Vertical Sysadmin, Inc.

Setting up CI/CD Pipelines course

Fri, 15 Sep 2017 00:00:00 +0000

I’ll be teaching “Setting up CI/CD Pipelines” at Ohio LinuxFest in Columbus on Sep 29th, and at USENIX LISA in San Francisco on Oct 31st.

My colleague Mike Weilgart will be teaching Git Foundations: Unlocking the Mysteries at both conferences.

We are available for training and consulting engagements.

Sysadmin war story: "The network ate my font!"

Wed, 13 Sep 2017 00:00:00 +0000

About 15 years ago, I was the only UNIX sys admin in a factory, and I was asked to help with a “network issue” which hit the Help Desk.

The problem, it was explained to me, was that the network was eating the MICR font (Magnetic Ink Character Recognition – machine-readable font) on the checks.

Look at the last line on the below check image for an example of MICR font.

What I learned at LISA 2016 conference

Sun, 18 Dec 2016 00:00:00 +0000

USENIX Annual Technical Conference and LISA are the first professional conferences I went to as a fledgeling sysadmin. USENIX will always hold a special place in my heart. I attribute my professional success to regular training at USENIX conferences.

I really enjoyed LISA ‘16 in Boston.

This year I exhibited, promoting our training services. I learned that people are looking for training on Machine Learning (Big Data) and on Go; and I got to show Tom Limoncelli a success story from my “Time Management for System Administrators” training at Ohio Linux Fest that I had received just that morning.

Setting up a Postgres Sandbox

Sun, 13 Nov 2016 00:00:00 +0000

I’m a fan of disposable sandboxes using Vagrant and VirtualBox.

I’ve been using Postgres on the job for nearly a year, and a while back I decided it was time to have a dedicated Postgres instance on my personal computer, on a virtual machine, just to play around with.

I’m using a Mac, but the steps below should work without change for Windows or Linux. Let me know in the comments if you run into any problems following these steps!

Bootstrapping CFEngine agent to a regional (AWS) hub

Wed, 26 Oct 2016 00:00:00 +0000

Hat tip to my DevOps buddy Joaquin Menchaca for this one-liner to find out what AWS region your VM is in:

AWS_REGION=$(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone | sed -e 's/[a-z]$//')

I am going to use it to bootstrap my Kubernetes VMs to the right CFEngine hub for their AWS region (i.e., to the local hub).

Looking up Postgres table name by id

Mon, 24 Oct 2016 00:00:00 +0000

When working with [TOAST][1] tables, I had the relid (relation or table id) of the parent table, and needed to get its name.

Here is how to perform the lookup. For example, if the relid is 19665:

SELECT relid, relname FROM pg_catalog.pg_statio_user_tables WHERE relid = '19665';

Safely updating /etc/sudoers non-interactively

Wed, 19 Oct 2016 00:00:00 +0000

I recently added my account to /etc/sudoers on N servers using Ansible in raw mode (running a shell oneliner). We use visudo to edit /etc/sudoers when we are logged into a server, but since I was doing this in “batch” mode I wanted to do it non-interactively but still have the benefit of the file-locking and syntax checking and rollback that visudo provides. So I set visudo’s VISUAL environment variable to my external command:

Introducing Infrastructure Inventory with CFEngine Enterprise

Wed, 05 Oct 2016 00:00:00 +0000

CFEngine Enterprise makes it absurdly easy to track deployed servers. All you have to do is spin up a hub, install the lightweight agent on each host, and run cf-agent --bootstrap <hub> to setup a trust relationship between hub and hosts. (If you need any help setting this up, let me know.)

The agent will discover information about each host (hostname, address, OS version, disk utilization, packages installed, etc.) and the hub will collect and aggregate this data, so you can see at a glance things like, my OS inventory is 5% RHEL 4, 10% RHEL 5, 84% RHEL 6, and 1% RHEL 7.

CFEngine Inventory of Windows Server 2012

Mon, 03 Oct 2016 00:00:00 +0000

I am working on setting up a “reporting portal” CFEngine Enterprise hub to aggregate inventory from several hubs in different parts of a company (managed by different organizations). This one “superhub” would allows executives instant insight into infrastructure integrity.

While demonstrating my prototype, an executive liked the idea of having data at her fingertips so much, she asked, can we put our Windows servers into CFEngine?

