NethServer 8: planning an evolution

[bwdjames (James Nesbitt)]

@alefattorini

Oh that’s a good question thanks for arguing this new point of view

Not a problem, glad to be of some help.

Not sure if its worth doing the same trick with a lot of the other stuff, taking a step back to reflect and redefine definitions and understanding of feature features and ways of doing things.

[royceb (Royce)]

Does NethServer have stats on the software/services people use the most?

[pike (Michael Kicks)]

Some said it was not needed…

[pagaille (Matthieu Gaillet)]

@alefattorini

Hi Elleni, could you add a few details? Which kind of infra services do you serve? How many nethserver instances are you running?

Maybe you could be interested in the network map of what I did over the past years at my former job. Almost all machines are NS based.

[giacomo (Giacomo Sanchietti)]

Thank you all for taking time to respond to this topic, for sure we are gathering very interesting feedback!

@pike

Is Debian Buster too far to take the leap?

Why not? We are open to all possibilities.
This would be a big change, but I do not know if the swithc would bring us some real benefits.
Still, we have 15 (20?) years of experience on RPM-based distribution and I would like to not through them into the trash bin.

@robb

That directly justifies the need for a very strong Firewall/Gateway.

Of course, but on a home firewall you usually do not need some advanced stuff like source natting, hair pinning, multi wan or advanced traffic shaping.
Maybe NethServer 8 could have a very simple firewall for local services and not acting as a firewall/gateway, which could be implemented on a different base.

@danb35

I believe that’s a mistake, even though it’s become easy and cheap to do, and I think it’s important to have a distro (or better yet, a few) to make it fairly easy to self-host for folks who want to do so.

We totally agree on this, I think this is one of the strongest point.
But in general, I do not think it make a real difference if you are installing NS on a Proxmox machine or on bare metal. The important thing is that you can choose to keep your data on premise.

@pike

How many Hosting services are providing IPv4 as payed option?

I do not know, but I’m still using many providers with free IPv4 addresses
If the development of NS 8 will be delayed, we could even think about adding IPv6 on NS 7.
But only the community is asking for IPv6, there is no business interest on it: it’s not easy to invest many resources on such implementation without a real profit.

@fausp

what if we start a survey and ask the Nethserver-admins what functionallity they use and miss?

I think we already have tones of feature request inside the forum and we already cherry picked the most asked ones. Of course, feel free to propose new ones!
@alefattorini what do you think? Is a survey a good way to gather other feedback on this topic?

@capote

no Virtualization, (if any body need it, should use Proxmox)

I agree: I see NS 8 running mostly on VMs and not the way around.

@bwdjames

I suppose a useful feature for NethServer 8 would be a way to manage each of those installations with each of their separate requirements centrally somehow.

Yes, but a central configuration usually requires a dedicated system with some highly special configuration. So In my view, the central system would be Dartagnan which could configure multiple NS instances.

@Andy_Wismer

A really good idea would be a “Delegate Authority” Button, or something similiar. If the company has someone to do the Job, that he can easily get auth for the server without too much trouble.

You can already do it: it’s just a couple API call inside a cron job to remove them when not needed any more.

@pagaille

I wish there would be something more complete to monitor the subsystems and alert the user when something is going wrong.

We already have it, see Dartagnan .

@oneitonitram

We have scenarios whereby, A person managing brand B, is not associated with brand A. why do they need to have an email for both brand A and brand B?

I strongly believe that the multi-tenant is not a priority for NS, but it doesn’t mean we want to block this possible evolution. I see the multi-tenant more like as multiple instances of a single-tenant as James explained very well

@bwdjames

If I may also diverge on a slight tangent: if NS 8 installs the various features using containerisation and the All-In-One server solution is no longer the focus, this does not necessarily mean that an admin cannot achieve an All-In-One solution. All they have to install the various containerised features on a single installation of NS 8 as opposed to multiple installations.

@mark_nl

With IOT you need to watch what is going out of unsuspected devices and isolate those. (believe me: designing the hardware of those devices)

I’m very interested on it. Would you like to do some examples? In your opinion, where should we focus to provide security for IOT devices?

@Andy_Wismer

One little feature I’ve seen and used elsewhere is the possibility / option to restore parts / segments of the config.

I like the idea, it could be easier with a container approach!

