Purpose: Audit of anti-malware/anti-virus controls across the VeriPath infrastructure.
Date: 15 May 2026
Evidence requirement: "Anti-virus/anti-malware solution name, update frequency, and coverage confirmation"
The VPS has no anti-malware software installed. None of the Docker containers have it either.
| Tool | Purpose | Is it anti-malware? |
|---|---|---|
| Lynis 3.1.6 | Security auditing / hardening assessment | ❌ No — audits config, doesn't scan for malware |
| Trivy | Container image vulnerability scanning | ❌ No — checks for known CVEs in packages |
| Nmap | Network port scanning | ❌ No — finds open ports, not malware |
| DefectDojo | Vulnerability management / tracking | ❌ No — tracks findings from other tools |
These tools are useful but do not satisfy the DSPT requirement for active anti-malware protection.
| Container / Host | Anti-Malware Present? |
|---|---|
| VPS host (Ubuntu) | ❌ None |
| gp_booking_app | ❌ None |
| gp_booking_nginx | ❌ None |
| wikijs | ❌ None |
| keycloak | ❌ None |
| forgejo | ❌ None |
| defectdojo_uwsgi | ❌ None |
| defectdojo_postgres | ❌ None |
The DSPT requirement primarily targets the end-user devices — your and Peter's workstations.
| User | Device OS | Typical Built-in AV | Status |
|---|---|---|---|
| Matthew | [Windows/macOS] | Windows Defender or XProtect | ⬜ Unconfirmed |
| Peter | [Windows/macOS] | Windows Defender or XProtect | ⬜ Unconfirmed |
Windows:
Settings → Privacy & Security → Windows Security → Open Windows Security
→ Virus & threat protection → check "Virus & threat protection" is active
Or run: Get-MpComputerStatus | select AntivirusEnabled, AMProductVersion, AntispywareEnabled
macOS:
XProtect and Gatekeeper are built in and update automatically. No user action needed beyond keeping macOS up to date. Verify:
System Settings → General → Software Update → Automatic updates are on
ClamAV is the standard open-source anti-virus for Linux. It is available in the Ubuntu package repository.
apt update
apt install -y clamav clamav-daemon
ClamAV includes freshclam which downloads updated virus definitions automatically. The service runs daily by default.
systemctl enable clamav-freshclam
systemctl start clamav-freshclam
Set up a weekly scan of the key directories:
# /etc/cron.weekly/clamav-scan
#!/bin/bash
LOG=/var/log/clamav/weekly-scan.log
mkdir -p /var/log/clamav
clamscan --recursive --quiet \
/opt/ \
/root/ \
/var/lib/docker/ \
/etc/ \
/home/ \
--exclude-dir=/var/lib/docker/overlay2/ \
--log="$LOG" --infected
ClamAV is lightweight on idle systems. The weekly scan uses CPU briefly but can be scheduled for low-usage times (e.g., Sunday 03:00).
Docker containers should generally not have anti-malware installed inside them (it adds bloat and isn't standard practice). Instead:
| Area | Status | Action Required |
|---|---|---|
| VPS host anti-malware | ❌ None | Install ClamAV + freshclam + weekly scan |
| Docker containers | ❌ None | Covered by host ClamAV + Trivy (acceptable) |
| Workstation anti-malware | ⬜ Unconfirmed | Matthew and Peter to verify Windows Defender / XProtect is active |
# Step 1: Install
apt install -y clamav clamav-daemon
# Step 2: Enable auto-updates
systemctl enable --now clamav-freshclam
# Step 3: Create weekly scan cron
cat > /etc/cron.weekly/clamav-scan << 'EOF'
#!/bin/bash
LOG=/var/log/clamav/weekly-scan.log
mkdir -p /var/log/clamav
clamscan --recursive --quiet \
/opt/ /root/ /var/lib/docker/ /etc/ /home/ \
--exclude-dir=/var/lib/docker/overlay2/ \
--log="$LOG" --infected
EOF
chmod +x /etc/cron.weekly/clamav-scan
# Step 4: Verify
clamscan --version
systemctl status clamav-freshclam