I said sure, but CFEngine inventory on Windows is not as detailed as it is for UNIX and Linux. The next question naturally then is how detailed is it?

You think our training is expensive?

Thu, 08 Sep 2016 00:00:00 +0000

I charge US $3,000 per training day, plus a US $2,000 admin fee, to come on-site and train up to 12 staff using a training methodology that ensure that deep learning occurs. Some people have pushed back on the price as too expensive.

As Red Adair, the firefighter specializing in putting out oil well fires, once said:

“If you think it’s expensive to hire a professional to do the job, wait until you hire an amateur.”

Graphing within psql

Sun, 14 Aug 2016 00:00:00 +0000

I mentioned this on HN years ago but it’s nifty so add it here.

You can graph SQL output with gnuplot without leaving the psql (Postgres client) command-line.

Because @fusiongyro commented “This is incredible! I only wish it were a little easier to do on the fly,” I inquired on the amazingly helpful pgsql-general list.

There are two approaches: client-side and server-side.

Ian Barwick explained how to put all the prep stuff into a psql script, define your query and invoke the script.

Binding an SSH launcher to a GNU Screen hotkey

Sat, 13 Aug 2016 00:00:00 +0000

I have a confession to make. I use SSH to access servers.

I tell the sysadmins I teach to make changes to their servers using configuration management, but:

(a) most clients I work with are just starting to use configuration management so we use SSH to access the systems that aren’t under in configuration management yet, and

(b) I enjoy troubleshooting issues rather than just shooting my IT infrastructure in the head and instantiating a new one that might have the same issue. But this post isn’t about immutable infrastructures. It’s about SSHing to servers.

Time Management and Git training at Ohio Linux Fest

Fri, 29 Jul 2016 00:00:00 +0000

I am pleased to announce that Mike Weilgart and I will be delivering professional training for Ohio Linux Fest Institute in October.

I will teach “Time Management for System Administrators” and Mike will teach “Git Foundations: Unlocking the Mysteries”.

You can now register for Ohio Linux Fest.

On a personal note, I enjoy walking about Columbus, lots of history there, and I love walking into German Village.

Using Ansible to change sshd configuration

Thu, 28 Jul 2016 00:00:00 +0000

One of my clients is at the ssh “for” loop stage of automation maturity, so I installed Ansible. Because of selinux and Python version issues, I’m using the “raw” mode (which doesn’t require Python on the hosts, it just runs raw shell commands).

What follows is an example of using Ansible raw mode to make changes at scale.

Problem

A developer requested:

Please, activate these option on XYZ servers in the /etc/ssh/sshd_config so I can stay connected while debugging:

Infrastructure Management at Scale

Tue, 26 Jul 2016 00:00:00 +0000

I recently spoke at Digital Media Educators Conference (DMEC) on Infrastructure Management at Scale and the skills educators need to impart to up and coming system administrators.

This conference serves the California community college system, which is dear to my heart. My mother worked at West Los Angeles College library her entire professional life in America, since we arrived in 1988. I used to volunteer and help her out with shelving in the summer. I was a very poor helper since I kept getting distracted by all the delicous books and did more reading than shelving.

CFEngine Enterprise tip: showing hosts that have a broken RPM database

Sat, 16 Jul 2016 00:00:00 +0000

RPM database corruption is a common problem on Red Hat Linux systems at scale.

When it happens, you have to rebuild the RPM database: - https://access.redhat.com/solutions/6903 - http://www.cyberciti.biz/tips/rebuilding-corrupted-rpm-database.html

I am working on automating this repair with CFEngine. In the meantime, here is a Custom Report to identify these systems:

-- Aleksey Tsalolikhin, 12 July 2016
-- Show hosts that have broken RPM databases
select hosts.hostname,changetimestamp
from promiseexecutions
inner join hosts on promiseexecutions.hostkey = hosts.hostkey
where logmessages::text ilike '%rpm%db3%'
and changetimestamp > current_timestamp - '24 hours'::interval
order by changetimestamp;

Why I credit my career success to USENIX LISA training

Sat, 16 Jul 2016 00:00:00 +0000

I encourage *nix sysadmins to go to the annual USENIX LISA conference and avail themselves of the training there.

USENIX is the UNIX Users Group. Around since the seventies, it is now a global professional society spanning industry and academia.

