4

This may sound like a duplicate of Free ClamAV alternative working with Amavis on Linux ARMHF but in reality my ultimate needs are slightly different in that I don't have an armhf restriction.

ClamAV, while it works as a decent antivirus scanner, is very evil and inefficient, and tends to eat up memory resources. On my 1GB server where I've set up a mail server (PostFix + DoveCot + Amavis + SpamAssassin + SPF + DKIM + DMARC), I can't enable the Amavis antivirus functions because ClamAV takes up in excess of 50% of the server's RAM, and it starts to swap after that (NOT GOOD!).

So, I'm after a lighter-weight alternative.

REQUIREMENTS

  • Lightweight
  • Good detection rate, low false-positive rate
  • Can integrate with amavisd-new

Optional Requirements:

  • Free (preferred)
  • Open Source (preferred)
  • Easy to install (.deb file or a repository)

Most of these reqs are identical to the other recommendation inquiry from 2015 that got nothing, but as I'm very fluent in how Linux and such works, I just need the antivirus component and am not as picky about it architecture-wise.

3
  • 1
    Yeah. And my linked question from 2015 still has not a single answer :( So meanwhile, +1 for yours – hopefully you're more lucky, and ideally the answer you will get works with ARMHF as well then, so I can get rid of that memory hog finally (which, BTW, fails to work often enough – with Amavis reporting no AV scanner was available)…
    – Izzy
    Commented Apr 4, 2017 at 8:29
  • @Izzy I was considering finding some type of AV wrapper that would let me dump the content to a separate server for AV analysis, but I'm lazy as all heck and with the amount of filtering on my network malware wouldn't get far (yay Snort heh, plus other analysis tools for ingressing traffic heh) Commented Apr 4, 2017 at 16:34
  • @Izzy yeah, well I'm only finding amd64/i386 solutions, and they are not free. My guess is clamav is probably the only solution lying around, but if I had some extra money I might be able to test the Avast Core Security. It seems also that most Server style scanner software is paid which may explain why your 2015 question has zero answers... ClamAV is the only free one I've found so far... real tempted to see if I can configure a remote ClamAV... Commented Apr 4, 2017 at 16:53

1 Answer 1

4

This answer will change as my research and testing continues.

As of August 12, 2017, I am accepting this as my answer, but I am going to continue to expand on this list as I find new potential alternatives. I still prefer Avast due to its memory footprint and cost effectiveness, but YMMV.

Just to make a note, I did some research based on the amavisd-new package's 15-av_scanners file in /etc/conf.d from the Ubuntu repository and came across Avast and some other solutions. Note that most of the solutions I've found are not free.


Avast Core Security for Linux

While most of the other solutions are not free, I have requested trial licenses for 30 days from Avast for their Avast Core Security Linux suite, which provides the antivirus protection and integration with AMaViS which I required. ($150/year for one server, however there's longer-term-license discounts it seems, with it becoming $295.99/3 years for one server, and varying other bulk-purchase discounts). It's running smoothly with very little resource usage. (~ 5MB RAM consumption on an idle/new mailserver, currently running at ~64MB of RAM consumption after being online for over a month and with handling active mail items.)

They have i386 and amd64 releases of the software. Unfortunately, no armhf or others... but for the average server on standard hardware that one would expect in the average corporate environment (amd64 or i386), it works well and is low-resource-usage.

Note that I went with an Avast Core Security license, as it's the most useful option available to me, balancing server resources and costs as factors.


Sophos Antivirus for Linux

Sophos makes an Antivirus for Linux that is free; you just need to register for it.

In my testing of this, though, I did not see an armhf version, and in working with Sophos for a client, they had told me there's no armhf version when I requested information for their Linux antivirus solution and supported architectures, but they did have an i386 and amd64 version. I also did not dig too deeply into this, because unlike Avast above, the Sophos software is pretty memory intensive as well. While it takes a lot longer to get up to that memory level consumption that ClamAV does, it does eat a ton of memory over time. Tested this on a mail server and it ate the 1GB RAM available to the system in no time, and ate all 1GB of swap while it was at it.

(While this is a free solution, Avast still runs with a lower footprint than the Sophos software, from my testing. Download requires registration (name and email), but is reported to accept even trashmails.com addresses.) Sophos integrates well with Amavis, as e.g. described in this German article.


F-Prot Antivirus for Linux Mail Servers

F-Prot has an antivirus flavor for Linux Mail Servers, which I believe that amavisd can interface with.

I have not tested F-Prot because they do not provide a free version for Linux mail servers ($130 US, for one year, for 1-10 users), and because I could not find a trial version. I've heard of them but can't attest to their usability or usefulness.

1
  • Wow, the resource usage part sounds wonderful! Just not the budget for my "family mail server", unfortunately, and no ARMHF (which is a show-stopper for me anyway). And yes, I've used the very same sources to check for alternatives some years ago ;) Unfortunately, many of the mentioned candidates in that list either no longer exist or are very much outdated…
    – Izzy
    Commented Apr 24, 2017 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.