Honestly…as far as I’m concerned, for linux servers (any servers, but linux servers especially), there isn’t much value in a traditional AV client that runs on the server itself.
Viruses and malware come from people downloading crap and going to shady websites. People shouldn’t do that on servers, and it should be blocked anyway by web filters.
Honestly if a linux server even has a web browser and xorg/wayland installed, you already fucked up. I’d allow lynx in niche circumstances.
There should be security layers long before anybody gets to the linux server…namely IPS’s and firewalls.
Most enterprise firewalls have a way to block known-baddies on their first SYN. There are probably several community-driven blocklists that can be imported to other firewalls, or even directly into the host-based firewall (which should also be running, along with SELinux or AppArmor or whatever)
The real threats with linux servers are:
lateral spread
compromised accounts, poor privileged account management, or insider threat
exploited vulnerability, which is most likely the entrypoint.
Keep SELinux/AppArmor up, manage permissions properly, have webfilters, IPS, L4 Firewall, WAF (if appropriate) in-line, and have an automated patching strategy. AV software does none of this (and would probably ask you to disable SELinux as step 1 in troubleshooting…)
Oh, yeah, and run applications in unprivileged containers wherever possible.
IOW, the solution is good cyber hygiene. At the server admin level, the biggest concern should be managing RBAC and patches.
I only wish I had a spare device with specs good enough to properly run Snort. Having an IPS isn’t always an option, sadly, for people doing this at home.
I was fortunate to build a homelab right before the market went crazy. I invested heavily into 7th/8th gen intel and DDR4.
I’m actually about to part out my lab – I just sidegraded my CPU from 5700G to 5600X3D…so I’m gonna put the 5700G to the task of ‘all my eggs in one basket’.
But my current lab consists of:
Lenovo M710s for OPNsense
2x Lenovo M710s and 1x Ryzen 5825U uSFF in a kubernetes cluster (used to be 3x M710s, but I put the 5825U in there for the vega transcoding)
A NAS (i7-6700, all the DDR3 I could fit on the board, LSI controller, some disks, etc)
I’m hoping to put all that into the 5700G, and squeeze in my old RX570 for a VM responsible for Jellyfin, but I’ll have it boot to retroarch and set up sunshine on it, so it’ll basically just be a persistent gaming VM like an always-on console. That way I can play practically any console, on any device in my house. Or PC game somewhat decently from my laptops.
It’s in the fun stages now of homelabbing…gear is fucking expensive, what can I do with what I’ve already got (especially w/r/t gpus, memory, and storage).
I’ve got some M910q’s I gotta find a use for. I’m thinking HTPC (as part of de-googling my life and getting rid of my Google TV’s), but I need to find a good 10-foot, controller/remote driven interface that isn’t Kodi. It looks like Plasma Bigscreen is out now, I’ll need to check that out.
Honestly…as far as I’m concerned, for linux servers (any servers, but linux servers especially), there isn’t much value in a traditional AV client that runs on the server itself.
Viruses and malware come from people downloading crap and going to shady websites. People shouldn’t do that on servers, and it should be blocked anyway by web filters.
Honestly if a linux server even has a web browser and xorg/wayland installed, you already fucked up. I’d allow lynx in niche circumstances.
There should be security layers long before anybody gets to the linux server…namely IPS’s and firewalls.
Most enterprise firewalls have a way to block known-baddies on their first SYN. There are probably several community-driven blocklists that can be imported to other firewalls, or even directly into the host-based firewall (which should also be running, along with SELinux or AppArmor or whatever)
The real threats with linux servers are:
Keep SELinux/AppArmor up, manage permissions properly, have webfilters, IPS, L4 Firewall, WAF (if appropriate) in-line, and have an automated patching strategy. AV software does none of this (and would probably ask you to disable SELinux as step 1 in troubleshooting…)
Oh, yeah, and run applications in unprivileged containers wherever possible.
IOW, the solution is good cyber hygiene. At the server admin level, the biggest concern should be managing RBAC and patches.
I only wish I had a spare device with specs good enough to properly run Snort. Having an IPS isn’t always an option, sadly, for people doing this at home.
I was fortunate to build a homelab right before the market went crazy. I invested heavily into 7th/8th gen intel and DDR4.
I’m actually about to part out my lab – I just sidegraded my CPU from 5700G to 5600X3D…so I’m gonna put the 5700G to the task of ‘all my eggs in one basket’.
But my current lab consists of:
I’m hoping to put all that into the 5700G, and squeeze in my old RX570 for a VM responsible for Jellyfin, but I’ll have it boot to retroarch and set up sunshine on it, so it’ll basically just be a persistent gaming VM like an always-on console. That way I can play practically any console, on any device in my house. Or PC game somewhat decently from my laptops.
It’s in the fun stages now of homelabbing…gear is fucking expensive, what can I do with what I’ve already got (especially w/r/t gpus, memory, and storage).
I’ve got some M910q’s I gotta find a use for. I’m thinking HTPC (as part of de-googling my life and getting rid of my Google TV’s), but I need to find a good 10-foot, controller/remote driven interface that isn’t Kodi. It looks like Plasma Bigscreen is out now, I’ll need to check that out.