The LISA (Large Installation System Administration) conference offers a mix of talks, presentations, expo hall, social activities and formal tutorials (e.g., last year’s program).

I attribute my professional success to being connected with USENIX, to attending every LISA conference I can, getting as much training as I can and to the amazing people I’ve met at LISA, many of whom are now dear friends.

Dumping RPM metadata

Mon, 11 Jul 2016 00:00:00 +0000

The other day, I wanted to find out which RPM metadata field was used to store the “el6” value in the “rpm -q” output for a package, e.g:

[root@as-ws-pr-la-01 Desktop]# rpm -q kernel-2.6.32-504.el6.x86_64
kernel-2.6.32-504.el6.x86_64
[root@as-ws-pr-la-01 Desktop]#

This came up because this output looks identical for CFEngine’s RHEL 4, 5 and 6 packages, even though there are two different packages involved.

So I used this one-liner to dump all RPM metadata which should be that RELEASE was most likely the proper field to update:

Feedback from "Taming the Git Filesystem" talk on June 2nd, 2016

Fri, 10 Jun 2016 00:00:00 +0000

Mike Weilgart is going to repeat his “Taming the Git Filesystem” talk on June 23rd in Burbank. In the meantime, here is what attendees said about the debut of this talk June 2nd at UUASC-LA/LOPSA-LA meetup:

“You definitely filled out some conceptual holes.” Stephen Franklin Systems Engineer

“I liked that it was approachable and assumed no prior knowledge.” Eric White Senior System Engineer

“Good foundational talk, Michael! Just as the description says, I’ve just learned enough about git to get my development work done. I occasionally find my ignorance of git’s foundation comes back to bite me in the rear. With this talk I can hope that happens less often.” George Wu Vice President of Engineering

Identifying critical unpatched vulnerabilities on a Red Hat system

Tue, 31 May 2016 00:00:00 +0000

These are some working notes for identifying critical unpatched vulnerabilities on a Red Hat Enterprise Linux system (version 6).

If you install yum-security plugin, you can list security updates available and which CVEs they relate to, as well as their severity according to Red Hat ratings system:

yum update-info list cves available

Identifying which unpatched CVEs (as returned by the yum-security plugin) are Critical according to CVSS (Common Vulnerability Scoring System), with score > 7:

Mario Obejas on "a replacement for bash?" and on writing production-grade code in any language.

Sun, 29 May 2016 00:00:00 +0000

Recently Yves Dorfsman asked on the lopsa-tech mailing list:

A lot of people love to hate bash, and there are good reasons for it, but it seems that there isn’t an obvious replacement for it. […] What do you use? Do you see any clear winner to replace it on the horizon?

Mario Obejas, a popular occasional Instructor for Vertical Sysadmin, and living proof that there is life after system administration, answered with this gem. This is the voice of 34 years of Software Development, Infrastructure, and Information Security experience, folks. (Thanks for allowing us to re-post it here, Mario!)

Ansible now available as an RPM

Thu, 26 May 2016 00:00:00 +0000

Ansible is now available as an RPM from the EPEL repo. It pulls in all the dependencies needed by Ansible (Python libraries, libyaml and sshpass). The RPM provides Ansible version 2.0.2.0 which includes a number of bug fixes including a security one (CVE-2016-3096). This is a lot easier to handle than fiddling with Python’s package manager of the day.

$ sudo yum install ansible
...
=============================================================================================================
Package Arch Version Repository Size
=============================================================================================================
Installing:
ansible noarch 2.0.2.0-1.el6 epel 2.9 M
Installing for dependencies:
PyYAML x86_64 3.10-3.1.el6 base 157 k
libyaml x86_64 0.1.3-4.el6_6 base 52 k
python-babel noarch 0.9.4-5.1.el6 base 1.4 M
python-crypto x86_64 2.0.1-22.el6 base 159 k
python-crypto2.6 x86_64 2.6.1-2.el6 epel 513 k
python-httplib2 noarch 0.7.7-1.el6 epel 70 k
python-jinja2-26 noarch 2.6-3.el6 epel 527 k
python-keyczar noarch 0.71c-1.el6 epel 219 k
python-paramiko noarch 1.7.5-2.1.el6 base 728 k
python-pyasn1 noarch 0.0.12a-1.el6 base 70 k
python-simplejson x86_64 2.0.9-3.1.el6 base 126 k
python-six noarch 1.9.0-2.el6 base 28 k
sshpass x86_64 1.05-1.el6 epel 19 k
Transaction Summary
=============================================================================================================
Install 14 Package(s)
Total download size: 6.9 M
Installed size: 33 M
Is this ok [y/N]:

Key references for various tools

Thu, 12 May 2016 00:00:00 +0000

The following post was contributed by Mike Weilgart who has recently joined the ranks of Linux system administrators.

