Hi there, On Mon, 14 Sep 2020, bobby via clamav-users wrote:
I plan to use it for email processing. I am using postfix currently. There are no other users besides myself, and it's only one domain.
What mail clients will there be? Any Windows boxes? To protect a Linux box against malware is relatively straightforward[*]. I use Linux more or less exclusively and I use ClamAV because I do a lot of spam processing, not because I feel the need for protection. For mail scanning you'd normally run two daemons, 'clamd' which is the actual scanner and a 'milter'. The milter takes messages from the MTA and passes them to clamd for scanning, then advises the MTA of clamd's findings. That might explain your confusion about services but I know little about the way Centos does things. ClamAV provides a milter, unsurprisingly called 'clamav-milter'. It does a bit more than I've described here but that's its main job. Personally I prefer not to use the distro-specific versions of things like ClamAV, partly because the distro maintainers almost invariably mess with things to comply with "policies" and partly because they're often not quite as up to date as you'd like in something like a virus scanner. ClamAV isn't so very difficult to install from source, and you'll learn a lot about it in the process. OTOH on security grounds you might not want for there to be a compiler available on the box - I would certainly not want one on a firewall for example.
This may be a silly question to ask here... but is there any other decent anti-virus software that does not take up as many resources?
If you want open source, I don't think there's anything else. There are commercial packages. I don't know how they compare for resource usage as I have no experience of any of them. See e.g. https://en.wikipedia.org/wiki/Comparison_of_antivirus_software#Linux A very few claim to be free, but you will still need a (proprietary) licence and probably have to accept some terms before you even get a copy of the package.
I am currently running my box in DO, and it looks like the next step up for RAM is 4GB.
DO == Digital Ocean? AS14061 is in my block list. :) -- 73, Ged. [*] Don't run any network-listening daemons that you don't have to, don't accept any connections you don't have to, and don't accept any connections from China and a bunch of other places with, er, history. Use common sense browsing habits - like using advertising and script blockers, not visiting porn sites etc. Of course keep the security patches up to date, don't let things run as root if they don't have to, don't run anything you don't have good reason to trust, use good passwords and don't give them away. Any number of places on the net can probably add a few items to that short list. This approach is a lot less likely to fail because of a zero-day vulnerability which the virus scanners haven't yet caught up with. Postfix itself will need to listen to the network so make sure if it is compromised by a zero- day vulnerability the user which runs Postfix can't do anything bad to the box (the same theory applies to clamd and any milters) without at least exploiting _another_ vulnerability to get elevated privileges. If you've done your homework well and kept on top of things there most probably won't be one. Unluckily if you're using a provider to supply the machine itself it's most likely virtual, meaning a vulnerability in the VM could be used to exploit not only _your_ VM, but very likely thousands of others as well. In that case, expect not to recover it. You'll want to know that you have backups you can rely on; to me that means it's in my office, not in some cloud in nobody-knows-where, and I made it last night. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
