Do I Need Anti-Virus Software On A Server..?...

Hello All.
I'm Still setting up this W2K.. DC server for the first time and now feel I'm getting there, Its for this local charity run school.

My next question is do I need anti-virus software to run on the server ?.

On the 30 computers in the school I have all free AV software
also free firewall ,anti-spyware , anti-malware .etc..... But the free AV will not run on the server !.

Does anyone know of any free AV software that can be used on a server.?.

What risk do I run if I did not have AV software on the server and just had it on the workstations ?.

Has many of you had attacks on your servers and what happened ?

Regards Michael.

PS I've only had one virus in the school on one workstation in 7 years .

Yes you should have AV software on the server, but you should only use it to run schedueled scans and not actively scan every file being accessed. This would kill your server if you did. If you simply setup a scheduled scan for 9pm (or whenever your backups usually finish) then this will , if configured correctly, either e-mail you or simply log the details. Ensure you look at these logs daily though as quite often they tell you who is copying nasties to there user areas.

Quote:

---

PS I've only had one virus in the school on one workstation in 7 years .

---

What!! Are you sure your AV software was working correctly? Usually we do not get infections but the amount of alerts I receive of attemted installs and other files being brought in are an almost daily occurence.

Quote:

---

Originally Posted by Dos_Box

Quote:

---

PS I've only had one virus in the school on one workstation in 7 years .

---

What!! Are you sure your AV software was working correctly? Usually we do not get infections but the amount of alerts I receive of attemted installs and other files being brought in are an almost daily occurence.

---

I think it came off a floppy / cd rom from pupil's home. AV software found it and held it.

I find spyware/trojans most prevelant at schools. Usually downloaded from the internet.

I concur that you MUST run scheduled scans on the server. Ideally, you would want a centrally managed solution reporting all of your spyware/malware/viruses back to one point but cost is going to be prohibitive.

What AV software have you tried and what do you currently use on your worstations? I have found ClamWin to be a very good and the virus definitions are regularly updated - it is a Windows port of the very popular ClamAV for *nix systems.

Clamwin doesn't have an on access scanner at the moment but it is being developed for the next major release. Would anyone consider using this alone on all your machines instead of paying sophos etc...???

Ben

ClamWin is properly free for use at school as well, I don't think most others are.

@plexer: You don't want on-access scanning on a server!

ClamWin is GPL because it's based on the *nix scanner ClamAV. Therefore you can use it at school.

I use it at home and have had no major issues with it.

I have ClamAV (via CopFilter) on my IPCop box and ClamWin on my PC at home. I also have some apps (like Juice) run a virus scan on any files they download... just to be on the safe side ;)

Hello Everyone.
Thanks for that info ( As I had said before this is a great site) You have just saved this charity a big chunk of money (all money to run the school comes from the parents raising it with non from the government)

Re "plexer" Being an ex scientist I'm willing to try this 'clamwin' AV on the server .

At home I downloaded it and then installed it on my 'test server' did the updates then a scan...all seems ok.

I know I should not but its a charity, I use AVG ,Zonealarm,SpywareBlaster,Spy-bot,Adaware,A Squared (free ones) on each workstation.
AVG, Spy-bot do auto updates .

As an experiment for about 6 months I have only been using 'SpywareBlaster' to look after the spy/malware (you can get a commercial version with auto updates) then using 'Adaware and Spy-bot'
to check the results .
Conclusion only getting odd one or two things getting through.Also A-squared seems good as well,

Re "ric" I was thinking of trying Ipcop is it easy to configure just trying smoothwall.

Regards Michael.

Quote:

---

@plexer: You don't want on-access scanning on a server!

---

When I said all machines I was reffering to using it on workstations when the on access is available instead of paying loadsa money for another commercial product.

Ben

Back to the original question. Yes the convesntional wisdom is to put AV on anything that runs antivirus but less step back a moment. If all the clients have AV and the server is patched then is it really necessary on a file server.

There's probably stronger case for on a mail server because of the greater risk of automatic replication. This means breaking th e on-access rule but narrowing down to scanning the /var/spool/mail folder (or the Exchange equivalent).

What do other people use for mail, Sophos or something else?

I must admit that we DO have Symantec Antivirus running on the server and it examines files in real-time. I've never noticed it causing too many resource problems.