Comparison of open-source configuration management software

References

1. Key pair: uses public/private key pairs and key fingerprints for mutual authentication, like SSH.
2. Secure Shell: Uses the Secure Shell protocol for encryption.
3. Certificate and Passwords: Uses SSL X.509 certificate and fingerprint for clients to authenticate server, and passwords
4. SSL: Uses the Secure Sockets Layer, Transport Layer Security (TLS) for encryption.
5. Full support for non-modifying determination of node compliance, including nodes not previously modified by a Bcfg2 conf
6. Per request signed headers and pre-shared keys.
7. Payload encryption via SSL if HTTPS proxy is configured.
8. Chef 10.14.0+ (called why-run mode)
9. HMAC: Uses HMAC signatures on all network traffic.
10. Certificates: Uses SSL X.509 Certificates for mutual authentication. Can use any SSL Certificate Authority to manage the
11. Using the --noop option
12. Using the Audit mode.
13. Network Trust: Trusts the network, like rsh.
14. User-only Auth: User authenticates to server via password, but uses Network Trust to authenticate user to server, like t
15. Secure Shell: Uses the Secure Shell protocol for authentication.
16. Synctool performs a dry-run by default, and only modifies things when invoked with '--fix'.
17. yes for managed machine; no for managing machine
18. Encap, RPM, and POSIX file support only.
19. FreeBSD.
20. Debian, Ubuntu; Gentoo; RPM-based distributions (CentOS, Mandrake, Red Hat, RHEL, SLES, SuSE)
21. POSIX File, Launchd, and MacPorts Support only.
22. Unix.
23. "Only support Guix system."
24. "It also works on Guix system with HURD."
25. "Recent versions run on Fedora Core (3, 5, 6). Various people have ported some of the LCFG core to other Linux distribut
26. "There has been an experimental port to OS X, which does work and includes some Mac-specific components. However, this i
27. "LCFG core has been ported back to Solaris and we are using this in production, although the software has not been packa
28. Digital Unix; IRIX
29. NetBSD.
30. OpenBSD.
31. Multiple users have successfully built and run the agent on FreeBSD, but no official package is available currently.
32. Android.
33. Written in Java, so should in theory work on this platform if there is the appropriate JVM version available for it; how
34. Will run anywhere Python runs, but handlers for different platforms are untested.
35. 4.3.3+ (Power 32); 5.1+ (Power 32/64)
36. FreeBSD 4.10 (x86-32); FreeBSD 6.1+ (x86-32)
37. 11.00+ (PA-RISC 32, IA-64)
38. (x86-32, x86-64, IA-64, PPC 64, zSeries 32/64)
39. 2.6+ (Sparc 32); 10+ (x86-32, x86-64)
40. 95, 98, Me, NT4, 2000, XP, 2003, Vista (x86-32), 7 (x86-32), 7 (x86-64); 2003, Vista (x86-64); 2004 (IA-64)
41. OS/400 5.2+ (iSeries 32); z/OS Unix 1.4+
42. Synctool runs on any platform that supports SSH, rsync and Python.
43. SuSE"
44. ansible.com
    http://www.ansible.com/products/awx-project/faq
45. docs.ansible.com
    https://github.com/ansible/ansible/blob/stable-2.18/changelogs/CHANGELOG-v2.18.rst#v2-18-4
46. GitHub
    https://github.com/Bcfg2/bcfg2/blob/master/LICENSE
47. "Bcfg2 Web Reporting System — Bcfg2 1.3.6 documentation"
    http://docs.bcfg2.org/reports/dynamic.html#screenshots
48. "Download – Bcfg2"
    http://bcfg2.org/download/
49. "cdist 6.9.8 has been released"
    https://groups.google.com/g/cdist-configuration-management/c/38qJsamcXJ8
50. "[#CHEF-13] Add -noop support - Opscode Open Source Ticket Tracking"
    https://web.archive.org/web/20140226055656/https://tickets.opscode.com/browse/CHEF-13
51. "Chef Infra Client 18.1.0 Released! - Chef Release Announcements - Chef Questions"
    https://discourse.chef.io/t/chef-infra-client-18-1-0-released/21738
52. "Chef Infra Server 15.4.0 Released! - Chef Release Announcements - Chef Questions"
    https://discourse.chef.io/t/chef-infra-server-15-4-0-released/21739
53. "CFEngine Source Code"
    https://github.com/cfengine/core
54. GitHub
    https://github.com/cfengine/core/blob/master/LICENSE
55. "tls_min_version in common control"
    https://docs.cfengine.com/latest/reference-components.html#tls_min_version
