Jump to content

Comparison of open-source configuration management software

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Micah (talk | contribs) at 15:28, 24 December 2007 (new puppet release). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

This is a comparison of free (libre) and open source configuration management software.

Basic properties

Language License Mutual auth Encrypts First release Latest stable release
Arusha Project (ARK) Python BSD [3] Yes [1] Yes [2] 2001-07-21 2005-04-19 20050419
Bcfg2 Python BSD [4] Yes [3] Yes [4] 2004-08-11 2007-11-09 0.9.5
Cfengine C GPL, FAL [5] Yes [1] Yes [5] 1993 2007-09-30 2.2.2
ISconf Python GPL [6] Yes [6] No [7] 1998 2006-08-13 4.2.8.233
LCFG Perl GPL Partial [8] Partial [9] 1994 2007-02-19 2007021901c
OCS Inventory NG with GLPI Perl, PHP, C++ GPL No [10] Yes [4] 2003 2007
PCfengine Python GPL [7] No [11] No [11] No public releases yet
PIKT C GPL [8] Yes [12] Yes[13] 1998 2007-09-10 1.19.0
Puppet Ruby GPL Yes [14] Yes [4] 2005-08-30 2007-12-13 0.24.1
Quattor Perl EDG[9] Yes [15] Yes [16] 2005-04-01 2007-02-07 1.2
Radmind C BSD [10] Yes [17] Yes [18] 2002-03-26 2007-07-5 1.9.0
SmartFrog Java LGPL Yes [19] Yes [19] 2004-02-11 2007-10-26 3.12.008
STAF C++ CPL [11] No [20] [21] Partial [22] 1998-02-16 2007-05-21 3.2.2

Platform support

Note: This means platforms on which a recent version of the tool has actually been used successfully, not platforms where it should theoretically work since it's written in good portable C/C++ or an interpreted language. It should also be listed as a supported platform on the project's web site.

AIX *BSD HP-UX Linux Mac OS X Solaris Windows Others
Arusha Project (ARK) Yes Yes Yes Yes No Yes No No
Bcfg2 Partial [23] Yes [24] No Yes [25] Partial [26] Yes No No
Cfengine Yes Yes [24] [27] [28] Yes Yes Partial [29] Yes Partial [30] No
ISconf Yes Yes Yes Yes Yes Yes No No
LCFG No No No Partial [31] Partial [32] Partial [33] No No
OCS Inventory NG with GLPI Yes Yes Yes Yes Yes Yes Yes No
PCfengine Yes No No Yes No Yes No No
PIKT Yes Yes Yes Yes No Yes No Yes [34]
Puppet Partial [35] Yes [36] Partial [37] Yes [38] Yes Yes No No
Quattor No No No Yes No Yes No No
Radmind Yes Yes [24] [27] [28] No Yes Yes Yes Yes No
SmartFrog No [39] No [39] Yes Yes Yes No [39] Yes No [39]
STAF Yes [40] Yes [41] Yes [42] Yes [43] Yes [44] Yes [45] Yes [46] Yes [47]

Short descriptions

Not all tools have the same goal and the same feature set. To help distinguish between all of these software packages, here is a short description of each one.

