[ILUG] Anti-Virus for LINUX/UNIX

[Paul J Collins]

>>>>> "WC" == Wynne, Conor <Conor.Wynne at compaq.com> writes:

    WC> I - currently - don't have a bogs notion what ssh is for. I
    WC> "presume" that its for tunnelling to your box through a
    WC> firewall, is this anyway right? I noticed its a feature of the
    WC> newer smoothwall (http://www.smoothwall.org) I installed last
    WC> night. So needless to say its the next thing on my HUGE list
    WC> of things to learn!

ssh is a secure replacement for telnet.  The whole tunneling stuff is
built ontop of that; when you log in via ssh, you also ask it to
encrypt and forward X clients from the remote machine to your local
machine.  It's useful too for collecting POP mail from a box that you
have shell access to without allowing your passwords to go over the
network in the clear.

ssh good; telnet bad.

    WC> Do you guys/gals use ssh in the real world?

A number of people on this list do, for things such as secure rsync
backups across the open Innurnet and various kinds of forwarding; I
mainly use it to connect to Zork.  I also run it by default instead of
telnet on any boxes that are non-sacrificial.

    WC> But surely we should still have some sort of anti-vandal/virus
    WC> app aswell? I know - or so I have read - that there has never
    WC> been a viral attack on a linux box in the "real" world to
    WC> date, but you never know.

It is extremely difficult to wrtie a successful virus for most
variants of Unix.  Even a desktop Linux box that was installed using
the "Next, Next, Next, Reboot" methodology will at least prevent
random users from overwriting system files; of course, root is
all-powerful, but you don't run random files as root, do you?  By
contrast, even NT servers can be set up with a FAT C drive, which
allows *anyone* over-write *any* file. (It's no use saying "format C
as NTFS"; many Microsoft configurations *require* a FAT C drive.)
Please don't quote Simson Garfinkel in relation to this; he has no
clue about viruses when it comes to *nix boxes.

    WC> Does anyone know what is on TCP or is it UDP port 137? I keep
    WC> getting attacks on this port at various time during the night.

It's used for Windows networking name service (see /etc/services for a
list of assigned ports).  Someone on your ISP's subnet might be
running a Windows box with NetBIOS bound to the Dial-Up Adapter, or
else someone is trying to see if you're running Samba (or Windows!).
Just make sure not to have Samba listening on any Internet-connected
interfaces (cf. "interfaces" and "bind interfaces only" in smb.conf).

I see a lot of connects to 137 since I started using OceanFree at home.

-- 
"Pity has no place at my table."
      -- Dr Hannibal Lecter