Networks

Ask something
Discussion Locked

Anti-virus on file servers?

0 helpful
26 replies

by edlockett 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is an interesting concept that has been bugging me recently. In doing work for our clients we frequently notice that certain anti-virus products cause problems with server performance. The clients can sometimes suffer from 1-2 minute delays just to open a file as the AV is grinding away wasting 50%+ CPU time.

The real question here is, if there is a file server, which serves files to local network clients, why does it even need AV? I can't think of any particularly good reasons why it is worth the performance sacrifice of a perfectly good server to make it thrash about scanning documents for viruses. Particularly when all of the clients have their own AV.

So does a file server, which only allows access by clients to certain shared folders, and no access to any of its system files, never executes any programs interactively and cannot be made to execute a program or change system files remotely, really need to AV scan every file that is opened by the system, to send over the network to a client who is also going to scan it (usually with the same engine and same definitions)? I would be very interested in a general discussion of this.

Consider also the fact that the vast majority of data files cannot contain malware as they are not executable. The only exceptions to this are Office documents which could contain macros. However, the server probably doesn't even have Office installed and wouldn't be trying to execute anything from its shared folders of its own accord. The clients do need AV and would be scanning all files opened themselves anyway.

Extend this idea to servers that have multiple roles. For example, in many small businesses a single server provides all services for network users. It might be a domain controller, file server, Exchange server, proxy server, host a couple of databases. Provided that incoming email is sanitised somehow to protect user mailboxes, does the server in this scenario really need to scan its files for viruses? There is still no real threat of the server operating system itself becoming infected.
Even if a hacker were able to gain access to a theoretical limited user account with permission to log on to the server it would still not be possible for them to infect any sensitive part of the system with any sort of malware.

If a hacker gains access to your admin account, you've had it anyway- no amount of AV will help you then. But viruses, generally, come in executable files. If a server doesn't ever execute any files from the outside world, why is it a good idea for them to have AV? Is it just a gimmick so that vendors make more money through scare tactics?

Please do express your thoughts and opinions on this. If I am missing something glaring in this area I would be pleased to be able to set my mind at rest!

Thanks
Ed

26 replies

by jaqui

1) It's a better policy to "trust nothing" and run the file server av to avoid infesting your network.

2) staff who can save files to the server may have an infected file they do not know about. bringing reason 1 into play. ;)

edit to add:

all the AV software I have seen for enterprise use [ file server ] have the problem of being resource hogs. lower the priority of the av in it's own config settings, and turn off the on access scan, use nightly full scan and on save scanning instead.

by edlockett

Hey Jaqui... Thanks for your input.
Although the two points I was trying to play on are:
1. The server can't get infected since it never runs any (foreign) executables.
2. The clients can't put infected items on the server, nor become infected if there are such items that they access - because they all have their own anti-virus.
So what I really want to talk about is what circumstances would make a convincing argument to put AV on a file server?

Any further comments/suggestions/discussion from all those bright minds out there?

by edlockett

Any more comments forthcoming on this topic? Thought I would elicit at least a fair response on this... Anyone feeling enthusiastic?

by 1bn0

Some applications require interaction on the server itself.

Including having Excel avilable to read the exported data and log files.

Once you are working in that mode, it is often easier to perfomr all realted tasks from the same session on the same server.

As this is also usually doen with an administrative account, you wouldn't get logged on to the server otherwise, it is a good idea to have av installed.

by edlockett

So the scenario you are covering really is the possibility that an admin who was performing some tasks on the server might accidentally execute some malicious code...
It's a fair point, but one I would say is fairly unlikely. Of course, log files and such produced by Windows services or trusted applications are not going to contain any malicious code. I think usually the admin would either copy or share these files and then access them from his/her workstation rather than paying for another copy of Office to sit on the server.
Really, as long as the server isn't a Terminal Server, the only people using it would be the IT admins. As they are kind of expected to be IT savvy, and they don't really have any need to access the Web or their e-mail whilst logged on at the server, the risks of becoming infected are low?
Maybe there would be some scenarios where the admins would be susceptible to sophisticated social engineering?

