No, you do not need an Antivirus (AV) on Ubuntu to keep it secure.
You need to employ other "good hygiene" precautions, but contrary to some of the misleading answers and comments posted here, Anti-virus is not among them.
For starters, there seems to be a confusion in some of the top-rated answers here between two issues:
- Existence of viruses for Linux and
- Ability to actually infect a system.
These two are not the same. There definitely are 'viruses' that can run on Linux, but in order to make them run, a malicious user needs to get someone with local privilege to actively install them. This requires the owner of the system to trust the malicious user, download the software, and use
sudo with a password to install it, (or run it as a regular user to cause some regular-user level damage). Not a trivial set of barriers to overcome.
Unlike on some other systems, a regular user who keeps their Ubuntu system up-to-date on security fixes (very easy to do), cannot normally install something by accident (e.g. by opening an attachment, or clicking on something). The exception is unknown zero-day vulnerabilities, but for those AV will be totally ineffective anyway. An Ubuntu user doesn't work with admin privileges by default, and remote root logins are disabled.
In addition, Ubuntu comes with:
- Random address loading (which foils most drop-to-shell attempts)
- Application restrictions/barriers via
apparmor so an application like firefox can only access a very restricted subset of files and actions for example (see
- Built-in firewall (iptables) which can be set-up to be very restrictive
So to be secure, you need to adhere to basic rules of safety such as:
- Keep your software up to date
- Only run software downloaded from official repositories (or software you wrote yourself, or can audit the source code of)
- Only use your standard package-manager for installs. In particular do not install proprietary binary stuff from random sources which you can't audit by looking at the source code using
- Have a home firewall & do not run unnecessary services
- Regularly run some log scanning to detect unusual activity -- I recommend
- Add a local
iptables based firewall for another defense perimeter layer
- Keep your passwords long and secure (a good password manager is recommended). Use two-factor authentication wherever possible.
- Use encrypted sessions (use
scp, and not
- Use containers (e.g.
systemd-nspawn images) - by running software in isolation from the rest of the system, even the most buggy/vulnerable software, won't be able to cause damage outside its container. Container-technology means basically game-over for compromised software.
If you follow these sensible guidelines, you'd be way safer than you would be by installing a non-opensource 'AntiVirus' (how can you trust such software?) and falling into a false, and highly deluded, sense of security.
Of course, if a malicious user asks you to download
badstuff.deb from somewhere and install it by opening a terminal window and typing:
sudo dpkg -i badstuff.deb
and you oblige, all bets are off, and you have only yourself to blame for being infected. An AntiVirus is pretty unlikely to save you in this case. Unless this particular
badstuff.deb is among the finite set of blacklisted signatures.
As others have mentioned
clamav "for Linux" is designed as a scanning server to other (non-Linux) systems.
Some of the answers and comments here make the following non-sequitur claim: "since user-level damage can be very harmful (e.g. removing
$HOME and everything under it),
sudo access is irrelevant. You need AV anyway."
This is a red-herring logical fallacy. You can willfully (or accidentally) remove
$HOME anyway, with or without a virus. The critical question, is again: do you run random code from untrusted sources or not. If you do, AV (or any other precaution) won't save you from yourself willingly damaging your system.
On Ubuntu, the whole system and software repository ecosystem is designed to prevent running random code from random sources, thus installing an AV to "protect Ubuntu from viruses" is a waste of time and resources.
Some answers here suggest installing a commercial, non-open source, AV software on Linux. Don't do this. AV software runs with elevated privileges, often changes system-call semantics (e.g. change open() to scan a downloaded file and possibly fail), and consumes very significant (memory, CPU, disk, network) resources. Such software cannot be audited so it is impossible to trust. Installing such software on your otherwise pretty secure Linux system, would dramatically increase the surface of attack of your system and make it far less secure.
- Are signature based antivirus or anti-malware effective?
- What automated intrusion notification/detection setup is good for home desktop use?
- Is it easier to write viruses for Windows compared to OS-X and Linux (Quora)
- Google: Symantec antivirus flaws are "as bad as it gets"
- Setting up
iptables - Ask Ubuntu question
systemd-nspawn on Arch wiki