Anti-Virus And Firewall Suggestions

Ste-

Have a Mandrake 9.1 installed but as yet haven't the internet running on it.
Before I do I wanna make sure I have a few things running first. I.e. an anti-virus and firewall.
I know there's not much need for an anti-virus.
Should I bother with one ?
I know firewalls are essential what's the best ?
Can anyone suggest anything for either.
Free as well please.
Thanks.

Ste-

Gavin

You don't really need a firewall if it's just a standalone machine, ie no network behind it. Edit /etc/services and disable any active services in it. Disable any network daemons, you have running. Perhaps sshd, sendmail, whatever mandrake uses as the default.

If you do have a network, just get your services to listen on the internal network interface and disable ip forwarding. If you are using the machine for NAT, then a firewall is probably a good idea. You can use iptables to restrict traffic.

Gav

leeroybrown

IPTables is the standard (kernel supported) method of firewaling a linux box. The netfilter support and other kernel options _should_ be compiled into your Mandrake packaged kernel.

Shorewall is one example of a user friendly iptables rule generator. It's more than likely packaged with Mandrake.

mneylon

For AV on linux: http://www.f-prot.com

thecivvie

I use and recommend ClamAV CLamAV Web SIte

Sean

mneylon

Originally posted by tcob1
I use and recommend ClamAV CLamAV Web SIte

Sean

ClamAv isn't bad, but it has issues with zip files at times

thecivvie

Originally posted by blacknight
ClamAv isn't bad, but it has issues with zip files at times

These appear to be sorted in the latest stable and the cvs as well, I run a BBS/Fidonet system and most files are zips

Sean

nadir

Id reccomend just running a simple firewall and maybe somthing like qmail scanner http://qmail-scanner.sourceforge.net/ for e-mail, but tbh you prolly dont even need that.

for a firewall, you need to build netfilter in the kernel as leeroybrown was saying, just go to the kernel config and build in all of netfilter, if something fails just remove what failed and try again, but it should be fine.
this is the firewall im using atm so it like accepts all outbound connections from internal ips assuming that you have eth0 internal and ppp0 to the interweb, and implements ip forwarding and a couple of other little trimmies. Very simple, should be easy to edit, i wouldnt use it in a professional enviornment though, lol.

#nadir's funky firewall thingie
modprobe ip_nat_irc
#set vars
#UNPRIVPORTS="30000:35000" # unprivileged port range


# Remove any existing rules from all chains
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -t mangle -F OUTPUT
#block all incoming ppp0 connections
iptables -A INPUT -d 10.0.0.0/8 -i ppp0 -j DROP
iptables -A INPUT -m state --state NEW,INVALID -i ppp0 -j DROP
#iptables -A INPUT -m state --state ! INVALID -j INCOMING
iptables -A INPUT -p tcp --syn -i ppp0 -j DROP
#allow for existing connections from eth0 <-> ppp0
iptables -A FORWARD -i eth0 -o ppp0 -m state --state ESTABLISHED,RELATED -j ACC
PT
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
#additional rules for services, DNS .etc
iptables -I INPUT 1 -p tcp -m multiport --dport 21,22,113,139,445 -j ACCEPT
iptables -I INPUT 1 -p udp -m multiport --dport 53,137,138, -j ACCEPT
iptables -I INPUT 1 -p tcp -m multiport --sport 53 -j ACCEPT
iptables -I INPUT 1 -p udp -m multiport --sport 53 -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
#enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# to list nat-iptable:: iptables -t nat -nL
echo "initializing firewall rule set"
#echo "

---

Rules are

---

"
#list rules
iptables -t nat -nL
iptables --list

leeroybrown

I admin two mail servers (exim) that run ClamAV (via Amavis) and I have to say it's excellent for that purpose anyway.

zAbbo

f-prot is easy to setup, just make a cron job with whatever command you want to run, something like this

f-prot / -append -packed -wrap -report=/var/log/virus-report.log

Thats scans everything "/" you can set it to whereevr u want and have the log to wherever to

using mandrake just go as root $urpmi f-prot
thatll download and install it