by dumphrey

then what is on the end user computers you add depth to scanning without the problems of double up on the workstation. Not all AV programs catch everything, its hedging your bets.

by edlockett

Using a different AV engine on server and on workstation would indeed offer this advantage.
However, most businesses choose to buy one site license, to cover all computers. It would be more expensive and difficult to administer if there were several different vendors' products.
One should be able to trust the labs of their chosen anti-virus vendor. That is the main reason why paid-for AV is better than free AV - there are more resources to investigate and release definitions for new viruses quickly. However, the major players generally all release definitions for new viruses within a short timeframe.
Does anybody else use different products on server / workstation for this reason?

by dumphrey

research. You should be able to trust your AV, in much the same way you should trust your seatbelt. But are you to cheep to pay for the airbag in your car? Is the seat belt really enough?
It comes down to how important is your data. Optimally, a gateway appliance is scanning all data streams with product A. Client machines scan the new file with product B, and the file is scanned again on the server with product C.
The mail que scanner should be different from the spam appliance scanner and from the end client scanner.
It all comes down to risk. And even the most trusted names in AV can let you down, hard.
http://www.itp.net/index.php?Itemid=1&id=486507&option=com_content&view=article
http://news.cnet.com/Symantec-patches-antivirus-worm-hole/2100-1002_3-6078160.html
http://www.fastcursor.com/lib/symantec-flaw-patch.asp

by the 'g-man.'

who do not know that a virus can spread through network shares is a poor excuse for a professional.

Worst still the applied understanding shown to what a virus can do through such a small attack vector frankly boggles the mind.

That and the total lack of paragraphing in the OP tops the lot.

by edlockett

Rather than put down the topic of the discussion, why don't you contribute to it? Discussion is, after all, the purpose of the forum and the intended reult of the exercise of posting.
I would be interested to discuss with you the reasons behind the statements you make. Please, explain how you think a file server might become infected with a virus through a file share.
Many others and I would be most enlightened, and would be grateful for the new knowledge.
Or maybe, if you were prepared to discuss, you might learn something new yourself!
I look forward to the elaboration of your points, if you are in fact not just a bridge-dwelling troll creature.

PS. In Britain at least, widely-accepted writing style dictates that a new paragraph consists of a new line and an indentation. As one cannot use in a textarea, I did indeeed just use line breaks. Looking at it now, it would probably have looked better with double line breaks between paragraphs. Oh, and I would have liked to justify it as well, but the world is not perfect.

by caballo2000

This post have some time now. But I found it because I'm investigating about performance issues where the culprit is the AV (Mcafee) in a powerfull file server. As a troubleshooting step, I removed the AV for some minutes. Disk busy messages from one specific app I have now drop to 0 ~20%... so the AV is the culprit, no doubt.

I'm looking another ways to lock down the server (Cisco CSA for example) instead of the AV.

But is true, the Virus risks is not only present when users run an exe file or something, a single share in a server can expose the system to full infection.

by edlockett

I'm not sure exactly why you think "trust is a bell curve". I find that bit a little confusing.

You do indeed have a good point about defence in depth.

Headline: "Budgies to cheep to pay for the airbags in your car!"
I kind of like that idea. Nice one.

by edlockett

Hmm yes, I feel that all reading this discussion can come away benefitting from your insight. Good effort.

I think the point made in the quoted post is perfectly valid. Do you disagree? Please discuss...

On a different note, I did take your advice about the layout. Happy Mr. Troll now?

Equal Opportunities Commission.

by edlockett

Does anybody have any good explanations of what kinds of risks would be opened up by not having anti-virus on file servers?
I'm really trying to get some good discussion going on this 'what if' scenario...

by the 'g-man.'

What do viruses infect?
What do file servers hold?
Where do these files come from?

Are all the upload vectors covered by another scanner or scanners?

What if someone was working directly on the server and downloaded a file?

What if an install on the server had a virus contained within (this has happened)?

What if a TSR virus was run on the server that did not write to disk?

Wait....

Virus scanners scan more than just files!

