AntiVirus / Malware Recommendations for Amazon Linux

1) I have a Wordpress site running on a LAMP stack running in AWS EC2 that got compromised today. The hacker encrypted the small MySQL database with a Bitcoin address instead of the expected tables.

Happens for many reasons. Most common reasons - Running old software (Kernel/PHP/WordPress). Running any clear text login on system, like FTP not SFTP or HTTP not HTTPS. Using easily cracked passwords. Using common user/pass across many sites, where another site is hacked then the info is use to hack your site.

You must close all these holes first or hacks will reoccur.

2) I would like to install some AntiVirus and Malware software as a future deterrent. It wouldn’t have done me a lot of good in this case, but I realized that the folks before me didn’t set this up.

Won't help. As Dr. Klahn mentions, these only show a site has been hacked after the hack has occurred + potentially destroyed your system.

3) Do you have any recommendations for software that plays nicely with Amazon Linux (basically RedHat)?

See #2.

4) Do you have a favorite set of “go-to” installation and configuration instructions that you could share? I need something fairly simple to setup & automate updating heuristics and protecting the system.

Yes.

Recently there are some very ugly hacks going around. Here's what I've started doing for projects.

cd /path-to-wordpress-install

chown -R root:root .

chown -R www-data:www-data wp-content/uploads
chown -R www-data:www-data wp-content/cache

Select allOpen in new window

This locks files to only allow Apache to write upload files + cache files.

5) The only way back from any harsh hack is to restore a clean backup.

No one can ever be smarter than 1,000,000s of hackers attacking sites continuously.

You just have to be prepared to restore a backup when required.

This means you must store backups on an external machine, lest your backups be encrypted in a ransomware attack.