For `bash` and POSIX shell scripting:

Variable quoting

Miscellaneous

For `vi` and Vim:

The article “Why, oh WHY, do those #?@! nutheads use vi?”
Stack Overflow answer encapsulating basics of vi command language
Stack Overflow answer encapsulating buffers vs. windows vs. tabs
Quick tips for using buffers effectively

For git:

What exactly do we mean by “branch”?
The Think Like a Git website, including all of the links on the “Resources” page.

`cgroups`:

Stack Exchange answer serving as an Introduction to cgroups

Training program to make a Novice System Administrator

Thu, 05 May 2016 00:00:00 +0000

I’ve put together a program to make entry-level Linux system administrators because we need more to maintain the IT fabric of modern civilization.

The program is self-paced, using online resources. This is not training I deliver personally, rather I will guide you to quality training resources, in the correct sequence, and work with you to debug any stops. There is no fee to me for this program. The training takes 2-3 months full-time and costs about USD 1,000 for the online training courses and books. You’ll need a practice computer you can install Linux on.

CFEngine Enterprise: Enabling Postgres Query Logging

Fri, 29 Apr 2016 00:00:00 +0000

Since the CFEngine Postgres database internals aren’t widely documented, you can learn more about them by observing what queries the Mission Portal sends to the DB (e.g., to do things like get the count of hosts with health issues which powers the health indicator you see in the Mission Portal status bar).

Postgres has a configuration parameter log_statement which you can change from none to all to enable query logging (i.e., all queries will get logged to /var/log/postgresql.log) to learn what queries the Mission Portal sends to the database.

CFEngine and Ansible are complementary

Thu, 18 Feb 2016 00:00:00 +0000

CFEngine is designed for ongoing maintenance and verification of desired state; whereas Ansible is designed as a simple tool for making changes quickly.

CFEngine and Ansible complement each other. For example, I have a CFEngine promise to inventory CliQr version by reading in /usr/local/osmosix/MANIFEST.MF. By pulling up a CFEngine Enterprise report, I can tell in 3 seconds how many of my thousands of hosts are on which version of CliQr. To run this report with Ansible would take minutes (the more hosts, the longer it would take).

LOPSA Mentorship Program protege Ionut Cadariu earns RHCE

Sat, 17 Oct 2015 00:00:00 +0000

I got a touching letter yesterday from a computer system administrator I’ve been mentoring over the years through the LOPSA Mentorship Program:

On Fri, Oct 16, 2015, Ionut Cadariu wrote: Hello Aleksey,

I finally achieved my long term objective -> to be Red Hat Certified Engineer…it was a long journey and I wanted to thank you for all the hard work you did with me in order to achieve this.

A big part of my career is because of you and I can’t thank you enough!

Senior Sysadmin becomes Director of Operations: Retrospective on Seven Years in Digital Cinema

Sun, 16 Aug 2015 00:00:00 +0000

In my position as Director of Production Systems at Deluxe Digital Cinema in Burbank (June 2013 - September 2014), I was responsible for Operation and Quality of Alchemy, Deluxe’s theatrical booking and delivery management system. This system would book which movies are going to play in which cinemas when, so Deluxe Digital Cinema could deliver the movie to each theatre and then deliver the decryption key so the cinema could play it.

CFEngine Bootstrapping Primer

Thu, 09 Jul 2015 00:00:00 +0000

Definitions

Managed server A server managed by CFEngine. Presumably one of many.

Policy server A file-sharing service used to distribute policy from some centralized point to a fleet of servers.

Hub A commercial add-on to CFEngine that collects reports from managed servers. These reports are available through the Web UI (another commercial add-on) and give you instant insight into the state of your infrastructure.

The policy server, the hub and the Web UI usually run on the same server called “hub” for short.

Can CFEngine compare server configurations?

Thu, 28 May 2015 00:00:00 +0000

One question I often hear sysadmins ask who are just getting into configuration management is, can CFEngine can report on configuration drift between servers? As in, take a server “A” and baseline it, and compare it to server “B”, and make a report telling where things are different.