56. "--dry-run option for cf-agent"
    https://docs.cfengine.com/latest/reference-components-cf-agent.html
57. "dryrun option in agent control"
    https://docs.cfengine.com/latest/reference-components-cf-agent.html#dryrun
58. "--simulate option for cf-agent"
    https://docs.cfengine.com/latest/reference-components-cf-agent.html
59. "Common promise attribute action_policy warn or nop"
    https://docs.cfengine.com/docs/latest/reference-promise-types.html#action_policy
60. "CFEngine Enterprise Mission Portal"
    https://cfengine.com/product/
61. "CFEngine 3.26.0 released"
    https://cfengine.com/blog/2025/cfengine-3-26-released-admin/
62. "CFEngine 3.24.2 released"
    https://cfengine.com/blog/2025/cfengine-3-21-7-and-3-24-2-released/
63. "CFEngine 3.21.7 released"
    https://cfengine.com/blog/2025/cfengine-3-21-7-and-3-24-2-released/
64. "Consfigurator"
    https://spwhitton.name/tech/code/consfigurator/
65. GitHub
    https://github.com/spwhitton/consfigurator/tags
66. "GNU Guix Reference Manual"
    https://web.archive.org/web/20210612235408/https://guix.gnu.org/en/manual/en/guix.html
67. "GNU Guix Reference Manual"
    https://web.archive.org/web/20210612235408/https://guix.gnu.org/en/manual/en/guix.html
68. git.savannah.gnu.org
    https://git.savannah.gnu.org/cgit/guix.git/tree/gnu.scm?h=v1.4.0#n8
69. It requires the guix daemon on the target Guix system.
70. "/trunk/LICENSE - ISconf"
    https://archive.today/20130415235717/http://trac.t7a.org/isconf/browser/trunk/LICENSE
71. "#39 (Implement TCP mesh) - ISconf - Trac"
    https://archive.today/20120716131832/http://trac.t7a.org/isconf/ticket/39
72. "Juju Source Code"
    https://github.com/juju/juju
73. "Juju Gui"
    https://web.archive.org/web/20150621233749/https://demo.jujucharms.com/trusty/juju-gui/
74. "timeline: pyjuju"
    https://launchpad.net/juju/+series
75. "GitHub"
    https://github.com/juju/juju/releases
76. LCFG does not provide its own transport mechanism; it relies on an external program, most often Apache. Using Apache it
    http://www.lcfg.org/doc/guide.pdf
77. LCFG supports encrypted communications channels (SSL via Apache); however the documentation at The Complete Guide to LCF
    http://www.lcfg.org/doc/guide.pdf
78. nocproject.org
    https://kb.nocproject.org/display/SITE/NOC
79. Server authenticates to client, but client does not authenticate to server. See OCS Inventory NG Installation and Admini
    https://prdownloads.sourceforge.net/ocsinventory/OCS_Inventory_NG-Installation_and_Administration_Guide_1.9_EN.pdf.zip?download
80. "2.1.2 stable published"
    http://www.ocsinventory-ng.org/en/home/news/ocs-inventory-ng-2.1.2-stable-publised.html
81. "PIKT Licensing"
    http://pikt.org/pikt/licensing.html
82. PIKT uses shared secret keys for mutual authentication. "As an option, you can use secret key authentication to prove th
    http://pikt.org/pikt/ref/ref.6.security_considerations.html
83. "For file installs, file fetches (to diff against the central configuration), and command executions, you can optionally
    http://pikt.org/pikt/ref/ref.6.security_considerations.html
84. "Index of /pikt/dist"
    http://pikt.org/pikt/dist/?C=M;O=A
85. "Evolving Puppet for the Next 10 Years"
    https://puppet.com/blog/evolving-puppet-for-next-10-years
86. "puppet agent Man Page — Documentation — Puppet Labs"
    https://web.archive.org/web/20130707135331/http://docs.puppetlabs.com/man/agent.html
87. olindata.com
    https://web.archive.org/web/20150117063953/http://www.olindata.com/blog/2014/01/puppet-management-gui-comparison
88. "Index of /puppet"
    http://puppetlabs.com/downloads/puppet/?C=M;O=A
89. "Puppet release notes"
    https://puppet.com/docs/puppet/latest/release_notes_puppet.html
90. "Puppet Server: Release Notes"
    https://puppet.com/docs/puppetserver/latest/release_notes.html
91. GitHub
    https://github.com/pyinfra-dev/pyinfra/releases/tag/v0.1
92. GitHub
    https://github.com/pyinfra-dev/pyinfra/releases/tag/v3.2
93. "EU DataGrid Software License (EUDatagrid) | Open Source Initiative"
