Linux Anti-Virus – Best Anti-Virus Solutions for Linux

Some points to consider:

1. Most infections today are malware from websites. That's why desktops would need protection measures in place...most users don't think about defensive web browsing. Even if they do, it's easy to accidentally trigger something, especially with IE.
2. If the NAS is used solely as a file repository, any desktop scanner should be able to scan mapped drive letters as files are accessed.
3. Even if you protect against browse-by malware, anything that is network based...an infected laptop brought into the network behind the firewall...could theoretically propagate itself into the NAS or clients.
4. Scan the NAS to make sure uneeded ports aren't open for some reason. If you don't need the service, shut it down. Make sure you're using encrypted connections for maintenance.
5. Is your NAS being used for Windows profiles? That's a great place for malware to hide.
6. Email: can you block executable files from being attached, period? We used to do that with a homebrew email filter. I got tired of people getting huge attachments and executables that 99.9% of the time were viruses anyway...so I added a filter to the mail forwarder that just blocked all executables and anything over a couple meg in size.
7. There are antivirus scanners for Linux like F-prot, and of course ClamAV but Clam would have to be a cron job since it's designed for email servers and as such is a "plug in", not on access scanning, just on-demand.
8. Your NAS, especially if not Windows based, will most likely be a virus carrier...not actively infected and trying to spread it.

I'd probably work on scheduling (or having another server schedule) a virus check with an antivirus of choice each night using a mapped drive to the NAS with administrative access; that should allay your client's fears a bit. I don't know what your role is in maintaining them (you're a consultant? on-site support?...) so I don't know if you want to put something in place that the user can maintain or if you're setting things up so you can monitor it remotely; i.e., some antivirus programs can email you a notice. If not, you could set up a small Linux box that is dedicated to doing some maintenance like this (logging) and it could use a cron job to scan for viruses every four hours or so and email you the results.

Yes, it's certainly a reasonable request. The day you deny that your infrastructure is vulnerable to virus threats is the day you've lost a great deal of credibility.

You need to weigh the ramifications (annoyance factor, possible performance issues, maintenance overhead) of running AV with the value of this contract. If one company is listing AV as a requirement, it's likely that others will do the same in the future. If you're already running it, you'll be well-positioned to win their business.