Comparing existing servers is the hard way to go about getting consistency.

I have a story about how I got into configuration management.

LOPSA-LA/CFEngine-LA help Thomas Shin get a job at Amazon

Fri, 24 Apr 2015 00:00:00 +0000

@arlieth, who got his shiny job at Amazon a year and a half ago through a joint LOPSA-LA/CFEngine-LA meetup at Amazon Irvine, is doing very well:

“I’m in the process of performing a transition to Systems Engineer I. I can honestly say without a doubt that you’ve helped me make the biggest leap in my career. Thanks for everything, I really mean it.”

You are welcome! Very well done, Thomas and continue!

CFEngine is awesome

Sat, 04 Apr 2015 00:00:00 +0000

In March 2014 post, agent42 at Enigmabox discovers CFEngine is 10 times faster, uses less memory and has simpler policy for JSON-driven configuration than other software; and is delighted by awesome support.

agent42’s post reminded me what sealed the deal for me when I was evaluating which configuration management tool to use.

I started by surveying the configuration management field. I picked CFEngine to examine closer because:

a) CFEngine had been around the longest, since 1993, so I expected it would be mature, and

Should people who are already using CFEngine 3 attend professional CFEngine training?

Wed, 01 Apr 2015 00:00:00 +0000

Over the years, I’ve had more than one student come up to me on break or after course to tell me they wish they came earlier as it would have saved them time and trouble.

I’d like to share with you some real-life student comments (emphasis mine):

Last week I attended VSA’s CFEngine Policy Writing Workshop taught by Brian Bennett.

I wanted to take a quick second to thank Aleksey for putting this on and Brian for teaching. It was very helpful. I only wish I had taken it when I first started working with CFEngine.

Advice to a junior sysadmin on acquiring certainty in Linux Sys Admin Basics

Wed, 02 Oct 2013 00:00:00 +0000

A sysadmin I’m mentoring through the LOPSA Mentorship program has learned a lot on the job but is not sure what he is missing. He asked for help identifying what he knows, and where he should learn more.

I suggested he look at LPI’s page outlining what the LPIC-1 certification covers and follow this program:

1. Print the page

2. Check off the items that you are certain you know how to do / how to use

Configuration Management tools need to be robust. Here is how NASA builds robust software.

Sat, 08 Jun 2013 00:00:00 +0000

Configuration Management tools have become a critical part of our infrastructure. We expect and depend on these tools being robust.

For the tool makers I offer my notes on Dr. Holzmann’s talk on how NASA/JPL builds robust software. The first part introduces and describes the challenge, the second part contains the solutions.

Highlights from LOPSA East 2013 Configuration Management Workflows panel

Mon, 13 May 2013 00:00:00 +0000

Use Syntax Highlighters

Highlighting syntax is a big time server. Color highlighting lets you save time and trouble by catching errors early in the development process.

Use a syntax plug-in for your editor!

Revision control system hooks. Code review.

You can set up a precommit hook to validate syntax before accepting code into your VCS repository; or you can use Jenkins to syntax-check new commits and move them to another branch if they validate.

CFEngine claims to be comprehensive. There are 478 unique promise attributes in CFEngine 3.4.0.

Sun, 02 Dec 2012 00:00:00 +0000

CFEngine is designed to be comprehensive and to let you model nearly any aspect of the system’s configuration. There are 478 unique promise attributes in CFEngine 3.4.0 to enable you to do so.

Here is a detailed listing of all the promise attributes available in CFEngine 3.4.0, and the synopsis for each. For more detail, please consult the syntax guide or the reference manual.

Fortunately CFEngine is also designed to address challenges of Knowledge Management and allows you to summarize and abstract the underlying low-level detail.

Idempotence vs Convergence in Configuration Management

Thu, 08 Nov 2012 00:00:00 +0000

Diego Zamboni, author of “Learning CFEngine 3”, commented on A not-so-brief aside on reigning in chaos. His comment includes the clearest explanation of idempotence vs convergence I’ve ever seen:

About idempotence vs convergence: as you rightly point out, they are not the same, and there are very important differences. Idempotence is an operation that leaves the system unmodified if it’s already in the desired state, whereas convergence is the property of a system of not making unnecessary changes (nor operations). The end result may be the same, but CFEngine emphasizes convergence over idempotence, and has A LOT of built-in logic to automatically avoid performing unnecessary operations.