    http://www.opensource.org/licenses/eudatagrid.php
94. "DataGrid Software License (do not change the page URL)"
    http://eu-datagrid.web.cern.ch/eu-datagrid/license.html
95. "Client to server authentication and vice versa: on one hand, this allows to enforce access policies to sensitive data a
    http://isscvs.cern.ch:8180/cgi-bin/cvsweb.cgi/%7Echeckout%7E/elfms/quattor/documentation/installation-guide/pdf/quattor-install-guide_1_1.pdf?rev=HEAD&content-type=application/pdf&cvsroot=elfms
96. "[...] secure information transfer, since data are encrypted: this prevents eavesdroppers from obtaining information in
    http://isscvs.cern.ch:8180/cgi-bin/cvsweb.cgi/%7Echeckout%7E/elfms/quattor/documentation/installation-guide/pdf/quattor-install-guide_1_1.pdf?rev=HEAD&content-type=application/pdf&cvsroot=elfms
97. quattor-documentation.readthedocs.io
    https://quattor-documentation.readthedocs.io/latest/ncm-ncd/ncm-ncd.html#other-options
98. "Index of /quattorsw/software/quattor/release"
    https://web.archive.org/web/20140318090836/http://quattorsw.web.cern.ch/quattorsw/software/quattor/release/
99. quattor.org
    https://www.quattor.org/news/2024/11/22/announcing-quattor-24.10.0.html
100. "Research Systems Unix Group: beepage"
     https://web.archive.org/web/20150210155103/http://rsug.itd.umich.edu/software/copyright.html
101. "SSL certificates can also be used to authenticate both the Radmind server and the managed clients, regardless of DNS or
     http://www.usenix.org/events/lisa03/tech/full_papers/craig/craig_html/index.html
102. "For network security, Radmind supports SSL-encrypted links. This allows nodes on insecure networks to be updated secure
     http://www.usenix.org/events/lisa03/tech/full_papers/craig/craig_html/index.html
103. "Radmind - Browse /radmind/radmind-0-6-0 at"
     https://sourceforge.net/project/showfiles.php?group_id=141444&package_id=155276&release_id=392624
104. sourceforge.net
     https://sourceforge.net/project/showfiles.php?group_id=141444
105. GitHub
     https://github.com/krimdomu/Rex/releases/tag/0.9.0
106. GitHub
     https://github.com/RexOps/Rex/blob/master/ChangeLog
107. rudder.io
     https://faq.rudder.io/knowledge-bases/2/articles/6-what-licences-apply-to-rudder
108. "Policy Mode (Audit/Enforce) - Rudder 4.0 - User Manual"
     https://www.rudder-project.org/doc-4.0/_policy_mode_audit_enforce.html
109. rudder.io
     https://docs.rudder.io/changelogs/7.3/main.html
110. Sourceforge
     https://sourceforge.net/p/smartfrog/svn/8898/
111. See Using the new SmartFrog Security
     http://www.hpl.hp.com/research/smartfrog/papers/sfSecurityTutorial.pdf
112. "SmartFrog - Browse /development/smartfrog-3.18.016 at SourceForge.net"
     https://sourceforge.net/projects/smartfrog/files/development/smartfrog-3.18.016/
113. Salt is an open source tool to manage your infrastructure. Easy enough to get running in minutes and fast enough to mana
     http://saltstack.org/
114. saltstack.com
     http://docs.saltstack.com/en/latest/topics/installation/index.html#dependencies
115. SaltStack
     http://saltstack.org/topics/index.html#open
116. SaltStack
     http://saltstack.org/topics/index.html#building-on-proven-technology
117. saltstack.com
     http://docs.saltstack.com/en/latest/topics/ssh/
118. SaltStack
     http://www.saltstack.com/enterprise/
119. GitHub
     https://github.com/erwindon/SaltGUI
120. vmware.com
     https://www.vmware.com/products/vrealize-automation/saltstack-config.html
121. SaltStack
     http://saltstack.org/topics/releases/0.6.0/
122. saltstack.com
     https://github.com/saltstack/salt/releases
123. fedorahosted.org
     https://fedorahosted.org/spacewalk/wiki/SpacewalkFaq#HowlonghasSpacewalkbeenaround
124. GitHub
     https://github.com/spacewalkproject/spacewalk/wiki
125. sourceforge.net
     https://staf.sourceforge.net/license.php
126. There is a feature request for a Secure TCP/IP Connection Provider, and one of the developers stated on 2007-04-05 that
     https://sourceforge.net/tracker/index.php?func=detail&aid=940264&group_id=33142&atid=407384
