Antimalware support

[zjosh86]

or in other words file level monitoring?

 

I just had a post on reddit regarding the options for Unraid and pretty much everyone rather tried to tell me to forget about it and that I don't need it.

Well, here is the thing. I want it.

 

So, is it possible for Unraid to monitor it's files? Will we ever see this kind of technology make it's way to Unraid?

 

The unique features offered by Webroots Secureanywhere protection. One of those features being "No reimaging Uses journaling and rollback features to restore files to their uninfected state, so you don't have to reimage."

This is just one feature from the suite of course. But, it's a significant example of the kinds of protections being left out by Unraid. That's not to say Unraid itself needs this kind of file level monitoring and protection. But, that I like to believe my Array deserves it.

 

So, why is this?

 

I realize Unraid is not for Business. But, I don't understand why you wouldn't want it to be an option. Let alone that, even consumer NAS have antivirus options.

 

Edited January 24, 2018 by zjosh86

[trurl]

See these plugins:

 

Dynamix File Integrity

http://lime-technology.com/forum/index.php?topic=44989.0

 

Ransomware Protection

http://lime-technology.com/forum/index.php?topic=52462.0

[pwm]

10 hours ago, zjosh86 said:

But, I don't understand why you wouldn't want it to be an option

 

But do you understand the implication of implementing the support to have every individual file support rollback? BTRFS can support snapshot, making it possible to rollback the full directory tree that was covered by the snapshot.

 

Besides the amount of work to implement an on-the-fly rollback system for every single file (which implies the need for CoW support for every sector write, or full-file copy for every file that receives a write), it also isn't without performance costs.

 

A product owner would only like to offer options that are economically viable to implement and support. That feature set is affected by the customers interest  in paying enterprise-level license fees. Are you interested in paying an enterprise-level fee for using unRAID?

 

@trurl posted links to two good solutions to catch hostile file writes to the array. And since RAID isn't a replacement for a backup system, users of unRAID are expected to either use the unRAID system as a backup of a different system, or use unRAID as the main data server while keeping backups on some other system. Preferably with the backup at a separate physical location.

[Frank1940]

Another approach:

 

         https://lime-technology.com/forums/topic/58374-secure-writing-strategy-for-unraid-server-using-write-once-read-many-mode/#comment-572532