An antivirus scanner for Linux servers with Windows clients
Heedful Helper

© Lead Image © 3dalia, 123RF.com
The Sophos Anti-Virus for Linux free antivirus scanner works unobtrusively in the background and targets mainly server operators and users who exchange files with Windows computers.
Newcomers in particular wonder about the security of the still unfamiliar Linux operating system. Can you really do without an antivirus scanner on Linux, and if so, should you do so? Can you really bank online without an antivirus scanner? The answer has not changed in recent years: Linux itself does not need an antivirus scanner.
Antivirus scanners for Linux typically target server installations, looking for infected files and attachments on mail and file servers. As services, they thus run in the background. Sophos Anti-Virus (SAV) for Linux is in this group of scanners; the application comprises a service with a toolset for the command line. Don't expect visual feedback unless the Sophos scanner discovers something on your disk or you are attempting to store an infected, or purportedly infected, file.
Sophos Anti-Virus
SAV is available for free from the Sophos website [1] in exchange for your email address. The installation package, sav-linux-free-9.9.tgz
, weighs in at 423MB – antivirus programs are not exactly lightweight. To set up the application, unpack the archive and run the text-based installation routine as root:
$ sudo apt-get install linux-headers-amd64 build-essential $ tar xzf sav-linux-free-9.9.tgz $ sudo sophos-av/install.sh
The installation requires that you have the matching kernel headers and the most important build tools in place. DEB or RPM packages for a clean installation via your choice of package manager are not available at this time.
In the first step, the install wizard (Figure 1) tells you about the program. Pressing Enter takes you to the proprietary license; you can quit viewing the license by pressing Q, and accept by pressing Y. The installer then asks you whether you want the program to look for malware in the background, informs you of the file locations, and asks whether you really do want to use the "Free" version (i.e., do without support). You normally want to press Enter to keep the defaults; only in the case of the support question do you need to explicitly press F for the free version.
Finally, the installation routine, if needed, generates a kernel module to match your system's kernel, acting as the interface between the antivirus scanner and the system. Under normal circumstances, the installation will then complete without any trouble; in our lab with Ubuntu 14.04, Ubuntu 14.10, and Debian 7, I did not experience any issues. Although Sophos works on Debian 8, the service conflicts with systemd and cannot be controlled using the new init system.
Antivirus Scanner
Immediately after installing SAV, the antivirus scanner starts running in the background. Using either the savdstatus
command from the Sophos archive or standard init commands, you can check the status. The init commands also let you start and stop the scanner daemon as needed – Listing 1 shows the matching commands for an Ubuntu system.
Listing 1
SAV Commands
To ensure that SAV really works, copy the Eicar test string (a small MS-DOS executable that can be expressed with printable characters) on the Eicar.org website [2] and write the sequence to a file. Sophos should then detect what is ostensibly malware, keep you from opening the file, and point out that it has found an "infected" file (Figure 2). In a virtual terminal, Sophos shows a text-based alarm on opening the file. The antivirus tool also prevents access using network protocols like SSH, but as a user, you have no idea why the call did not work (Figure 3).

SAV does not come with a GUI. If you enabled the on-access scanner, the service works unobtrusively in the background. If you want to scan individual files or folders, you can open a terminal window and run the savscan
command (Listing 2, first line); you also need to turn to the terminal to update the signature database (Listing 2, last line). If auto-update is enabled, Sophos keeps the virus signatures up-to-date without intervention.
Listing 2
Manual File Scans
For manually triggered antivirus scans, you can pass in either a filename or directory name; for a directory, Sophos recursively searches for malware-infected programs and files. If you add the -di
option to the call, the scanner then attempts to disinfect the files; -remove
tells the program to delete the files instead. Detailed help for these commands is available from the program's man page (man savscan
).
If you want a graphical user interface, Sophos offers an optional web front end, and you can set it up using the test-based savsetup
configuration tool. To enable the web server, call the tool (Listing 3) and select item 2 from the menu to configure the SAV GUI. Once in the GUI, you can define a port and assign access credentials; again, your best option is to accept the defaults by pressing Enter.
Listing 3
Setting Up the GUI
After completing the configuration, you can access the GUI on http://localhost:8081 or from any other computer on http://<host IP>:<port>. The front end has a Home tab with an up-to-date overview (Figure 4).
Control lets you start and stop the on-access scanner as needed. Scanning lets you define whether Sophos should also search in archives and whether the antivirus scanner should disinfect or simply delete infected files. The other tabs let you exclude file types or paths from the search, define alerts, or view the antivirus scanner's logs.
Upgrade and Documentation
You can use Sophos Anti-Virus for Linux without charge both privately and for commercial purposes; for a surcharge you can upgrade to a "Premium" version with support and centralized management. For more information, visit the vendor's website or the forum set up for the Linux version [3]. The forum and FAQs [4] have very little content at the moment. The PDF documentation for installing [5] and configuring [6] the program provides you with far more help.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
KDE Plasma 5.27 Beta is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.
-
Gnome 44 Now Has a Release Date
Gnome 44 will be officially released on March 22, 2023.
-
Nitrux 2.6 Available with Kernel 6.1 and a Major Change
The developers of Nitrux have officially released version 2.6 of their Linux distribution with plenty of new features to excite users.
-
Vanilla OS Initial Release Is Now Available
A stock GNOME experience with on-demand immutability finally sees its first production release.
-
Critical Linux Vulnerability Found to Impact SMB Servers
A Linux vulnerability with a CVSS score of 10 has been found to affect SMB servers and can lead to remote code execution.
-
Linux Mint 21.1 Now Available with Plenty of Look and Feel Changes
Vera has arrived and although it is still using kernel 5.15, there are plenty of improvements sure to please everyone.