Now that is put to bed the thread can die.

by edlockett

For the purposes of this discussion, we are working with a simplified theoretical example. I am trying to get people to visualise a concept so that we can exchange ideas.

To go back to the original scenario, a file server is accessed only by local client computers that all have AV.

So, to clarify...

Are all the upload vectors covered by another scanner or scanners?
Yes, in this example, for the sake of the discussion. Clients on the local network only place files in the shares.

What if someone was working directly on the server and downloaded a file?
Only the administrator is permitted to log on to a server interactively. It is not best practice to use servers for day-to-day activity such as browsing or downloading untrusted software.

What if an install on the server had a virus contained within (this has happened)?
It's a file server. Windows was installed from an official media. There is no other software. For the sake of the example, to base a discussion upon.

What if a TSR virus was run on the server that did not write to disk?
Not sure what you mean by this one. How does something get into memory without being read from some medium first? TSR was a technique that stood in for multitasking in DOS - it's no longer really useful.

I'm sorry that you have such a problem with this discussion, G-Man. It was meant to stimulate some intelligent conversation about a theoretical concept. You seem unable to overcome the reaction of putting people down and stifling an exchange of information and thoughts because something strikes you as being different to what you perceive to be the norm.

Please, if you have something constructive to contribute to the discussion, I would be glad to hear it. Otherwise, you don't have the right to call other people or to dictate what happens in a public forum. I would advise you don't bother - it won't make you popular like it might have done at school.

by caballo2000

There is a risk. If the server have shares, you have a risk. I see servers infected even with lot of permission restrictions(and AV installed).

by caballo2000

This is a real good post. In the past lot of IT admins refuse to use AV in servers. Performance hits are big when your files are scanned all the time by the AV software.

I see very powerfull file servers (and running other roles) with real performance problems because the AV. I'm even now troubleshooting a real deal when users complains and complais because opening files take some time in powerfull equipment because the AV.

So, I'm investigating if I really need AV in this server and how I can remove the AV and lock the server to avoid infections.

Security in MS OSs are a big problem. You need to keep in mind lot of steps: windows updates, service packs, critical updtes, remove unnecesary services, limit permissions and some people add AV and Antimalware/Antispyware software.

I see some companies who do not use AV software in file servers, instead, they use CSA locking systems.

You need to understand one single thing (important). A windows file server with a single share without AV, is at riks of infections. Lot of virus outhere looks for shares in the network and replicates. I see lot of servers and infrastructures infected in such way.

by the 'g-man.'

your strange assumptions just stifle the conversation. Besides if one had said nothing (as you put it) then your response would not exist :-)

Besides in my opinion you are just fishing for information to take to the boss for a "look what I can do" moment.

Your history on this very site makes it a dead giveaway.

by wes

I am new to IT, and I read the threads because I have the same question. My office has only 5 users that have the same AV protection, and the file server had a PC AV software that expired soon after I arrived. I installed a 30-day trial, which expires soon. I'm leaning toward purchasing an AV software for the server and 5-PCs just for peace of mind.

by cwheeler33

What happens if we run nightly AV scan, and use a white list app instead? As an example product BIT9... Would that sufficiently reduce the risk to the file server while saving on performance?

Although this is an old thread, I think it's still a valid discussion.

I do believe in Defence in Depth (provided we can aford it)
I do believe File Servers are at risk
Part of the solution is best practice before you even go shopping. As such I like to follow NSA guidelines to locking down...
The name of the game is risk management... I don't believe anyone can protect themselves 100% of the time. We can only do our best to get as close as possible.

by charliespencer

"2. The clients can't put infected items on the server, nor become infected if there are such items that they access - because they all have their own anti-virus."

That's a lot of trust in both the local AV app and in the inability of unprotected systems to connect to the network. All it takes is one well-intentioned employee connecting a vendor or customer's contaminated laptop, or a 'drive-by' wireless poacher, or a flash drive full of cooties stuck in the server's USB port.

For small shops, I agree with those who say run one app on the clients and a different one on the servers. Larger outfits should invest in the appropriate corporate-grade products designed to minimize the performance penalty on servers.

This discussion is closed to new replies.