Linux Server Antivirus in 2026: What Actually Works

Server antivirus gets a bad reputation, and some of it is earned. Plenty of sysadmins will tell you a scanner on a Linux box is wasted CPU, and for a locked-down machine with no untrusted input, they have a point.

But most servers aren't that machine. If yours accepts file uploads, delivers mail, hosts a CMS, or holds backups of Windows laptops, then files arrive from people you don't control. That's precisely the problem a scanner is built for.

So this is the practical version: what's actually worth scanning on a server, the two tools that do the job, and the parts of server security that matter more than any scanner. Commands included, and honest about where each tool stops.

Do you actually need antivirus on a Linux server?

It depends entirely on whether untrusted files touch the machine. Here's the honest split.

Worth scanning:

• Web servers that accept uploads. WordPress, Nextcloud, forums, anything with a file field. Uploaded PHP shells are the single most common thing a server scanner actually catches.
• Mail servers and gateways. This is what ClamAV was built for in 2002, and it's still the best-understood use.
• File shares. Samba or NFS serving Windows clients. The malware isn't aimed at your server; your server is just the delivery route.
• Backup targets. Scanning here tells you whether a restore point is clean.
• Shared hosting. Multiple customers, arbitrary code. Scanning isn't optional.

Probably not worth it:

• A single-purpose API box with no file intake, no mail, and no user content.
• An immutable container that gets rebuilt from a trusted image on every deploy.

One more thing worth being clear about. Ransomware against Linux is real, and it goes after infrastructure far more than desktops. A file scanner is a weak defence against it, because by the time encryption starts, the attacker is already inside. We go through that threat model properly in Linux ransomware in 2026.

The two tools that matter

For free server scanning, the realistic list is short.

ClamAV is the engine. Open source under the GPLv2, maintained by Cisco Talos, in every distro's repositories, and listed in CISA's catalog of no-cost security tools. It's the general-purpose scanner: mail, uploads, file shares, backups. If you want the full picture of how it works, see our complete guide to ClamAV.

Linux Malware Detect (maldet, sometimes LMD) is the specialist. Also GPLv2, built by R-fx Networks specifically around threats seen in shared hosting. Its signatures target the things that actually happen to web servers: PHP backdoors, uploaded shells, injected JavaScript. It's the tool behind most searches for "linux malware detector" and "linux website malware scanner".

They're complementary, not competing. The standard deployment runs both, with maldet calling the ClamAV engine for scanning while applying its own signature set.

And if you searched for a big commercial name: most consumer antivirus brands don't sell a Linux desktop product, and their Linux coverage is enterprise endpoint platforms with central management and mandatory cloud accounts. We checked each vendor's own documentation in which antivirus actually works on Linux.

Setting up ClamAV as a daemon

On a server you want clamd, the daemon, not bare clamscan. The daemon loads the signature database once and keeps it in memory, so each scan is fast. Running clamscan from cron reloads the whole database every time, which on a busy box is painful.

# Debian / Ubuntu
sudo apt install clamav clamav-daemon

# RHEL / Rocky / Alma (EPEL)
sudo dnf install clamav clamd clamav-update

Get signatures and start the services:

sudo systemctl stop clamav-freshclam
sudo freshclam                       # first fetch, run manually
sudo systemctl enable --now clamav-freshclam
sudo systemctl enable --now clamav-daemon

Then scan through the daemon with clamdscan instead of clamscan:

clamdscan --fdpass --infected /var/www
clamdscan --multiscan --fdpass --infected /home

--fdpass passes the file descriptor to the daemon, which avoids permission problems when clamd runs as its own user. --multiscan uses multiple threads.

Two things that bite people:

• Keep the engine updated, not just the signatures. A scanner's job is parsing hostile files, so its parsers are a target. ClamAV shipped 1.5.4 and 1.4.6 in August 2026 fixing a batch of parser bugs in ZIP, PDF, XAR, Mach-O and GPT handling, some of them years old. freshclam won't deliver those. Your package manager will.
• Check your version isn't past end of life. ClamAV 0.103 stopped receiving database updates on 14 September 2025. Older LTS distros can still be carrying it. Run clamdscan --version.

Real-time scanning on upload directories

Scheduled scans find malware hours after it lands. For an upload directory, you usually want to know immediately.

ClamAV's on-access scanner handles this, and there's an important constraint: it's Linux-only and needs a kernel of 3.8 or newer, because it uses the kernel's fanotify interface. It runs as clamonacc alongside clamd.

