I haven't encountered the idea of anti-malware on e.g. Ubuntu before, and this seems like an absurd idea. However, it could just be my inexperience showing, so - is anti-malware a common practice? What are the industry-standard products for anti-malware? Is the footprint ever a concern?
One place where this sort of thing can be useful is when running a file or mail server to help stop you from spreading malware to users, but to do it as a way to prevent infection on the box itself? Worthless.
Kernel/userland hardening is a thing, however, and is arguably more effective.
[forgive me if I misunderstood the topic] If you're running a server, then you really should keep the Web side of things in an even more restricted zone than normal Users. I create extremely limited accounts for each domain or large App being hosted. Each such account can access only those resources it's supposed to be able to.
You didn't misunderstand at all! When I stated that, I mean two different things:
- Kernel hardening
Kernel hardening is when you take the kernel and add patches/configure it to be more secure, like grsecurity.
- Userland hardening This is when you do exactly what you're talking about: you restrict what the userland can do and configure userland programs to be more secure (ie turning off insecure Apache options). This could also mean jailing or containerizing them.
Nowadays, there are a few MacOSX and Linux malware, so it could be useful if you are a high visibility potential target, to have such filters.