Hello everyone, I have some questions and need food for thought about clamAV. First, do you use it and why ? If yes, how are you running it ? I plan to maybe use it for nextcloud (and *arr stack later)
Antivirus as a thing is mostly dead, or has morphed into more aggressive endpoint protection. In that sense ClamAV is mostly to scan for known malware in things like mail servers. Make sure people aren’t sending malicious stuff, albeit mostly low hanging fruit.
Nextcloud, wikis, or other similar aggregation sites are also a usecase, but again low hanging fruit.
Set up a cron job and have it run periodically, like once an hour / day / week, whatever. Make sure you set up something that alerts you if/when it hits on something.
ClamAV is great for exactly one thing: checking the “has antivirus” checkbox on company security audits.
Don’t get me wrong, it’s a real AV product, but there’s no real need for it. You’ll get much better results just being careful about what you run and having a system and network firewall. And not running everything as root.
I do use ClamAV. Most users just run some sort of daily scan, but this is remedial and not preventative.
In order to truly harness clamav’s potential, you need to configure clamonacc on-access scanning. It passes items off to clamd with lowered privileges and prevents file access through inotify until its realtime scan has cleared.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
ClamAV is mostly for filtering things on mail servers or uploads to a shared resource like a wiki.
You can also use it as a system virus scanner, but most viruses it detects are Windows viruses.
So, for nextcloud and automatic torrenting it should not be too bad to protect windows users ?
Antivirus as a thing is mostly dead, or has morphed into more aggressive endpoint protection. In that sense ClamAV is mostly to scan for known malware in things like mail servers. Make sure people aren’t sending malicious stuff, albeit mostly low hanging fruit.
Nextcloud, wikis, or other similar aggregation sites are also a usecase, but again low hanging fruit.
Set up a cron job and have it run periodically, like once an hour / day / week, whatever. Make sure you set up something that alerts you if/when it hits on something.
ClamAV is great for exactly one thing: checking the “has antivirus” checkbox on company security audits.
Don’t get me wrong, it’s a real AV product, but there’s no real need for it. You’ll get much better results just being careful about what you run and having a system and network firewall. And not running everything as root.
I use it. I think it was a hardening recommendation from lynis IIRC.
I definitely experienced a lot more freezing on my laptop after installing it (it’s a memory hog) so I upped my swap and things are back to normal.
I do use ClamAV. Most users just run some sort of daily scan, but this is remedial and not preventative.
In order to truly harness clamav’s potential, you need to configure clamonacc on-access scanning. It passes items off to clamd with lowered privileges and prevents file access through inotify until its realtime scan has cleared.