start and stop the scanner daemon as needed – Listing 1 shows the matching commands for an Ubuntu system.

Listing 1

SAV Commands

### Status query
$ /opt/sophos-av/bin/savdstatus
Sophos Anti-Virus is active
$ service sav-protect status
sav-protect start/running, process 5370
### On-access-Scanning stoppen
$ sudo service sav-protect stop
### Start on-access scanning
$ sudo service sav-protect start

To ensure that SAV really works, copy the Eicar test string (a small MS-DOS executable that can be expressed with printable characters) on the website [2] and write the sequence to a file. Sophos should then detect what is ostensibly malware, keep you from opening the file, and point out that it has found an "infected" file (Figure 2). In a virtual terminal, Sophos shows a text-based alarm on opening the file. The antivirus tool also prevents access using network protocols like SSH, but as a user, you have no idea why the call did not work (Figure 3).

Figure 2: When you try to open an infected file, SAV prevents access.
Figure 3: Sophos also blocks access to infected files over network protocols. Users do not learn why from the error logs, however.

SAV does not come with a GUI. If you enabled the on-access scanner, the service works unobtrusively in the background. If you want to scan individual files or folders, you can open a terminal window and run the savscan command (Listing 2, first line); you also need to turn to the terminal to update the signature database (Listing 2, last line). If auto-update is enabled, Sophos keeps the virus signatures up-to-date without intervention.

Listing 2

Manual File Scans

$ savscan /home
SAVScan anti-virus scanner program
Version 5.12.0 [Linux/AMD64]
Version virus data 5.13, March 2015
Detects 8899461 viruses, Trojans and worms
Copyright (c) 1989-2015 Sophos Limited. All rights reserved.
System time 22:30:55, system date April 11, 2015
Normal check
2243 files checked in 40 seconds.
No viruses were found.
End of Scan.
$ /opt/sophos-av/bin/savupdate

For manually triggered antivirus scans, you can pass in either a filename or directory name; for a directory, Sophos recursively searches for malware-infected programs and files. If you add the -di option to the call, the scanner then attempts to disinfect the files; -remove tells the program to delete the files instead. Detailed help for these commands is available from the program's man page (man savscan).

If you want a graphical user interface, Sophos offers an optional web front end, and you can set it up using the test-based savsetup configuration tool. To enable the web server, call the tool (Listing 3) and select item 2 from the menu to configure the SAV GUI. Once in the GUI, you can define a port and assign access credentials; again, your best option is to accept the defaults by pressing Enter.

Listing 3

Setting Up the GUI

$ sudo /opt/sophos-av/bin/savsetup
[1] Auto-updating configuration
[2] Sophos Anti-Virus GUI configuration
[q] Quit
What do you want to do? [2]

After completing the configuration, you can access the GUI on http://localhost:8081 or from any other computer on http://<host IP>:<port>. The front end has a Home tab with an up-to-date overview (Figure 4).

Figure 4: As an alternative to a GUI, SAV offers a web front end.

Control lets you start and stop the on-access scanner as needed. Scanning lets you define whether Sophos should also search in archives and whether the antivirus scanner should disinfect or simply delete infected files. The other tabs let you exclude file types or paths from the search, define alerts, or view the antivirus scanner's logs.

Upgrade and Documentation

You can use Sophos Anti-Virus for Linux without charge both privately and for commercial purposes; for a surcharge you can upgrade to a "Premium" version with support and centralized management. For more information, visit the vendor's website or the forum set up for the Linux version [3]. The forum and FAQs [4] have very little content at the moment. The PDF documentation for installing [5] and configuring  [6] the program provides you with far more help.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Virus Checkers

    So you want a virus checker? We’ll show you what we found when we toured some of the top scanners for the Linux environment.

  • KlamAV

    Linux may not be as virus-ready as Windows, but who wants to harbor pointless malware? Now you can hunt for viruses with KDE's KlamAV, a desktop front-end for the ClamAV Open Source virus protection system.

  • Pest Control: Free Virus Scanner AVG 8.5

    AVG Technologies has released a new version of its virus scanner for Linux as AVG 8.5. Biggest features are its malware protection, improved virus filter and on-access scanner based on the RedirFS filesystem.

  • Samba Antivirus

    Realtime virus scanning at the file server is an elegant and efficient option for protecting Windows clients. We’ll show you some tools and techniques for realtime scanning with Samba.

  • Security Lessons: ClamAV

    Protecting Windows clients from the big bad Internet.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95


njobs Europe
Njobs Netherlands Njobs Deutschland Njobs United Kingdom Njobs Italia Njobs France Njobs Espana Njobs Poland
Njobs Austria Njobs Denmark Njobs Belgium Njobs Czech Republic Njobs Mexico Njobs India Njobs Colombia