Making Conference Posters

Tue, 14 Aug 2012 00:00:00 +0000

At a certain point in your career, you may start sharing your work with others in your profession. You may be asked to present a poster at a conference summarizing your work.

There is a wonderful write-up by Colin Purrington, graphic designer, on creating academic posters - it is full of useful tips and is funny and passionate.

Guide to CFEngine 3 Body of Knowledge

Thu, 22 Sep 2011 00:00:00 +0000

Purpose: There is a lot to know about CFEngine, which can make it hard for people new to the subject. The purpose of this guide is to lay out the resources available to CFEngine students and to orient them to this body of knowledge to speed their journey into practical system automation with CFEngine 3.

The guide is based largely on the materials of cfengine.com with full gratitude to Mark Burgess for continuously raising the bar in the field of system administration.

Which open source configuration management tool should I use?

Thu, 15 Sep 2011 00:00:00 +0000

Resources for choosing a configuration management tool:

“Getting Started with Configuration Management”

Cory Lueninghoener. ;login:, Apr 2011.

“Configuration management tools take time to set up and maintain, but using one is well worth the effort. In this article I will present technical and social problems, solutions and advice related to getting started with a configuration management tool.” C.L.
“Configuration Management Summit”

Aleksey Tsalolikhin. ;login:, Oct 2010.

Conference report summary from the First Configuration Management Summit, with a concise overview of Bcfg2, CFEngine, Chef and Puppet, as well as the relative strengths and weaknesses of each.

Give Your Sysadmin Career a Boost with the LOPSA Mentorship Program

Wed, 22 Sep 2010 00:00:00 +0000

Mount Laurel, NJ, 22 September 2010 -

LOPSA, the League of Professional System Administrators, a professional sys admin organization, unveils a mentorship program. In fulfillment of LOPSA’s mission to support the practice of system administration, LOPSA’s sys admin members volunteer as mentors and as program coordinators. Anyone can join the program as a protege; membership in LOPSA in not required. This is truly a community service.

How does the LOPSA Mentor Program work?

Aleksey's Articles and Presentations on Open-Source Configuration Management

Wed, 15 Sep 2010 00:00:00 +0000

A Report from Configuration Management Summit 2010

“Introduction to Automating System Administration with Cfengine 3” (Brief version) (Longer version) (Full version)

UUASC-LA panel on Cfengine, Chef and Puppet on 1 Oct 2009 CFengine 2 presentation book. Video: part 1 part 2

UUASC-LA presentation on Cfengine 3 on 2 Sep 2010 Video: part 1 part 2 part 3

Comments welcome - please email me.

Wed, 15 Sep 2010 00:00:00 +0000

Comments are welcome - please email me: aleksey@verticalsysadmin.com

Getting started with Infrastructure As Code

Wed, 15 Sep 2010 00:00:00 +0000

After talking with John Willis of Chef/OpsCode at Ohio Linux Fest (I taught an intro class on Cfengine 3), I finally started to get Infrastructure As code.

Am immensely excited to try it out. My first project is to ephemerize the Web/App server tier in a staging environment - instead of rolling out a new version of the application, I will roll out a new VM, completely configured by Cfengine, and the new application, also installed by Cfengine.

Misc. Sys Admin Resources

Wed, 15 Sep 2010 00:00:00 +0000

Nutshell Comparison of PCI, PCI-X and PCI Express

Unix Flight Recorder

Relative Origin of Cfengine, Puppet and Chef

Wed, 15 Sep 2010 00:00:00 +0000

In Cfengine, creator Mark Burgess pioneered the idea of using a configuration description language to describe desired state on heterogeneous Unix and Unix-like systems. This language included “classes” or built-in if/then tests to control when and where the configuration should apply.

In Cfengine 2, Mark introduced ideas of convergence to a desired state and self-healing (computer immunology).

Puppet was created by a power Cfengine 2 user Luke Kanies out of his dissatisfaction with Cfengine 2 and Mark’s management of the project. Next generation tool after Cfengine 2, Puppet is graph-based and model-driven and has a very simple DSL language (designed to be simple, safe and human readable) and now a Ruby DSL (for additional power and flexibility). Puppet has a large and active community.

About Aleksey Tsalolikhin