tickmike Posted August 11, 2006 Posted August 11, 2006 Hello All. I'm Still setting up this W2K.. DC server for the first time and now feel I'm getting there, Its for this local charity run school. My next question is do I need anti-virus software to run on the server ?. On the 30 computers in the school I have all free AV software also free firewall ,anti-spyware , anti-malware .etc..... But the free AV will not run on the server !. Does anyone know of any free AV software that can be used on a server.?. What risk do I run if I did not have AV software on the server and just had it on the workstations ?. Has many of you had attacks on your servers and what happened ? Regards Michael. PS I've only had one virus in the school on one workstation in 7 years .
Dos_Box Posted August 11, 2006 Posted August 11, 2006 Yes you should have AV software on the server, but you should only use it to run schedueled scans and not actively scan every file being accessed. This would kill your server if you did. If you simply setup a scheduled scan for 9pm (or whenever your backups usually finish) then this will , if configured correctly, either e-mail you or simply log the details. Ensure you look at these logs daily though as quite often they tell you who is copying nasties to there user areas.
Dos_Box Posted August 11, 2006 Posted August 11, 2006 PS I've only had one virus in the school on one workstation in 7 years . What!! Are you sure your AV software was working correctly? Usually we do not get infections but the amount of alerts I receive of attemted installs and other files being brought in are an almost daily occurence.
tickmike Posted August 11, 2006 Author Posted August 11, 2006 PS I've only had one virus in the school on one workstation in 7 years . What!! Are you sure your AV software was working correctly? Usually we do not get infections but the amount of alerts I receive of attemted installs and other files being brought in are an almost daily occurence. I think it came off a floppy / cd rom from pupil's home. AV software found it and held it.
Geoff Posted August 11, 2006 Posted August 11, 2006 I find spyware/trojans most prevelant at schools. Usually downloaded from the internet.
Ric_ Posted August 11, 2006 Posted August 11, 2006 I concur that you MUST run scheduled scans on the server. Ideally, you would want a centrally managed solution reporting all of your spyware/malware/viruses back to one point but cost is going to be prohibitive. What AV software have you tried and what do you currently use on your worstations? I have found ClamWin to be a very good and the virus definitions are regularly updated - it is a Windows port of the very popular ClamAV for *nix systems.
plexer Posted August 11, 2006 Posted August 11, 2006 Clamwin doesn't have an on access scanner at the moment but it is being developed for the next major release. Would anyone consider using this alone on all your machines instead of paying sophos etc...??? Ben
MkII Posted August 11, 2006 Posted August 11, 2006 ClamWin is properly free for use at school as well, I don't think most others are.
Ric_ Posted August 11, 2006 Posted August 11, 2006 @plexer: You don't want on-access scanning on a server!
Geoff Posted August 11, 2006 Posted August 11, 2006 ClamWin is GPL because it's based on the *nix scanner ClamAV. Therefore you can use it at school. I use it at home and have had no major issues with it.
Ric_ Posted August 11, 2006 Posted August 11, 2006 I have ClamAV (via CopFilter) on my IPCop box and ClamWin on my PC at home. I also have some apps (like Juice) run a virus scan on any files they download... just to be on the safe side
tickmike Posted August 12, 2006 Author Posted August 12, 2006 Hello Everyone. Thanks for that info ( As I had said before this is a great site) You have just saved this charity a big chunk of money (all money to run the school comes from the parents raising it with non from the government) Re "plexer" Being an ex scientist I'm willing to try this 'clamwin' AV on the server . At home I downloaded it and then installed it on my 'test server' did the updates then a scan...all seems ok. I know I should not but its a charity, I use AVG ,Zonealarm,SpywareBlaster,Spy-bot,Adaware,A Squared (free ones) on each workstation. AVG, Spy-bot do auto updates . As an experiment for about 6 months I have only been using 'SpywareBlaster' to look after the spy/malware (you can get a commercial version with auto updates) then using 'Adaware and Spy-bot' to check the results . Conclusion only getting odd one or two things getting through.Also A-squared seems good as well, Re "ric" I was thinking of trying Ipcop is it easy to configure just trying smoothwall. Regards Michael.
plexer Posted August 12, 2006 Posted August 12, 2006 @plexer: You don't want on-access scanning on a server! When I said all machines I was reffering to using it on workstations when the on access is available instead of paying loadsa money for another commercial product. Ben
ITWombat Posted August 12, 2006 Posted August 12, 2006 Back to the original question. Yes the convesntional wisdom is to put AV on anything that runs antivirus but less step back a moment. If all the clients have AV and the server is patched then is it really necessary on a file server. There's probably stronger case for on a mail server because of the greater risk of automatic replication. This means breaking th e on-access rule but narrowing down to scanning the /var/spool/mail folder (or the Exchange equivalent). What do other people use for mail, Sophos or something else?
eejit Posted August 12, 2006 Posted August 12, 2006 I must admit that we DO have Symantec Antivirus running on the server and it examines files in real-time. I've never noticed it causing too many resource problems.
ITWombat Posted August 12, 2006 Posted August 12, 2006 Let's not forget that Ric runs a thin client environment so that's why he might be so emphatic on the no on-access on servers rule.
tickmike Posted August 12, 2006 Author Posted August 12, 2006 Hi. The pupils are not allowed email so that's not a problem. no email server. And for the teachers I set up outlook express on the office computer but they will insist on using the web browser access to there emails in the class after school . Is that a security risk ?. Michael
ITWombat Posted August 12, 2006 Posted August 12, 2006 What does tOutlook Express on staff PCs connect to? Are you using email accounts hosted by your ISP?
tickmike Posted August 12, 2006 Author Posted August 12, 2006 Hello . No staff personal PC's, just the staff and some parents use the office one for admin and email etc. Very small school with 30 PC's and run by the parents with three teachers. Its Hotmail for the school email, unfortunately one of the teachers set it up just after the school went on the internet instead of letting me set one up with our ISP. !. And what the teachers personal email accounts are I have no idea. With having av and firewalls on each workstation I hope if they did open a bad email it will contain it to the one PC.?. Or would it be a good idea to ask/tell them to only use the office PC for emails ? Regards Michael.
Ric_ Posted August 14, 2006 Posted August 14, 2006 @ITWombat: The terminal servers have on-access scanning... I tend to treat those like workstations There's not too much security risk with your email situation there tickmike. If the kids start using email, you will need to use a system where by you can monitor the traffic (big brother style) for child protection and all that malarky. It also looks better if your letterhead doesn't have a hotmail address on it
ITWombat Posted August 14, 2006 Posted August 14, 2006 @ITWombat: The terminal servers have on-access scanning... I tend to treat those like workstations So does Cray do educational pricing these days?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now