21

I have upgraded into Ubuntu 18.04.2 LTS. I have worked primarily with Windows and secondarily with Ubuntu (14.04 and 16.04). I will work with Ubuntu 18.04 as my main Operational System (distribution). I want to ask if it is necessary to install an anti-virus and if the answer is affirmative what is the better choice (free of course:-)!).

  • 6
    You don't need it -unless- you use Linux as a gateway and have Windows machines behind your gateway. Then you can scan your files before sending them to those machines. There are zero known virusses; any virus known is either a proof of concept that did not leave a laboratory setting or where you need to download and install it yourself. Stick to installing from official sources and there is near zero risk (not totally zero as Mint once got their website hacked, That kind of thing could happen to Canonical too ;) ) – Rinzwind May 5 at 14:28
  • 1
    If you are worried about security (and not only virus) you may want to have tools like rkhunter against rootkits and other malware – mattia.b89 May 5 at 15:28
  • 6
    Possible duplicate of Do I need to have antivirus software installed? – Fabby May 6 at 9:30
25

This article suggests not to, but if nonetheless you wish to install AV software, ClamTK downloadable from the Ubuntu Software Centre will provide some peace of mind.

Alternatively as described here you can open a terminal and type:

sudo apt-get install clamtk

or load it through Synaptic Package Manager.

  • 17
    The hit on performance, the time wasted scanning, wasted on negative results never ever will make up for the amount of linux virusses it will find. All these scanners are good for is scanning windows files. – Rinzwind May 5 at 14:32
  • @colbycdev That's a windows attitude you have there. Please do not apply that to Linux. We install software from --trusted-- sources. Period. That is all anyone must adhere to. Trusted sources are per definition free of malware (so not just virusses; also rootkits). Download random crap from the web and installing it where you provide your sudo password is on THAT user but not applicable to the whole Linux user base. Yes, rootkits are a thing but we are talking virusses here. Not rootkits. As there are ZERO virusses active for Linuix a scanner is only useful for scanning windows files. – Rinzwind May 6 at 12:45
  • Yes. I do security audits. " "Zero viruses" indicates you have not." Yes I have. There are zero active virusses for Linux . All of the 42 that might be a problem you need to install yourself. We are talking -virusses- not rootkits. virusses have 2 points of entry: mail and downloads. The 1st you do online and the 2nd you do from trusted sources. An admin provides for ONLINE mail and blocks ANY untrusted sources plus the execution of software by the user. Nowhere does a linux admin need a virusscanner for that – Rinzwind May 6 at 13:03
  • 1
    @Rinzwind Bad things can still happen from "trusted" sources. Look at the ME in Intel chips as a good start - yes, I know, hidden code in a hidden system but you still expect to be able to trust your own CPU. A bit of paranoia can't hurt. Also, not everyone installs from trusted sources. How do I know that the game files from GoG or HumbleBundle are not contaminated - beyond trusting those sources. It's not a bad idea to think like Windows users are forced to act in preparation to for the day when Linux becomes the next target. – Underverse May 6 at 14:05
18

Based on my experience from using Ubuntu as my main operating system for more than 5 years and 18.04 for more than one year, you do not need anti-virus software at all. I don't use it and never had any problems so far. That said, you should always adhere to the usual safety rules: Do not open/download unknown files, install software from trusted sources, keep your system updated, etc....

EDIT: See this article for further information.

  • 8
    I think personal experience is invalid argument here. Firstly personal habits can vary a lot and someone might be completely safe even on Windows 2000. Secondly not noticing any problems does not mean an uninfected system. – Carolus May 5 at 15:13
  • 1
    @Carolus you are right. It's just my experience, feel free to post your own as well. In this case there is no clear right or wrong, as it depends on many factors, but if most people (standard users) get along without AV, then it might be an indication for OP. – Ethunxxx May 5 at 15:33
10

Anti-virus software does not just look for viruses.

You will also want to look at rkhunter which looks for root kits.

While Linux/Unix has little notion of viruses, that does not mean to say that software cannot be loaded on to these systems through known vulnerabilities and be executed. Anti-virus software can also look for these.

  • I'm not sure the difference between a virus and a rootkit is a meaningful one at this level. – Federico Poloni May 6 at 22:30
7

No, you need no anti-virus program.

There are a few, but they look for Windows viruses. For example clamav is useful when you run a e-mail server and want to filter e-mails with virus attachments. But it is not very useful for Linux malware.

