An antivirus scanner for Linux servers with Windows clients
Heedful Helper

© Lead Image © 3dalia, 123RF.com
The Sophos Anti-Virus for Linux free antivirus scanner works unobtrusively in the background and targets mainly server operators and users who exchange files with Windows computers.
Newcomers in particular wonder about the security of the still unfamiliar Linux operating system. Can you really do without an antivirus scanner on Linux, and if so, should you do so? Can you really bank online without an antivirus scanner? The answer has not changed in recent years: Linux itself does not need an antivirus scanner.
Antivirus scanners for Linux typically target server installations, looking for infected files and attachments on mail and file servers. As services, they thus run in the background. Sophos Anti-Virus (SAV) for Linux is in this group of scanners; the application comprises a service with a toolset for the command line. Don't expect visual feedback unless the Sophos scanner discovers something on your disk or you are attempting to store an infected, or purportedly infected, file.
Sophos Anti-Virus
SAV is available for free from the Sophos website [1] in exchange for your email address. The installation package, sav-linux-free-9.9.tgz
, weighs in at 423MB – antivirus programs are not exactly lightweight. To set up the application, unpack the archive and run the text-based installation routine as root:
$ sudo apt-get install linux-headers-amd64 build-essential $ tar xzf sav-linux-free-9.9.tgz $ sudo sophos-av/install.sh
The installation requires that you have the matching kernel headers and the most important build tools in place. DEB or RPM packages for a clean installation via your choice of package manager are not available at this time.
In the first step, the install wizard (Figure 1) tells you about the program. Pressing Enter takes you to the proprietary license; you can quit viewing the license by pressing Q, and accept by pressing Y. The installer then asks you whether you want the program to look for malware in the background, informs you of the file locations, and asks whether you really do want to use the "Free" version (i.e., do without support). You normally want to press Enter to keep the defaults; only in the case of the support question do you need to explicitly press F for the free version.
Finally, the installation routine, if needed, generates a kernel module to match your system's kernel, acting as the interface between the antivirus scanner and the system. Under normal circumstances, the installation will then complete without any trouble; in our lab with Ubuntu 14.04, Ubuntu 14.10, and Debian 7, I did not experience any issues. Although Sophos works on Debian 8, the service conflicts with systemd and cannot be controlled using the new init system.
Antivirus Scanner
Immediately after installing SAV, the antivirus scanner starts running in the background. Using either the savdstatus
command from the Sophos archive or standard init commands, you can check the status. The init commands also let you start and stop the scanner daemon as needed – Listing 1 shows the matching commands for an Ubuntu system.
Listing 1
SAV Commands
To ensure that SAV really works, copy the Eicar test string (a small MS-DOS executable that can be expressed with printable characters) on the Eicar.org website [2] and write the sequence to a file. Sophos should then detect what is ostensibly malware, keep you from opening the file, and point out that it has found an "infected" file (Figure 2). In a virtual terminal, Sophos shows a text-based alarm on opening the file. The antivirus tool also prevents access using network protocols like SSH, but as a user, you have no idea why the call did not work (Figure 3).

SAV does not come with a GUI. If you enabled the on-access scanner, the service works unobtrusively in the background. If you want to scan individual files or folders, you can open a terminal window and run the savscan
command (Listing 2, first line); you also need to turn to the terminal to update the signature database (Listing 2, last line). If auto-update is enabled, Sophos keeps the virus signatures up-to-date without intervention.
Listing 2
Manual File Scans
For manually triggered antivirus scans, you can pass in either a filename or directory name; for a directory, Sophos recursively searches for malware-infected programs and files. If you add the -di
option to the call, the scanner then attempts to disinfect the files; -remove
tells the program to delete the files instead. Detailed help for these commands is available from the program's man page (man savscan
).
If you want a graphical user interface, Sophos offers an optional web front end, and you can set it up using the test-based savsetup
configuration tool. To enable the web server, call the tool (Listing 3) and select item 2 from the menu to configure the SAV GUI. Once in the GUI, you can define a port and assign access credentials; again, your best option is to accept the defaults by pressing Enter.
Listing 3
Setting Up the GUI
After completing the configuration, you can access the GUI on http://localhost:8081 or from any other computer on http://<host IP>:<port>. The front end has a Home tab with an up-to-date overview (Figure 4).
Control lets you start and stop the on-access scanner as needed. Scanning lets you define whether Sophos should also search in archives and whether the antivirus scanner should disinfect or simply delete infected files. The other tabs let you exclude file types or paths from the search, define alerts, or view the antivirus scanner's logs.
Upgrade and Documentation
You can use Sophos Anti-Virus for Linux without charge both privately and for commercial purposes; for a surcharge you can upgrade to a "Premium" version with support and centralized management. For more information, visit the vendor's website or the forum set up for the Linux version [3]. The forum and FAQs [4] have very little content at the moment. The PDF documentation for installing [5] and configuring [6] the program provides you with far more help.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
News
-
Deepin 23 Preview Release is Available For Testing
The developers of Deepin have made a preview release of their latest offering available with three exciting new features.
-
The First Point Release For Ubuntu 22.04 is Now Available
Canonical has released the first point upgrade for Jammy Jellyfish which includes important new toolchains and fixes.
-
Kali Linux 2022.3 Released
From the creators of the most popular penetration testing distributions on the planet, comes a new release with some new tools and a community, real-time chat option.
-
The 14" Pinebook Pro Linux Laptop is Shipping
After a considerable delay, the 14" version of the Pinebook Pro laptop is, once again, available for purchase.
-
OpenMandriva Lx ROME Technical Preview Released
OpenMandriva’s rolling release distribution technical preview has been released for testing purposes and adds some of the latest/greatest software into the mix.
-
Linux Mint 21 is Now Available
The latest iteration of Linux Mint, codenamed Vanessa, has been released with a new upgrade tool and other fantastic features.
-
Firefox Adds Long-Anticipated Feature
Firefox 103 has arrived and it now includes a feature users have long awaited…sort of.
-
System76 Refreshes Their Popular Oryx Pro Laptop with a New CPU
The System76 Oryx Pro laptop has been relaunched with a 12th Gen CPU and more powerful graphics options.
-
Elive Has Released a New Beta
The Elive team is proud to announce the latest beta version (3.8.30) of its Enlightenment-centric Linux distribution.
-
Rocky Linux 9 Has Arrived
The latest iteration of Rocky Linux is now available and includes a host of new features and support for new architecture.