Question About Security Software for Ubuntu

Question About Security Software for Ubuntu

[Kelly Sapergia]

Hi,
   I'm getting the latest version of Ubuntu loaded onto my laptop in 
addition to Windows XP. I was just wondering if there are any good virus and 
spyware protection programs available for Ubuntu?
   Thanks.

Yours Sincerely,
Kelly John Sapergia
Personal Website: http://www.ksapergia.net
Need to relax and unwind? Listen to "Northern Lights", Thursdays from 01:00 
to 03:00 GMT (Wednesdays in North America) on ACB (American Council of the 
Blind) Radio Interactive at http://interactive.acbradio.org
Visit the show's website at http://nl.ksapergia.net
If you need jingles, voiceovers and music for your project at an affordable 
price, visit KJS Productions at: http://www.kjsproductions.com

Re: Question About Security Software for Ubuntu

[Georgina Joyce]

> I was just wondering if there are any good virus and 
> spyware protection programs available for Ubuntu?

As it is said on this forum, such problems are aimed at Windows users.
Security is a big plust for using linux.  Of course antivirus software
producers will take your money.  But I don't know of any that will be
accessible.

http://ubuntuforums.org/showthread.php?t=411716

I guess you'll have questions regarding orca so may I invite you to join
the orca list too.
http://live.gnome.org/Orca
Gena

Re: Question About Security Software for Ubuntu

[Tony Baechler]

Georgina Joyce wrote:
>> I was just wondering if there are any good virus and 
>> spyware protection programs available for Ubuntu?
>>     
>
> As it is said on this forum, such problems are aimed at Windows users.
> Security is a big plust for using linux.  Of course antivirus software
> producers will take your money.  But I don't know of any that will be
> accessible.
>   



Hi,

What about ClamAv?  It is command line based so should be totally 
accessible and is well supported.  There used to also be F-Prot but I 
don't know if it's still supported.  It is non-free but worked well 
enough.  I've never heard of any spyware for Linux but I suppose it 
could be out there somewhere.  As long as you stick with Debian and 
Ubuntu packages, I wouldn't think this would be an issue.  Obviously the 
original poster needs to read more about Linux first.

Re: Question About Security Software for Ubuntu

[Chuck Hallenbeck]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

On Thu, Jun 12, 2008 at 03:18:17AM -0700, Tony Baechler wrote:
>
> Hi,
>
> What about ClamAv?  It is command line based so should be totally  
> accessible and is well supported.  

I use clamav for virus protection and spamassassin for spam filtering.
Both are very accessible, are automatically updated on a regular basis,
and come in Debian packages. In addition, spamassassin can be
configured stochastically, i.e. so it learns as it goes, if you want to
take the trouble to tell it about false positives and false negatives.
My email services have their own filters, but mine still catch things
from time to time. I have not played with the stochastic configuration,
but it's there if one wants to.

But Linux security is more than just virus and spam. It would pay to
dig into the subject a bit. A good firewall is a start, and running
only essential services and daemons. 

Chuck


- -- 
The Moon is Waxing Gibbous (68% of Full)

My web site: http://hallenbeck.ftml.net and my cell phone: 1-518-334-9022.
                                --------
 "With us nothing has time to gather meaning, and too many things
are occurring for even a big heart to hold."
- --W. B. Yeats
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkhRBbgACgkQ0maTgpPXM9dkdgCdEEI1jfyFwFEeg2N1gL4CkcYy
yjsAnjmNUhNVUl+GmtekFJsvJUcCAItY
=DhNG
-----END PGP SIGNATURE-----

Re: Question About Security Software for Ubuntu

[Georgina Joyce]

> I use clamav for virus protection and spamassassin for spam filtering.
> Both are very accessible, are automatically updated on a regular basis,
> and come in Debian packages. In addition, spamassassin can be
> configured stochastically, i.e. so it learns as it goes, if you want to
> take the trouble to tell it about false positives and false negatives.
> My email services have their own filters, but mine still catch things
> from time to time. I have not played with the stochastic configuration,
> but it's there if one wants to.
> 
> But Linux security is more than just virus and spam. It would pay to
> dig into the subject a bit. A good firewall is a start, and running
> only essential services and daemons. 
> 
Yes, but we have to start at the level of the original questioner's
understanding.  He / she may not even realise the relationship between
debian and Ubuntu, for example.

