Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

[Theodore Tso <tytso@mit.edu>]

On Wed, Aug 06, 2008 at 02:49:57PM -0400, Eric Paris wrote:
> 
> This simple thread shows what I believe to be clear and compelling
> evidence of the need for an in kernel solution.  Lets just consider that
> we are a high input, high output, NFS file server with other OS's
> mounting this NFS share RW.
> 
> Our goal is to stop, or at least reduce the throughput (I clearly
> document and accept the open to read race, and until we get a working
> revoke I don't see that changing) of malware across the NFS server.
> This data will not be attacking the NFS server.  We wish to slow and
> hopefully halt the spread of this data with minimal impact to the NFS
> server.

In this scenario, are you positing that you are worried about Windows
malware, or Linux malware?  What OS are the clients running?  I will
note that Windows has such a sucky NFS implementation that nearly all
Widows clients will be running CIFS/SMB, not NFS --- so the right
solution there is to integrate the virus checking with Samba ---
especially since the one AV vendor has already admitted the actual
virus signature checking has to be done in userspace.

For Linux clients, one question that immediately rises is the
end-to-end argument.  Wouldn't be far better to run whatever security
solution on the client?  After all, a Virus checking on an NFS server
isn't going to help the user if they accidentally track in the virus
on a USB stick.  (Especially if it is an infected Macro virus in an
office document.)  

							- Ted