127. sourceforge.net
     https://staf.sourceforge.net/history.php
128. sourceforge.net
     https://staf.sourceforge.net/
129. Synctool aims to be easy to understand and use. It is built in Python and uses SSH and Rsync.
     http://www.heiho.net/synctool/
130. heiho.net
     http://www.heiho.net/synctool/doc/chapter2.html
131. GitHub
     https://github.com/walterdejong/synctool/blob/master/LICENSE
132. walterdejong.github.io
     https://walterdejong.github.io/synctool/doc/chapter1.html
133. heiho.net
     http://www.heiho.net/synctool/doc/chapter1.html
134. GitHub
     https://github.com/walterdejong/synctool/releases
135. "Uyuni: Forking Spacewalk with Salt and Containers"
     https://news.opensuse.org/2018/05/26/uyuni-forking-spacewalk-with-salt-and-containers/
136. Uyuni
     https://lists.opensuse.org/archives/list/[email protected]/thread/QJBVKBUS25XJHEUAFHXGYDYT44QCZ334/
137. Installation: Control Machine Requirements
     http://docs.ansible.com/intro_installation.html#control-machine-requirements
138. Opscode and IBM Join Forces to Bring Open Source Cloud Automation to the Enterprise
     http://www.opscode.com/blog/2013/04/25/opscode-and-ibm-join-forces-to-bring-open-source-cloud-automation-to-the-enterprise/
139. Install the chef-client on Microsoft Windows
     https://docs.chef.io/windows.html#install-the-chef-client-on-windows
140. spwhitton.name
     https://spwhitton.name/doc/consfigurator/introduction.html#portability-and-stability
141. Windows workloads using juju
     https://jujucharms.com/docs/1.25/about-juju#what-about-windows-or-other-linux-operating-systems?
142. Puppet on Windows: top questions for 2019
     https://puppet.com/blog/puppet-windows-top-questions-2019/
143. Pyinfra WinRM connector
     https://github.com/pyinfra-dev/pyinfra-windows
144. sourceforge.net
     https://sourceforge.net/p/quattor/mac-quattor/
145. "Rex installation instructions"
     http://www.rexify.org/get
146. GitHub
     https://github.com/cfengineers-net/rudder-packages/tree/master/rudder-agent/other
147. SaltStack
     http://saltstack.org/topics/tutorial.html#installing-salt
148. Salt was added to the OpenCSW package repository in September of 2012 in version 0.10.2 of Salt
     http://docs.saltstack.org/en/latest/topics/installation/solaris.html
149. fedorahosted.org
     https://fedorahosted.org/spacewalk/wiki/BrainBox
150. fedorahosted.org
     https://fedorahosted.org/spacewalk/wiki/WikiStart#Introduction
151. fedorahosted.org
     https://fedorahosted.org/spacewalk/wiki/ManagingSolarisSystems
152. [1]10.2+ (?)
     https://sourceforge.net/tracker/index.php?func=detail&aid=1458480&group_id=33142&atid=407383
153. "Installation — Ansible Documentation"
     https://docs.ansible.com/ansible/latest/intro_installation.html#control-machine-requirements
154. "CFEngine vs Puppet: Detailed Comparison | UpGuard"
     https://www.upguard.com/blog/puppet-cfengine
155. Computer Immunology
     https://www.usenix.org/legacy/event/lisa98/full_papers/burgess/burgess.pdf
156. GitHub
     https://github.com/chef/chef-server
157. upguard.com
     https://www.upguard.com/articles/puppet-vs.-chef-revisited
158. "GNU Guix Reference Manual"
     https://web.archive.org/web/20210612235408/https://guix.gnu.org/en/manual/en/guix.html
159. "GNU Guix Reference Manual"
     https://web.archive.org/web/20210612235408/https://guix.gnu.org/en/manual/en/guix.html
160. "opsi features"
     https://web.archive.org/web/20090130033052/http://www.opsi.org/features/
161. Puppet Labs
     https://puppetlabs.com/blog/ruby-dsl/
162. puppetlabs.com
     https://web.archive.org/web/20130513170449/http://docs.puppetlabs.com/puppet/3/reference/whats_new.html#ruby-dsl-is-deprecated
163. "Performance"
     https://docs.pyinfra.com/en/3.x/performance.html#performance
164. "Pyinfra"
     https://pyinfra.com/