How do you keep ancient software alive?

[Tegan]

So in the sciences we have massively expensive equipment (compared to our budgets) that often has a computer controlling it. Unfortunately, the equipment manufacturers don't usually maintain the software for very long and so that expensive equipment, which often lasts decades, is tied to an ancient operating system and the associated aging consumer grade PC.

The two main issues I'm looking at right now are: 1) how to mitigate the increasing difficulty of finding repair parts for aging computers, and 2) how to best bring them into compliance with IT security policies that say everything needs to be encrypted and on a supported OS.

I was thinking of migrate them to VMs which could be run locally on a modern hypervisor. From what I've read, most hypervisors aren't made for local use but Windows Server would do it. That would solve my issue of having a supported OS and allowing encryption. It would also make an easy way to migrate the whole system to a new computer if that needed to be replaced. It does seem a bit silly to run Windows Server to host a copy of XP, but that's my best solution so far.

Has anyone here had any success making such systems policy-compliant and relative future proof?

Other useful details: For my current challenge everything connects via USB. Also, I'm the guy using the equipment, not in IT. My technical skills are high enough to regularly enjoy this site, and run a tiny home lab, but probably not at your level.

 

[nexox]

I don't have much experience solving your particular sort of problem, but I will point out that you don't need a hypervisor for this, something like VirtualBox will run Windows XP and pass through USB devices just fine, should cost a lot less than a Windows Server license and it will be more portable.

 

[CyklonDX]

i'd ask what kind of acceptable encryption

with kvm's you can encrypt everything at any state.

by using amd-v (SEV) you can run encrypted memory
and encryption at rest is there too - all kinds on linux.

The great thing on kvm you can emulate older cpu's, and bioses so systems won't know its running on some super-hyper new box and still think its pentium 3 xeon.

while sure the os inside the vm itself is not being encrypted etc - but it is outside, just the vm isn't aware of it.

 

[Stephan]

If the issue is just USB, there is a company called Silex in Japan with DS-510 or newer and also ebay for older models which lets you connect USB gear to any Windows machine with the Silex client. Connects over TCP/IP and ethernet. Usually WoW64 on current 64-bit Windows will run old 32-bit applications alright, but Silex have a nice palette of supported Windows 32-bit versions: USB Device Server Setup

If you get a used box like an SX-3000GB from 15 years ago for like 10 bucks on ebay, just make sure to replace the power supply with a new one, because those age and die. Security updates for 32-bit Windows 10 also right at the end. If you need that for longer, best to air-gap it.