@royceb

Does NethServer have stats on the software/services people use the most?

Yes and no. We have a lot of statistics from our Enterprise installations but not from Community.
But since Enterprise installations should outnumber the Community ones, we could take some data-driven decisions. Still, requirements from community are often much different from business ones.

[robb (Rob Bosch)]

@giacomo

Still, we have 15 (20?) years of experience on RPM-based distribution and I would like to not through them into the trash bin.

So that leaves ‘that other’ rpm-based distro: OpenSuSE? Or do you have something else in mind? However, there is no Open/free/libre version of SLES so it will complicate things for a server distro.
Zooming in on options this really will be a major thing to decide and not to be taken lightly. In fact, there are not that many distributions that actually focus on server roles, especially in the rpm-based family.

@giacomo

Maybe NethServer 8 could have a very simple firewall for local services and not acting as a firewall/gateway, which could be implemented on a different base.

You are thinking about a dockerized pi-hole?

[danb35 (Dan)]

@giacomo

Still, we have 15 (20?) years of experience on RPM-based distribution and I would like to not through them into the trash bin.

Depends how you’re counting. If you count all the way back to the days of e-smith, the oldest release DistroWatch lists is 4.1.2, released 30 March 2001. I know I was using 3.something, which would push it back to at least some time in 2000. I assume there were 1.x and 2.x releases as well, but I can’t say I clearly remember those.

I don’t think changing to .deb packaging would necessarily be an awful thing, but I can’t believe you still can’t do apt install https://url.

[oneitonitram (Martin)]

@giacomo

I strongly believe that the multi-tenant is not a priority for NS, but it doesn’t mean we want to block this possible evolution. I see the multi-tenant more like as multiple instances of a single-tenant as James explained very well

Well, in this case, my siggestion was more on the EMail app.

Sharing the same Ldap instance etc is not a problem. but the email domains should have a way to seprate them somehow.

where i can create an email address for a new separate domain, and chose who will have ability to login, without having an alias of the parent email address.

@giacomo

Still, requirements from community are often much different from business ones.

WHy do you believe so. there are instances where someone uses the community because at the time, they can afford the enterprise, or alternatively, because the people they are deploying to are paying less than the enterprise support charges.
This does not mean that the use cases are different. it is just they have been necessitated to use the community version, until they can upgrade.

[MrE (Enrique D)]

At this time, my primary use of NS is to create and manage a

• Local Samba 4 Active Directory Domain Controller (100 users)
• Our NAS / synology uses the authentication provided by NS / AD and so far it works wonders.
• Zabbix (I am in the process of learning)

I’ll keep it simple, but it is the lack of organization in my network that is the main reason for not activating and using more services in NS.

[alefattorini (Alessio Fattorini)]

@giacomo

@alefattorini what do you think? Is a survey a good way to gather other feedback on this topic?

That’s a good idea, just added to my list.

[hector (Héctor Pérez)]

In short terms: The same NethServer 7 with new software!!! y listo muchachones!!! that’s all folks!!!

[m.traeumner (Michael Träumner)]

@giacomo

We believe NethServer should focus on two main points:

• privacy: you own your data and you can store them anywhere you want
• simplicity: the configuration should be easy for administrators with little or no experience

I totally agree with this.

@giacomo

it’s a cloud-oriented distribution focused on containers

There are enough companies who don’t like a cloud version.

@giacomo

If nobody is at the office, does it make sense to have a firewall that filters internet traffic and protects just a few hosts?

I don’t think, that nobody is at the office at the future.

@giacomo

Having a platform that just runs containers is not enough

You are right, only running containers is not the right way, but additional running several containers with several applications could be a very flexible All-In-One Server Solution.

@giacomo

does it still make sense to develop a distribution?

Yes please do it.

@giacomo

is the all-in-one server still a valid solution?

Yes and No. I would prefer to run several servers for some roles, explicitly firewall and IPS and Proxy on the same mashine, but ad on another as local virtualized servers.

@giacomo

is it time to start the development of NethServer 8?

It’s not the time if we don’t know in which direction we want to go, but like others said here, we need IPV6.
If we can get such important features in Version 7, I think we can wait.

@giacomo

should the NethServer 8 be just a solid base to run or orchestrate multiple services?

