No, you do not need an Antivirus (AV) on Ubuntu to keep it secure.
And sadly, this is an example of where Stack-Exchange reputation system has failed to promote correct answers while some opinionated and misinformed early "answers" got many upvotes
You need to employ other "good hygene" precautions, but contrary to some of the misleading answers posted here, AV is not among them.
For starters, there seems to be a confusion in some of the top-rated answers here between two issues:
- Existence of viruses for Linux and
- Ability to actually infect a system.
These two are not the same. There definitely are 'viruses' that can run on Linux, but in order to make them run, a malicious user needs to get someone with local privilege to actively install them. This requires the owner of the system to trust the malicious user, download the software, and use sudo with a password to install it, (or run it as himself to cause some regular-user level damage). Not a trivial set of barriers to overcome.
Unlike on some other systems, a regular user who keeps his Ubuntu system up-to-date on security fixes (very easy to do), cannot normally install something by accident (e.g. by opening an attachment, or clicking on something). The exception is unknown zero-day vulnerabilities, but for those AV will be totally ineffective anyway. A Ubuntu user doesn't run with admin privileges by default, and remote root logins are disabled.
In addition, Ubuntu comes with:
- Random address loading (foils most drop to shell attempts)
- Application restrictions/barriers via
apparmor so an application like firefox can only access a very restricted subset of files and actions for example (see
- Built in firewall (iptables) which can be set-up to be very restrictive
So to be secure, you need to adhere to basic rules of safety such as:
- Keep your software up to date
- Only run software downloaded from official repositories
- Only use your standard package-manager for installs. In particular do not install proprietary binary stuff from random sources which you can't audit by looking at the source code using
- Have a home firewall & do not run unnecessary services
- Reguarly run some log scanning to detect unusual activity (I recommend
- Add a local
iptables based firewall for another defense perimeter layer
- Keep your passwords long and secure (a good password manager is recommended)
- Use encrypted sessions (use
scp, and not
And similar good habits along these lines. If you do, you'd be way safer than you would be by installing an non-opensource 'AntiVirus' (how can you trust such software?) and falling into a false, and highly deluded, sense of security.
Of course, if a malicious user asks you to download
badstuff.deb from somewhere and install it by opening a terminal window and typing:
sudo dpkg -i badstuff.deb
and you oblige, all bets are off, and you have only yourself to blame for being infected. An AntiVirus is pretty unlikely to save you in this case. Unless this particular
badstuff.deb is among the finite set of blacklisted signatures.
As others have mentioned
clamav "for Linux" is chiefly designed as a scanning server to other (non Linux) systems.
Some of the top-rated answers here make the following non-sequitur claim: since a user-level damage can be very harmful (e.g. removing $HOME and everything under it), sudo access is irrelevant to the need for AV. This is an obvious fallacy since you can accidentally or willfully remove $HOME anyway, with a "virus" or not. The issue and critical question, is again: do you run random code from untrusted sources or not. If you do, AV (or any other precaution) won't save you from yourself willingly damaging your system. Since on Ubuntu the whole system and software repository eco-system is designed to prevent running random code from random sources, an AV to "protect Ubuntu from viruses" is a waste of time and resources.
- Are signature based antivirus or anti-malware effective?
- What automated intrusion detection and notification are good for destop use?