Edit clamd.conf:

OnAccessIncludePath /var/www/uploads
OnAccessPrevention yes
OnAccessExcludeUname clamav

Then restart clamd and start the watcher:

sudo systemctl restart clamav-daemon
sudo clamonacc --log=/var/log/clamonacc.log --move=/var/quarantine

With OnAccessPrevention yes, fanotify blocks access to a malicious file in kernel space, which is stronger than noticing afterwards. Three practical notes from the official documentation:

• You cannot watch /. OnAccessIncludePath rejects it deliberately, because blocking access to system files would lock up the machine. Watch the directories that actually receive untrusted files.
• Exclude the ClamAV user with OnAccessExcludeUname, or the scanner triggers itself.
• Prevention needs kernel support. Check with grep FANOTIFY /boot/config-$(uname -r). If CONFIG_FANOTIFY_ACCESS_PERMISSIONS isn't set, on-access still scans and alerts but can't block. The docs call that notify-only mode.

Watch your inotify watch limit on deep directory trees. The default is 8192, and the docs cover raising it.

Linux Malware Detect for web content

If you host websites, this is the tool that earns its place. LMD's signatures come from threat data seen on real hosting infrastructure, so it catches web shells and injected code that a general-purpose scanner can miss.

wget https://www.rfxn.com/downloads/maldetect-current.tar.gz
tar -xzf maldetect-current.tar.gz
cd maldetect-*
sudo ./install.sh

Scan a web root:

sudo maldet -a /var/www
sudo maldet --report list          # past scan reports
sudo maldet -q SCANID              # quarantine results from a scan

Version 2.0.1, released 25 March 2026, was a substantial rewrite. Per the project's changelog, it added a batch-parallel scanning engine, SHA-256 hashing with hardware acceleration, YARA as an independent scan stage, JSON report output, and alerting through Slack, Telegram and Discord alongside email. Worth knowing if your last look at LMD was a few years ago, when it was a much simpler cron job.

It also does real-time monitoring via inotify, which is an alternative to ClamAV's fanotify approach if you'd rather keep everything inside maldet.

Where it stops: it's built for web-hosting malware. It isn't a desktop tool, and it isn't a replacement for ClamAV on a mail server.

Mail servers

This remains ClamAV's strongest use. The ClamAV team maintains ClamAV-Milter for Sendmail, and the community maintains integrations for other mail transfer agents. For Postfix, most setups route mail through a content filter such as Amavis, which calls clamd.

The important part is architectural, not configurational: scan before delivery. Catching a malicious attachment in the queue is worth far more than finding it in someone's maildir next Tuesday.

What matters more than a scanner

If you only have an hour, spend it here rather than on antivirus. These address how servers actually get compromised.

• Automatic security updates. Unpatched services beat every other entry route. unattended-upgrades on Debian family, dnf-automatic on RHEL family.
• SSH keys only. Set PasswordAuthentication no and PermitRootLogin no. Credential guessing stops being a threat.
• fail2ban on anything internet-facing, to blunt brute-force attempts.
• A firewall that defaults to closed. ufw or firewalld. Open only what you serve.
• File integrity monitoring. AIDE baselines your system files and reports what changed. This catches persistence that signature scanning won't. Build the baseline at deploy time, before you need it.
• Wazuh if you run more than a handful of machines. Host intrusion detection with log analysis and integrity monitoring in one place.
• Lynis for a hardening audit: sudo lynis audit system gives you a prioritised list of specific weaknesses.

We cover these tools and their maintenance status in more depth in our open-source security tool audit. And if you suspect a machine is already compromised, signs your Linux system is hacked is the more useful starting point than a scan.

Containers, and what about AIX or IBM i?

Containers. ClamAV publishes official Docker images, and note that Talos narrowed Docker Hub to supported versions only. Pin to a feature release tag such as 1.5 rather than a specific patch version, so you keep getting fixes. A common pattern is one clamd container that other services scan through over a TCP socket.

AIX and IBM i. Worth being straight about this, because people do search for it. ClamAV targets Linux, the BSDs, macOS and Windows. AIX and IBM i aren't supported platforms, and the prebuilt RPM packages expect glibc 2.28 or newer. If you're protecting those systems, you need vendor tooling built for them, not ClamAV. Don't let a Linux guide talk you into an unsupported build on a production mainframe-adjacent box.

The stack, in order

For a general-purpose Linux server that accepts untrusted files:

1. Automatic security updates, SSH keys only, firewall closed by default, fail2ban.
2. clamd plus freshclam on a timer, with the engine updated by your package manager.
3. clamdscan on a weekly timer across your data directories.
4. clamonacc watching upload directories, if you accept uploads.
5. Linux Malware Detect if you host web content.
6. AIDE with the baseline built at deploy time.
7. Wazuh once you're past a few servers.

None of that needs a licence, an account, or a vendor relationship. "Best free server antivirus" has a real answer, and this is it: ClamAV for general scanning, Linux Malware Detect for web content, and a handful of tools around them doing the work a scanner can't.

The honest summary is that server security is mostly not about antivirus. But if untrusted files reach your machine, a scanner is a cheap layer worth having, and both of these are free.

Your device. Your rules.

Last updated: September 2026