For Linux there is little malware at all and most of it is not targeting your desktop computer. The most common problem is malware installed via remote access tools (usually due to weak passwords) like SSH. It tends to send spam mails and scan for other vulnerable systems trying not to be found.

When a malware gets root access, it may try to hide using a rootkit. You can use rkhunter to find common rootkits. The program runs fast, as the list is rather short. There are tools like debsums to check all system programs for integrity, too.

As an Ubuntu user, you will get most software from the trusted repository of your distribution and that will keep you safe. Be aware that there are some harmful things you can do when following different advise to "just copy this into your terminal" or add PPA repositories from people you do not know.

A stupid and harmful joke is that people suggest to run rm -rf /, what deletes all files on your computer. (This one may be prevented by now, but a slightly different variant will still do the same).

Other things include running things without really understanding them, when your system is slightly different than the author's system. For example some howto for copying an ubuntu image to a usb stick may include dd if=ubuntu.img of=/dev/sdb. This will run fine when you have one hard disk (sda) and the usb stick (sdb). But when you have a second hard disk, the usb stick will be sdc and your second hard disk is sdb and you will overwrite your data.
So do not run scripts, you do not understand how they work, if you are not sure that the author thought about things like this.

In summary:

  • Use software from Ubuntu only (this is the default, if you do not add PPAs or download .deb packages or scripts)
  • Do not use SSH unless you need to
  • Use a good password, especially when allowing remote access
  • Do not run random commands, that some stranger one the internet recommended, if you do not understand what they do.
6

My reply to answers like:

"From my personal experience you don't need an antivirus"

From a cyber-security defense focused company, our cyber-security experts do recommend to use antivirus for Linux or MacOS. Indeed, it is an internal requirement to have antivirus installed in our workstations.

These systems have less market (if we don't take into account Android) then, also a smaller target from the bad guys and, therefore, viruses (and malware) are less common, and by Unix stronger design, it is more difficult to develop virus/malware for GNU/Linux, but sometimes safe options are disabled (as memory randomization in Linux), and, there is no safe software.

Also, remember that we all use Web browsers, and there are many browser centered attacks.

It is easy to think that you are protected because you use a Unix, like GNU/Linux, BSD or MacOS. But this is very wrong. Indeed:

  1. I had heard a similar answer from the MacOS community, and I have found myself bitcoin miners in MacOS laptops.

  2. I have also seen also in other companies old unprotected GNU/Linux servers (no updates, not proper firewall rules on the server SW FW, no anti-virus/anti-malware) being victims of ransomware attacks, under bitcoins demands to be decrypted.

  3. I have seen several cyber-security products packed into virtual appliances (used to distribute deployable VMs), and all come with ClamTk, a firewall, etc. If these guys include them, I tend to think there's a reason behind it.

So, my free advice: change your mindset, install ClamAV, ClamTk, check that your distro good firewall is enabled, and be careful on the Internet.

  • 1
    Typically, when servers are running bitcoin miners, it's not because they have viruses, but because software they are running has security vulnerabilities that have enabled attackers to gain access to them (which rarely involves installing viruses). Ransomware is slightly more likely to be caught by AV software, but odds still aren't great, partly because attackers may disable AV before proceeding. And this all overlooks the fact that AV software can, itself, have security vulnerabilities, so can leave you more vulnerable than you would be without it. – James_pic May 7 at 14:35
  • you are right, but malware I meant, trojans are also not viruses, but we abuse of language everyday, also, anti-virus prevent more than virus, the right name should be anti-malware (there are also products with that name), but, well, c'est la vie xD – xCovelus May 8 at 8:47
4

As already mentioned above you might not need one but you should get yourself a firewall, Ubuntu has one but it's not enabled by default. UFW or UncomplicatedFireWall is ubuntu's solution. Enable it with the command

$ sudo ufw enable

you can then enable logging if you want with the command

$ sudo ufw logging on

If for whatever reason 'ufw' is not installed you can install it using both snap and apt package managers.

To install type

$ sudo snap install ufw

As already mentioned not many viruses are built or targeted for Linux. You would not have to worry about a MITM attack. Your only real risk is if someone is targeting you.

  • that is a very good advice – xCovelus May 8 at 8:46
1

You do need to install antivirus linux can not have virus The system is so powerful its not like windows so no need Dont trouble yourself my friend

protected by Community Aug 22 at 5:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.