Manage Your Configuration with Rudder

Take the Helm

Many administrators rely on Ansible for configuration management, but Rudder [1] is an interesting alternative that combines legacy dashboard functionality with configuration management. Put simply, Rudder handles two tasks at the same time in a web-based environment that monitors the configurations of your infrastructure components continuously in real time, presents a high-level summary, and supports ISO 27001 rules.

Implementing an end-to-end configuration strategy can be challenging, which is where Rudder enters the scene. The tool is based on a simple framework that lets you apply specific low-level configuration patterns with the integrated rule editor. Like a modular system, Rudder uses basic configuration elements, and the graphical builder significantly reduces the level of technical wizardry you need. However, those who prefer a command-line approach can steer their environment at the console level.

In principle, policies can be configured independently of each other at the policy and host levels with Enforce policy mode to assert configuration changes. Another positive aspect is that Rudder supports physical and virtual devices, which means you can monitor traditional servers and infrastructure components and modify their configurations, and you can do the same for your virtual servers and cloud instances.

Rudder also supports embedded Internet of Things (IoT) devices. You always have the choice of the level at which central configuration will take place. You can define this globally with configuration rules and on a node-specific basis. Auditing is also supported.

Rudder relies on a classic agent-server environment for monitoring and configuration management. The use of agents is mandatory. According to the developers, the lightweight agent, which is programmed in C, is extremely fast: Processing 100 rules takes fewer than 10 seconds.

Rudder's primary area of application to date has been small to medium-sized infrastructures. Typical implementations manage several hundred to a thousand nodes. You can integrate the environment into your existing monitoring environment with the API. Another benefit is that you can also implement sophisticated configurations in the web graphical user interface (GUI). Rudder also helps you understand specific interrelationships. Against this background, the project name makes sense: Rudder is the central entity that steers an IT infrastructure, including those times when you need a change of direction.

A couple of restrictions apply to the two versions of Rudder: Rudder Core, the community edition, and a subscription version. Both versions are based on the same core software, but the commercial version provides additional services and functions. More specifically:

• Patch management and vulnerability assessment to improve security management
• Extended support for Windows computers and older Linux distributions to ensure wider compatibility
• Dedicated support, including expert help and availability

Rudder not only simplifies configuration management but also helps you focus on compliance in the dashboard (Figure 1); for example, Rudder lets you know whether security-relevant patches have been rolled out across the entire network.

Getting Started

The Rudder server manages node configurations and is the heart of any Rudder environment. The server is home to the inventory, configuration rules, compliance databases, and logs. You can also use the Relay module explicitly to isolate network areas from each other, without the need for a second server.

The Rudder developers did not want to reinvent the wheel; instead, they relied on proven open source projects during development. The environment currently runs on all major Linux distributions, along with some experimental builds for Solaris, FreeBSD, Android, macOS, and a version for the Arm architecture.

If you want to evaluate Rudder without too much overhead, you can set up the Rudder repository on your system and use the package manager to install the Rudder server:

wget https://repository.rudder.io/tools/rudder-setup
chmod +x rudder-setup ./rudder-setup setup-server latest

Once the installation is complete, it's time to set up a user account. The easiest way to do this is to use the following command to create a local admin user:

rudder server create-user -u <username>

You have to enter the password twice before the account is created. Rudder is now basically ready for use, and you can open an initial connection to the server. Log in with the credentials you defined previously. In the web interface, go to Administration | Settings | General | Allowed Networks to check whether the networks listed there include all the network addresses of your nodes. By default, this list contains the networks connected to your server and completes the Rudder server setup.

The next step is to install the agents (e.g., on a Debian or Ubuntu system) and configure the interaction with the server:

apt-get install rudder-agent
rudder agent policy-server <IP address of the Rudder server>

A few minutes after starting the agent, it should register with the Rudder server and appear in the Nodes section of the web interface. On the agent side, you can also use the

rudder agent inventory

command to enforce a start and send the current status to the server. It is important to remember that each node or agent is self-sufficient. The nodes use FusionInventory technology [2] to send information to the server. They can then pick up the policies from the server and use Syslog to send their reports. The master then decides whether or not compliance has been achieved by reference to the actual and target values. Incidentally, the server has no access to the nodes.