Re: Question About Security Software for Ubuntu

[Georgina Joyce]

> What about ClamAv?  It is command line based so should be totally 
> accessible and is well supported.  There used to also be F-Prot but I 
> don't know if it's still supported.  It is non-free but worked well 
> enough.  I've never heard of any spyware for Linux but I suppose it 
> could be out there somewhere.  As long as you stick with Debian and 
> Ubuntu packages, I wouldn't think this would be an issue.  Obviously the 
> original poster needs to read more about Linux first.

I agree with what you state and I hope I gave the original poster
something to get their teeth into.  My comment in respect of
accessibility was in respect of the paid for products as it was in the
same paragraph.

I started going down that road but then deleted it owing to the size
limit on these posts for this list.  Furthermore, as you acknowledge the
lister needs to read a bit more.  Then discussions on clamav,
spamassassin, iptables etc. can take place.

> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
-- 
Gena

http://www.ready2golinux.com

M0EBP

Re: Question About Security Software for Ubuntu

[Gregory Nowak]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jun 12, 2008 at 12:43:00PM +0100, Georgina Joyce wrote:
> Then discussions on clamav,
> spamassassin, iptables etc. can take place.
> 

Well, not really. A number of such discussions have taken place on
this list already, as well as on other lists out there, so they're in
the archives, at least when it comes to this list, as well as most of
the other lists out there. I suspect all one really needs to do to
become familiar with the topic is some googling, or searching with
whatever engine one prefers to use.

Greg


- -- 
web site: http://www.romuald.net.eu.org
gpg public key: http://www.romuald.net.eu.org/pubkey.asc
skype: gregn1
(authorization required, add me to your contacts list first)

- --
Free domains: http://www.eu.org/ or mail dns-manager@EU.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIUWN07s9z/XlyUyARAnIFAJ9fXIlHpveIpPfAnf5T/+RIOh5PPQCff62g
ExqNoPnQYTT+NAYaBuXtdsA=
=D7iP
-----END PGP SIGNATURE-----

Re: Question About Security Software for Ubuntu

[Georgina Joyce]

> Well, not really. A number of such discussions have taken place on
> this list already, as well as on other lists out there, so they're in
> the archives, at least when it comes to this list, as well as most of
> the other lists out there. I suspect all one really needs to do to
> become familiar with the topic is some googling, or searching with
> whatever engine one prefers to use.
> 

That's your opinion but I totally disagree.  I'm hopefully more
approachable than that to new users.  The community is about sharing
isn't it?  Of course it's quicker for people to find the information
themselves via google but a little care and nurturing goes a long way.
I've been around for some time as you and I still need help.  That new
user may just have the resorce I need in the future.  But if I've put
his nose out now he's not likely to help anyone.

We're not all gifted in the same way.  

Gena

Re: Question About Security Software for Ubuntu

[Tony Baechler]

Gregory Nowak wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, Jun 12, 2008 at 12:43:00PM +0100, Georgina Joyce wrote:
>   
>> Then discussions on clamav,
>> spamassassin, iptables etc. can take place.
>>
>>     
>
> Well, not really. A number of such discussions have taken place on
> this list already, as well as on other lists out there, so they're in
> the archives, at least when it comes to this list, as well as most of
> the other lists out there. I suspect all one really needs to do to
> become familiar with the topic is some googling, or searching with
> whatever engine one prefers to use.
>   



Hi,

Another good source of information is the various Linux magazines, 
articles, and documentation.  Of course the Linux Documentation Project 
comes to mind, but another good source is the Linux Gazette.  It has 
several articles on all of the above subjects going back several years.  
With Google, there are a lot of beginner forums out there as well which 
will show up in searches.  There are also the O'Reilly books, the 
distro-specific documentation, etc.  Two web sites are http://tldp.org/ 
and http://linuxgazette.net/ respectively.

Tshark and like tools

[Sean Murphy]

All,

Has anyone written any tools to simplify the use of Tshark or any other 
network protocol analyzing text based tools under Linux?

I am seeking tools to be able to trace TCP or UDP conversations. 
Determining the round trips of packets.  Finding out what protocols are 
being used by whom and where too.  Etc.

I am aware of Wireshark (GUI version) but last time I looked, it was not 
accessible.  So I am seeking of an text version which provides simular 
functionality.

Sean 

Re: Tshark and like tools

[Tony Baechler]

Sean Murphy wrote:
> Has anyone written any tools to simplify the use of Tshark or any 
> other network protocol analyzing text based tools under Linux?
>
> I am seeking tools to be able to trace TCP or UDP conversations. 
> Determining the round trips of packets.  Finding out what protocols 
> are being used by whom and where too.  Etc.



