I see three possible ways to infect your server/network:
email
internet
USB
To the first: seperate the email-server from NS7 to an up-to-date one. Use any restriction for your dedicated email-server you can. There are quite a lot, and users, customers and suppliers may complain. Check it - if you don’t know, ignore it. Be safe. Let them complain or isolate an email and check it before delivering to a user.
To the second: use a proper firewall with all possible pre-cautions (there are tons) you can take. Restrict any connection you don’t trust/know. I.e. the only open port at the FW for an email server is 25. Nothing more. Restrict your WAN, WLAN, VLAN AND LAN. Do you need bluetooth in a company? Use your own VPN’s for your company. Yes, again: users may complain. So? A server may also complain - check it before allowing to connect to elsewhere. Read the logs. At least for a few weeks. Remember: your company will stand totally still without IT.
To the third: disable USB in any PC. And again: users may complain.
Not to forget - most important: backup, backup, backup. Think careful about retention. And test the backup in case of…
I’m talking about a SME company, nothing else. This can only be done on your own in a small company. I’m aware of this. There’s a company size, you have to have professionals. Of course.
Why? NS8 provides a simple UI to configure SME services as NS7 did.
The difference is under the hood, it’s now podman containers instead of distro services which has the advantage of having a cleaner system.
For example, when you uninstalled software on NS7, some artifacts were always left.
It always depends on the IT knowledge of the person who runs the company. But for NS8 you just need to go to CLI for creating a user to access via SSH and for network configuration and even there is a text UI available. The rest is done in the web UI cluster-admin.
Also the NS7 needed a permanent internet connection? What about mailing, web server and updating etc.?
You need an SSD now, that’s it. Also with Windows servers it’s not always possible to just use the old hardware when you update as the new software may need more resources.
As said, it’s just a bit of podman (only if you want customization). All other things are possible in web UI.
Yes, it’s the same with NS8. Did you ever try it?
It was just one example that on EOL systems updates won’t work anymore at some point.
The solution for an old NS7 is to separate it’s services to new servers? This way you loose the advantage of NethServer, that services are preconfigured to each other. If I need to setup new servers/services it costs resources and time and makes maintenance harder.
I think this is a contradiction to what you want.
Unfortunately OP went rogue, and the topic was heavily oversteered into “application phylosophy” rather than “case analysis”.
So I’m doubling down, pedal to the metal and continuing on the slide…
I’m sorry, Marcus. Your words are mostly true, but are missing some of the points.
NS7 is/was a “distro” on top on CentOS7, and any module was a package. That distro was virtualization-keen, had some limits about the structure (single userbase) and provided some services; adding more packages on the side would not harm too much the setup.
NS8 is an application on a limited set of Linux distros; one is officially supported for payed support, 3 more are tolerated as base of setup.
NS8 for achieving the goal of multi-server structure acts like a cluster management tool.
NS8 for delivering services/applications imply a containerized structure, only with podman.
The installation is hostage of NethServer 8, sysadmin can do “some things” but not too much.
Due to this structure (I’m not debating the approach nor the tools)…
“metal” is owned by NS8
no other container manager should be installed on that machine
is far better avoid deplyiment of other podman containers that are not the modules provided by the “marketplace”
Therefore… competition is not anymore with any “one man band” distros but with players like
ProxMox
XCP/XenServer
Windows Hyper-V
Red Hat OpenShift
Oracle Virtualization (OCI)
Any HA-oriented clustering system
Any container system which is not podman
ESX (which Broadcom put out of game plain and straight for any Small and most Medium companies)
which is not a simple league change… it’s whole another sport, like from MTB riding to a fully fledged motor racing team.
While delivering mostly the same services, NS7 and NS8 are not similar in any way and the “8” song is a marketing jingle. Hardware requirements and system structure follows that.
Now… the upgrade and scaling capabilities are not existing in NS7 even with current software support, is not designed for that: Sysadmin can only increase ram, storage, probably tweak some of the parameters for optimize system perfomances.
For NS8, these are the founding grounds for allow any installation to grow, expand, experiment and outsurce/outplace, but are (IMO) some sort of hindrance in small scale installs, like the one of the OP; an example is that all the nodes must have a VPN solution integrated, probably not that useful in a single node install. And without saying, not useful for homelabbing or small companies (until some buyout).
All persons saying “is not that different”, “kinda like the same thing”, are stating uncorrect things.
The truthful one is “can do mostly the same things and some more unavailable for the other product”.
Because compared to a lot of other “mostly comparable software” well.. I’d love to se a discussion on that, could be really important to improve my knowledge.
I fully agree from a technical point of view - this is what I meant by under the hood.
But on a higher abstraction level, NS8 provides some services and has a simple UI to manage them, like NS7 did.