After an agent has transmitted its data to the server, it initially joins the Pending Nodes list. Rudder distinguishes between accepted and pending nodes. The list of pending nodes shows a plethora of detailed information on the various systems. To accept a request to join monitoring, check the box in the last column. Clicking Accept adds the nodes to the Rudder environment. In the Directive column, click on the magnifying glass symbol to see which rules apply to the system in question.

You can click on a node entry to call up the details of a system. At this point, it becomes clear that Rudder also targets users who are not die-hard administrators, with a color-coded evaluation label that reveals the status of compliance, vulnerability, and update status. You can call up further details on these ratings on the associated tabs.

As part of node management, Rudder offers the option of grouping or categorizing nodes. Typical categories include the environment, the application, or the operating system. The matching functions can be found under Node Management | Groups in the left-hand menu. The great thing about this arrangement is that groups can be managed dynamically. If a new node appears in the environment that corresponds to one of the parent groups, the node is added automatically.

Rules-Based Configuration

Rudder uses a strategy that is based on Directives, Techniques, and Global properties to configure the nodes (Figure 2). The Techniques submenu offers a series of processes and settings to help you achieve a specific behavior on your nodes and is where you will find various predefined sets for a new installation (e.g., to configure Windows Firewall or Windows SSH). CPU vulnerabilities are also implemented in this form. In the System settings category, you can use various hardening packs to check whether AppArmor or SELinux is configured on the nodes. The editor also lets you create new configurations.

Under Patch management, Rudder lists the nodes for which patches and updates are available. Rudder determines them by comparing the local data with the information stored in the matching repository. By default, updates are automatically routed to the systems with apt update. You can define the details (e.g., the execution time, reboot behavior, etc.) as update campaigns.

Rules are an essential element in Rudder. They combine a group of computers with a group of policy specifications. The rules are therefore the link between the assets and configuration management. As a rule, you will want to link policies with nodes. A predefined set of policies is available; however, you can also create your own configurations.

Security management relies on the Rudder CVE plugin in the Rudder menu, which shows a summary of the vulnerabilities detected for each node (Figure 3). Again, color highlighting helps you to assess the severity.

Flexible Expansion

One of Rudder's special features is its modular architecture. Thanks to the plugin mechanism, additional features can be added to the basic system. You can discover the modules already installed under Plugins. In terms of installation, the core and commercial versions have differences.

If you take out a subscription (see the "Pricing" box), you can import extensions from Administration | Setup. In the Core version, you have to do this manually by downloading the desired extension and installing it with:

rudder package install-file<package.rpkg>

The Rudder repository [4] will tell you which plugins are available. Rudder also has extensive admin functions that let you manage the server, agents, users, and other system variables. On the Allowed networks page (Figure 4), you can first define which network clients are allowed to open a connection to the Rudder server. Use the Add a network function to add to the default settings with just a few mouse clicks.

The Reporting mode option lets you define the reporting settings. In default mode, the dashboard presents a plethora of information. You can significantly reduce this output by choosing Non compliant only mode, which means you only see notifications if the agent makes a change or errors occur on a node.

By default, the agents check the nodes every five minutes. This short interval allows a rapid response to changes in the evaluation status. For smaller and less busy environments, it might make sense to increase the interval significantly. Whenever you make changes to the node environment, a backup is made, which the agents save in /var/rudder/modified-files/. All modified files are retained for 30 days by default, but tvalue can be adjusted in Modified files backup.

Rudder naturally comes with integrated user management, which you can access with Administration | User management. In addition to the admin users, you can use Create to add additional users and delegate the various tasks.

Conclusions

Rudder offers impressive functionality and a wide range of applications. Administrators looking for a dashboard that gives them an easy-to-understand status report for their environment will appreciate working with Rudder. The tool also performs well when it comes to patch management. Rudder is not only useful as an audit tool but also simplifies the task of standardizing node configuration.