Open-source antivirus and anti-malware for business computers and servers
The best-known open-source antivirus is ClamAV, a free scanner maintained by Cisco Talos, and it is excellent at what it was built for: scanning email and files on servers. Its own documentation says it is not a traditional antivirus or endpoint security suite, so it is not a like-for-like replacement for the protection built into a modern desktop operating system. A sound open-source set-up combines several tools, each in the place it does best: ClamAV for mail and files, Linux Malware Detect for web hosting, YARA rules for custom detection, Lynis and rootkit checkers for auditing, and Snort or Suricata watching the network.
The tools at a glance
| Tool | What it is | Licence | Best used for |
|---|---|---|---|
| ClamAV | Antivirus engine and scanner, by Cisco Talos | GPLv2 | Mail gateways, file servers, scanning uploads |
| Linux Malware Detect (maldet) | Malware scanner for shared web hosting, by R-fx Networks | GPLv2 | Finding web shells and injected code on hosting servers |
| YARA and YARA-X | A rules language for describing malware, from VirusTotal | BSD | Writing and sharing your own detection rules |
| Lynis | Security audit and hardening tool, by CISOfy | GPLv3 | Checking a Linux server's configuration |
| rkhunter and chkrootkit | Rootkit checkers | Open source | Spot checks for known rootkits |
| Snort 3 | Network intrusion detection and prevention, by Cisco | GPLv2 | Watching traffic for known attacks |
| Suricata | Network intrusion detection and prevention, by the Open Information Security Foundation | GPLv2 | The same job, with multi-threaded performance |
ClamAV: the mail and file scanner
ClamAV runs on Linux, the BSDs, macOS and Windows. Its signature database is updated several times a day by a tool called freshclam, and its documentation describes its main purpose as scanning email on mail gateways and scanning files.
Some details matter when you plan with it:
- Real-time scanning is Linux only. ClamAV's on-access scanner, clamonacc, works only on Linux. On other systems ClamAV scans on demand or on a schedule.
- Keep it supported. ClamAV publishes an end-of-life policy, and versions out of support can be blocked from signature updates. Version 1.4 is the long-term-support release, supported until August 2027.
- It is the standard in open-source mail filtering. Rspamd, the open-source spam filter, supports ClamAV for virus scanning, and Mailcow, the open-source mail server, lists ClamAV among its components.
The honest limit
Independent test labs last put open-source Linux antivirus through comparative tests in 2015, and ClamAV did not score well on desktop malware then. No current independent result exists. On business desktops and laptops, keep the protection built into the operating system switched on and up to date, as the UK National Cyber Security Centre (NCSC) advises; it notes that modern devices come with antivirus switched on. Use ClamAV in addition, where it is strong: scanning mail, shared folders and files moving between systems.
ClamTk, a desktop interface for ClamAV that many guides still recommend, is no longer maintained according to its own project page, so it is not a good choice for new installations.
Linux Malware Detect: built for web hosting
Linux Malware Detect is written for the threats found on shared web hosting, such as web shells and code injected into websites. It has its own scanning engine and can use ClamAV and YARA alongside it. It suits anyone running websites on their own Linux server.
YARA: write your own rules
YARA is the common language security researchers use to describe malware: a rule says which strings or patterns identify a family. Many published threat reports include YARA rules, and ClamAV and Linux Malware Detect can use them. YARA-X, also from VirusTotal, is its successor.
Lynis and rootkit checkers: audit, not antivirus
Lynis audits a Unix-like system's configuration and suggests hardening steps. rkhunter and chkrootkit look for signs of known rootkits. None of them is an antivirus; they are checks you run regularly to catch weaknesses and tampering. rkhunter's last release was in 2018, so treat it as a supplementary check.
Snort and Suricata: watching the network
Snort 3 and Suricata do not scan files. They inspect network traffic and raise alerts on, or block, patterns that match known attacks: intrusion detection and prevention. Placed at the edge of an office network or on a server, they see attacks that file scanners never would, such as exploitation attempts against a web application. Snort's free rules are available to registered users, and paying subscribers receive new rules 30 days earlier.
Putting it together
| Where | What to run |
|---|---|
| Business desktops and laptops | The operating system's built-in protection, updates, and care with downloads |
| Linux desktops and file servers | ClamAV with scheduled scans, plus on-access scanning for shared folders |
| Web hosting servers | Linux Malware Detect with ClamAV, and Lynis audits |
| Mail servers | ClamAV with Rspamd, or a mail platform that includes them |
| The network | Snort or Suricata at the edge, with someone reading the alerts |
The last point matters most. Every one of these tools produces findings, and findings help only if someone reads and acts on them. Our article on open-source threat hunting and security monitoring covers the tools that collect and sort those alerts.
Where Noiz fits
On Noiz shared hosting, mail is scanned for spam and viruses on every plan, and the Email Security add-on adds advanced spam and virus filtering for domains hosted with Noiz. On a Noiz Cloud server you choose and run your own tools, and Noiz can set up and maintain them as part of a quoted Linux administration service.
If you would like ClamAV, Linux Malware Detect and Lynis set up on your server and kept running, ask Noiz for a Linux administration quote.
Sources
- ClamAV documentation: https://docs.clamav.net/
- ClamAV, on-access scanning: https://docs.clamav.net/manual/OnAccess.html
- ClamAV, signature management: https://docs.clamav.net/manual/Usage/SignatureManagement.html
- ClamAV, end-of-life policy: https://docs.clamav.net/faq/faq-eol.html
- ClamAV source and licence: https://github.com/Cisco-Talos/clamav
- ClamTk project: https://github.com/dave-theunsub/clamtk
- Linux Malware Detect: https://github.com/rfxn/linux-malware-detect
- rkhunter: https://sourceforge.net/projects/rkhunter/
- chkrootkit: https://www.chkrootkit.org/
- Lynis: https://github.com/CISOfy/lynis
- YARA: https://github.com/VirusTotal/yara
- YARA-X: https://github.com/VirusTotal/yara-x
- Snort: https://www.snort.org/ and https://www.snort.org/products
- Snort 3 licence: https://github.com/snort3/snort3/blob/master/LICENSE
- Suricata, what is Suricata: https://docs.suricata.io/en/latest/what-is-suricata.html
- Rspamd, antivirus module: https://docs.rspamd.com/modules/antivirus
- Mailcow, prerequisites: https://docs.mailcow.email/getstarted/prerequisite-system/
- AV-TEST, Linux security packages tested (2015): https://www.av-test.org/en/news/linux-16-security-packages-against-windows-and-linux-malware-put-to-the-test/
- AV-Comparatives, Linux security review 2015: https://av-comparatives.org/tests/linux-security_review_2015/
- NCSC, protecting your devices: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/protecting-your-devices
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
