Firewall – Free Windows server anti-virus and firewall programs

The main reason to have anti-virus running on linux servers is usually not to protect the server itself - but to protect the end users who use the services / files on the server. Think of the server as a potential virus carrier.

In order to protect the server itself you should be looking at proper firewalling and server hardening procedures, and packages like aide / tripwire and chkrootkit / rkhunter to detect compromises if they happen.

We use clamav on our fileservers, mailservers, and webservers. On the fileservers (by far the largest) we configured it to scan the modified files hourly, and do a full scan over the weekend on a monthly basis. Otherwise the default configuration has not caused a noticeable performance impact.

Some points to consider:

1. Most infections today are malware from websites. That's why desktops would need protection measures in place...most users don't think about defensive web browsing. Even if they do, it's easy to accidentally trigger something, especially with IE.
2. If the NAS is used solely as a file repository, any desktop scanner should be able to scan mapped drive letters as files are accessed.
3. Even if you protect against browse-by malware, anything that is network based...an infected laptop brought into the network behind the firewall...could theoretically propagate itself into the NAS or clients.
4. Scan the NAS to make sure uneeded ports aren't open for some reason. If you don't need the service, shut it down. Make sure you're using encrypted connections for maintenance.
5. Is your NAS being used for Windows profiles? That's a great place for malware to hide.
6. Email: can you block executable files from being attached, period? We used to do that with a homebrew email filter. I got tired of people getting huge attachments and executables that 99.9% of the time were viruses anyway...so I added a filter to the mail forwarder that just blocked all executables and anything over a couple meg in size.
7. There are antivirus scanners for Linux like F-prot, and of course ClamAV but Clam would have to be a cron job since it's designed for email servers and as such is a "plug in", not on access scanning, just on-demand.
8. Your NAS, especially if not Windows based, will most likely be a virus carrier...not actively infected and trying to spread it.

I'd probably work on scheduling (or having another server schedule) a virus check with an antivirus of choice each night using a mapped drive to the NAS with administrative access; that should allay your client's fears a bit. I don't know what your role is in maintaining them (you're a consultant? on-site support?...) so I don't know if you want to put something in place that the user can maintain or if you're setting things up so you can monitor it remotely; i.e., some antivirus programs can email you a notice. If not, you could set up a small Linux box that is dedicated to doing some maintenance like this (logging) and it could use a cron job to scan for viruses every four hours or so and email you the results.