Hi,

You didn't mention what distro you're using, but I can say that there 
are several Debian packages to do what you want.  You might want to look 
at the grml live CD as it comes with many of them already installed and 
running.  I don't have a list of the packages but I ended up removing 
several dozen.  You could look at http://grml.org/ and see if the list 
of packages is online and go from there.  My mind is going blank as to 
the names of some of them.  One is nessusd or similar but it is non-fre 
I think.  You could also look at the "harden" Debian package and 
specifically its dependencies.  That might also give some ideas.  You 
could browse through the "Net" section as well.  If your distro has a 
package search ability, you could search for network security or 
similar.  There are many programs out there to do what you want.  
Obviously, Google is your friend here.

Re: Tshark and like tools

[Alex Snow]

Nessus is nonfree as in speech, though still free as in beer...I've 
used it before, the CLI version works well, and the GTK version is 
useable with orca.  Some other network analysis software that comes to 
mind is ettercap, tcptrace, and tcpdump.
On Thu, Jun 12, 2008 at 
08:59:36AM -0700, Tony Baechler wrote:
> Sean Murphy wrote:
> >Has anyone written any tools to simplify the use of Tshark or any 
> >other network protocol analyzing text based tools under Linux?
> >
> >I am seeking tools to be able to trace TCP or UDP conversations. 
> >Determining the round trips of packets.  Finding out what protocols 
> >are being used by whom and where too.  Etc.
> 
> 
> 
> Hi,
> 
> You didn't mention what distro you're using, but I can say that there 
> are several Debian packages to do what you want.  You might want to look 
> at the grml live CD as it comes with many of them already installed and 
> running.  I don't have a list of the packages but I ended up removing 
> several dozen.  You could look at http://grml.org/ and see if the list 
> of packages is online and go from there.  My mind is going blank as to 
> the names of some of them.  One is nessusd or similar but it is non-fre 
> I think.  You could also look at the "harden" Debian package and 
> specifically its dependencies.  That might also give some ideas.  You 
> could browse through the "Net" section as well.  If your distro has a 
> package search ability, you could search for network security or 
> similar.  There are many programs out there to do what you want.  
> Obviously, Google is your friend here.
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
On the Internet, no one knows you're using Windows NT
	-- Submitted by Ramiro Estrugo, restrugo@fateware.com

Re: Question About Security Software for Ubuntu

[Daniel Dalton]

On Wed, 11 Jun 2008, Kelly Sapergia wrote:

> to Windows XP. I was just wondering if there are any good virus and spyware 
> protection programs available for Ubuntu?

You don't really need virus protection since most viruses are written
for windows and if you just install stuff from apt and build from source
there isn't a lot you can do.
So basically if you do nothing stupid you will be fine against
viruses...

Also, regarding spam I dunno, spam isn't a problem for me and my ISP
(iinet) already provide spam protection with in my email account...

You may want to set up a firewall though, to block unneeded ports and so
you are sure no one is getting into your box.
For example, don't run a telnet server, and if you run an ssh server you
may want to write an iptables rule for port 22, but you should be ok
since ssh is very secure.
Perhaps a better example would be to only allow a certain ip get into
your nfs shares. Actually nfs is very secure though.
Basically what I do is close all ports and just allow local processes to open
ports and data to be exchange between my computer and the net through a
port I opened, but not allow people just to start connections with me.
Then I write rules to open other ports so I can use them for example I
opened port 22 so I could ssh in from my laptop, and I also opened up
ports for my nfs shares, oh and I allowed pings.
Just use iptables for all of this. Basically you just place all the
iptables commands in a shell script and run this at start up: I have
fw-close.sh: Close all ports fw-open.sh: open all ports and fw-start.sh:
close all ports by running fw-close.sh, then allow me to open ports and exchange packets
through ports I opened, and then run my rules I want for example, open
port 22 so people can log in to ssh...

I don't know iptables very well, so just google for info on how to use
it. I generally just do a google for something like: "Openning port 22
in iptables" And a nice forum or something comes up, I try it and if it
works add it to my fw-start.sh script.
Let me know if you want my 3 scripts with some default rules in them and
all you need to do is open/forward/close ports you want. If I gave it to
you it would allow nothing to come only you can open ports and once a
port is open a packet can come and go out etc.

But, there isn't really a lot to worry about...
Especially if you are behind a router.
Just be careful about leaving services running and servers and
stuff like that.

Cheers,

-- 
Daniel Dalton

http://members.iinet.net.au/~ddalton/
<d.dalton@iinet.net.au>