Arusha Project (ARK)
Manage package and configuration specification of hosts via a custom XML description language. Can be used as a front end for Cfengine or PIKT. Provides some collaboration features between administration 'teams'. The last commit dates from April 2007.
Bcfg2
Software to manage the configuration of a large number of computers using a central configuration model and the client-server paradigm. The system enables reconciliation between clients' state and the central configuration specification. Detailed reports provide a way to identify unmanaged configuration on hosts. Generators enable code or template based generation of configuration files from a central data repository.
Cfengine
Manages configuration of a large number of computers using the client-server paradigm. The server has the authoritative version of configuration: any client state which is different from the server is always reverted to the authoritative version. Configuration state is specified via a declarative language.
ISconf
Tool to execute commands and replicate files on all nodes. The nodes do not need to be up; the commands will be executed when they boot. The system has no central server so commands can be launched from any node and they will replicate to all nodes. It implements many of the ideas in "Why Order Matters: Turing Equivalence in Automated Systems Administration".
LCFG
LCFG manages the configuration with a central description language in XML, specifying resources, aspects and profiles. Configuration is deployed using the client-server paradigm. Appropriate scripts on clients (called "components") transcribe the resources into configuration files and restart services as needed.
OCS Inventory NG with GLPI
OCS Inventory NG, when integrated with GLPI, provides inventory and asset management scans/database, package deployment, distributed script execution, and via plugins permissions management and other configuration management functions. Here is a good diagram of its architecture.
PCfengine
This tool aim to be a better Cfengine written in Python. It uses Python directly as a language to describe configuration files. In contrast to Cfengine, it determines automatically the order in which actions are applied in the client. You can read about its concepts and api.
PIKT
PIKT is foremost a monitoring system that also does configuration management. "PIKT consists of a sophisticated, feature-rich file preprocessor; an innovative scripting language with unique labor-saving features; a flexible, centrally directed process scheduler; a customizing file installer; a collection of powerful command-line extensions; and other useful tools." [12]
Puppet
Puppet consists of a custom declarative language to describe system configuration, distributed using the client-server paradigm (using XML-RPC protocol), and a library to realize the configuration. The resource abstraction layer enables administrators to describe the configuration in high-level terms, such as users, services and packages.
Quattor
"The quattor information model is based on the distinction between the desired state and the actual state. The desired state is registered in a fabric-wide Configuration Database (CDB), using a specially designed configuration language for expressing and validating configurations, composed out of reusable hierarchical building blocks called templates. Configurations are propagated to and cached on the managed nodes." [13]
Radmind
Radmind manages hosts configuration at the file system level. In a similar way to Tripwire (and other configuration management tools), it can detect external changes to managed configuration, and can optionally reverse the changes. Radmind does not have higher-level configuration element (services, packages) abstraction. A graphical interface is available (only) for Mac OS X.
SmartFrog
Java-based tool to deploy and configure applications distributed across multiple machines. There is no central server; you can deploy a .SF configuration file to any node and have it distributed to peer nodes according to the distribution information contained inside the deployment descriptor itself.
STAF
"The Software Testing Automation Framework (STAF) is an open source, multi-platform, multi-language framework designed around the idea of reusable components, called services (such as process invocation, resource management, logging, and monitoring)." [14] There are STAF plugins to perform a variety of common configuration management functions, such as distributed scheduling, execution, and file copying.