It should also be a strong firewall.

@giacomo

what will be the base for the UTM firewall, if any?

I don’t know.

[hector (Héctor Pérez)]

Is going to be cockpit based?

[giacomo (Giacomo Sanchietti)]

@robb

So that leaves ‘that other’ rpm-based distro: OpenSuSE?

This could be an idea.

@robb

You are thinking about a dockerized pi-hole?

Not really, but I’m not excluding it

@m.traeumner

I would prefer to run several servers for some roles, explicitly firewall and IPS and Proxy on the same mashine, but ad on another as local virtualized servers.

I agree on this!

@hector

Is going to be cockpit based?

Who knows

[corteq (Graham Young)]

As a new contributor and someone who is searching for the ideal SME solution for New Zealand clients, I would like to encourage your development work. You have many things just right. It’s a clean fast and easy to maintain environment.

@giacomo

is the all-in-one server still a valid solution?

Microsoft removed ISA Firewall from their SBS platform years ago because the general belief was that this does not belong on the same machine as the Domain Controller, or any other internal server for that matter. I agree. PFsense on a machine at the edge of the network serves me well.

For everything else, most certainly. The weakness I see is still the Exchange replacement. In my search for the best solution I am leaning to NethServer as AD Controller but having to run Windows Server 2019 with Exchange Server 2019 as a member server just to handle mail well. For me, THAT is where the focus needs to be.

NethServer is touted as a SBS replacement. Do that well, drop the firewall.

[Andy_Wismer (André Wismer)]

@corteq

Hello Graham

For one client, a doctors practice, I’m using virtualization on Proxmox, NethServer is running as AD, File, Print, NextCloud, Zabbix Monitoring.

The doctors application is running on a Windows 2019 Server, virtualized.

Exchange functionality is provided here with a Linux LXC (Linux Container) with 6 GB RAM allocated and running Kerio, a full replacment for Exchange, including Web-Access.

Besides the not very open source PFsense, you might want to have a look at OPNsense, a (better) fork of PFsense. PFsenses mentality is $$$, not open source. OPNsense has a more modern GUI and includes more than you expect! I wouldn’t touch PFsense with a long pole!

I do not use the built in firewall for my clients (Almost all use OPNsense), but two friends have it running as home server, one uses the NethServer firewall. His real firewall died somewhere between Xmas and New Year 1.5 years ago, and getting replacements in that period was difficult. So a quick help to allow Internet at home has stayed and still works.

BTW, all my other clients use NethServer as SBS replacement, WITH Mail, Calendar, Adressbooks and more!

Most of my clients do not want “Cloud”, indeed for certain businesses (financial) it’s illegal in Switzerland.

My 2 cents
Andy

[harrioh]

Reading this kind of comments gives only one resolution: I have four years to retire all NethServer 7 systems and transfer their workload back to CentOS 8 servers running same services individually. There are more and more SME companies willing to do some investing on PRIVATE IT infra after they have learnetd Corporate Dominance issues during COVID-19.

I have a choise; most of the SME do not have. I just put more servers in our private cloud and go back to services model as it was before. I have been with Linux and open source since 1996 and running our family business exclusively on RedHat, CentOS and Fedora since 2000 ( the year last Windog server was retired and converted to Scientific Linux [at that time] )

Going along the Debian way is the easy way to give up for Windows converts.

Sad, sad, sad…

…addition:

Trying to be monolithic on-sever-for-everything is the old Window$ way. Take the steps on Linux/Unix and master one segment exeptionally well. OPNsense for office and IPFire are better Firewalls and designed to do just that. Nethserve should be SME businesses SBS first and if possible SME web application platform second.

[hector (Héctor Pérez)]

This thread makes me rebember the magic black guy Natking Coll with this famous song:

Siempre que te pregunto
Que cuándo cómo y dónde
Tú siempre me respondes
Quizás, quizás, quizás

A sí pasan los días
Y yo desesperado
Y tú, tú, tú, contestando
Quizás, quizás, quizás,

Estás perdiendo el tiempo
Pensando, pensando
Por lo que más tú quieras
Hasta cuando, hasta cuando

Y así pasan los días
Y yo desesperado
Y tú, tú contestando
Quizás, quizás, quizás

The link for the video: https://youtu.be/rDGgUGBD-90