A common misconception is that Linux users never need to worry about malware. Yes, it's true that Linux is much more resistant to viruses than Windows is. But viruses are only one type of malware, and other types of malware can be planted on Linux machines. And, if you're running a server that will share files with Windows users, you'll want to make sure that you don't share any virus-infected files with them.

While Linux system log files are nice, they don't always give a good picture of who does what or who accesses what. It could be that either intruders or insiders are trying to access data that they're not authorized to access. What we really want is a good auditing system to alert us when people do things that they're not supposed to do.

And then there's the issue of regulatory compliance. Your organization may have to deal with one or more regulatory bodies that dictate how you harden your servers against attacks. If you're not in compliance, you could be fined or put out of business.

Fortunately, we have ways to deal with all of these issues, and they aren't all that complicated.

In this chapter, we'll cover the following topics:

• Installing and updating ClamAV and maldet
• Scanning with ClamAV and maldet
• SELinux considerations
• Scanning for rootkits with Rootkit Hunter
• Performing quick malware analysis with strings and VirusTotal
• Controlling the auditd daemon
• Creating audit rules
• Using the ausearch and aureport utilities to search the audit logs for problems
• oscap, the command-line utility for managing and applying OpenSCAP policies
• OpenSCAP Workbench, the GUI utility for managing and applying OpenSCAP policies
• OpenSCAP policy files and the compliance standards that each of them is designed to meet
• Applying a policy during operating system installation

If you're ready, let's begin by looking at a Linux-based virus scanning solution.