References

  1. ^ a b Key Pair: Uses public/private key pairs and key fingerprints for mutual authentication, like SSH.
  2. ^ Secure Shell: Uses the Secure Shell protocol for encryption.
  3. ^ Certificate and Passwords: Uses SSL X.509 certificate and fingerprint for clients to authenticate server, and passwords for server to authenticate clients; clients should only share the same password if they are allowed access to each other's configuration data.
  4. ^ a b c SSL: Uses the Secure Sockets Layer / Transport Layer Security (TLS) for encryption.
  5. ^ Custom: Uses code specific to the software for this function.
  6. ^ HMAC: Uses HMAC signatures on all network traffic.
  7. ^ Improved security which would include an encrypted, mutually authenticated, peer-to-peer message bus is tracked here.
  8. ^ LCFG does not provide its own transport mechanism; it relies on an external program, most often Apache. Using Apache it should be possible to do mutual authentication in several ways; however the documentation at The Complete Guide to LCFG, Section 9.4: Authorization and Security, shows access control based on IP address ranges, implying that the client does not authenticate itself to the server via a SSL certificate; it also does not mention if the LCFG client checks the validity of the server's SSL certificate (such as via a per-site fingerprint distributed with the client, or a chain of trust to an accredited CA). It mentions that there can be a per-client password in the profile, but also states that "The contents of the LCFG profile should be considered public".
  9. ^ LCFG supports encrypted communications channels (SSL via Apache); however the documentation at The Complete Guide to LCFG, Section 9.4: Authorization and Security, states that "The contents of the LCFG profile should be considered public".
  10. ^ Server authenticates to client, but client does not authenticate to server. See OCS Inventorty NG Installation and Administration guide, page 114.
  11. ^ a b It is not clear if PCfengine's networking code was ever completed. The README states that libdnet is used, which doesn't look like it supports any kind of strong network security.
  12. ^ PIKT uses shared secret keys for mutual authentication. "As an option, you can use secret key authentication to prove the master's identity to the slave. [...] If one managed to crack any system in the PIKT domain, one would have access to all common secrets. To solve this problem, you may use per-slave uid, gid, and private_key settings." - from Security Considerations.
  13. ^ "For file installs, file fetches (to diff against the central configuration), and command executions, you can optionally encrypt all such data traffic between master and slave." - from Security Considerations.
  14. ^ Certificates: Uses SSL X.509 Certificates for mutual authentication. Can use any SSL Certificate Authority to manage the Public Key Infrastructure.
  15. ^ "Client to server authentication and vice versa: on one hand, this allows to enforce access policies to sensitive data according to the client "name", on the other hand, clients are guaranteed to talk to the original server." - from Quattor Installation and User Guide: Version 1.1.x, page 70
  16. ^ "[...] secure information transfer, since data are encrypted: this prevents eavesdroppers from obtaining information in transit over the network." - from Quattor Installation and User Guide: Version 1.1.x, page 70
  17. ^ "SSL certificates can also be used to authenticate both the Radmind server and the managed clients, regardless of DNS or IP-address variation." - from Radmind: The Integration of Filesystem Integrity Checking with Filesystem Management
  18. ^ "For network security, Radmind supports SSL-encrypted links. This allows nodes on insecure networks to be updated securely." - from Radmind: The Integration of Filesystem Integrity Checking with Filesystem Management
  19. ^ a b See Using the new SmartFrog Security
  20. ^ Network Trust: Trusts the network, like rsh.
  21. ^ User-only Auth: User authenticates to server via password, but uses Network Trust to authenticate user to server, like telnet.
  22. ^ There is a feature request for a Secure TCP/IP Connection Provider, and one of the developers stated on 2007-04-05 that "You will need to download the source code for OpenSSL and point the build files at it. Other than that, it should just work.", so it looks like there may be working encryption if you build from scratch instead of using the prebuilt binaries. It is unclear what if any authentication building against OpenSSL would give STAF.
  23. ^ Encap, RPM, and POSIX File Support Only
  24. ^ a b c FreeBSD
  25. ^ Debian, Ubuntu; Gentoo; RPM-based distributions (CentOS, Mandrake, Red Hat, RHEL, SLES, SuSE)
  26. ^ POSIX File and Launchd Support Only
  27. ^ a b NetBSD
  28. ^ a b OpenBSD
  29. ^ Support for Darwin, Mac OS X's *BSD base, via Darwin Ports
  30. ^ Cfengine 1 was ported to Windows NT4 using Cygwin. Was unable to find more recent version or indication that anyone was actively maintaining or using Cfengine 2 on Windows.
  31. ^ "Recent versions run on Fedora Core (3, 5, 6). Various people have ported some of the LCFG core to other Linux distributions, such as Debian, but these ports have not been incorporated"
  32. ^ "There has been an experimental port to Mac OS X, which does work and includes some Mac-specific components. However, this is not production quality and the lack of uniform packaging system under OS X means that automatic management of installed software is likely to be difficult."
  33. ^ "LCFG core has been ported back to Solaris and we are using this in production, although the software has not been packaged for distribution, and is not so well supported"
  34. ^ Digital Unix; IRIX
  35. ^ Support for any types that are used on other platforms (e.g., init.d services, files)
  36. ^ OpenBSD, FreeBSD
  37. ^ Support for any types that are used on other platforms (e.g., init.d services, files)
  38. ^ CentOS, Debian, Gentoo, Red Hat, SuSE
  39. ^ a b c d Written in Java, so should in theory work on this platform if there is the appropriate JVM version available for it; however it has not been tested on the platform, which should be considered unsupported.
  40. ^ 4.3.3+ (Power_32); 5.1+ (Power_32, Power_64)
  41. ^ FreeBSD 4.10 (x86_32); FreeBSD 6.1+ (x86_32)
  42. ^ 11.00+ (PA-RISC_32, IA_64)
  43. ^ (x86_32, x86_64, IA_64, PPC_64, zSeries_32, zSeries_64)
  44. ^ 10.2+ (?) [1][2]
  45. ^ 2.6+ (Sparc_32); 10+ (x86_32, x86_64)
  46. ^ 95, 98, Me, NT4, 2000, XP, 2003, Vista (x86_32); 2003, Vista (x86_64); 2004 (IA_64)
  47. ^ OS/400 5.2+ (iSeries_32); z/OS UNIX 1.4+
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Comparison_of_open-source_configuration_management_software&oldid=179963276"