This is a comparison of notable free and open-source configuration management software, suitable for tasks like server configuration, orchestration and infrastructure as code typically performed by a system administrator.

Basic properties "Verify mode" (also called dry run) refers to having an ability to determine whether a node is conformant with a guarantee of not modifying it, and typically involves the exclusive use of an internal language supporting read-only mode for all potentially system-modifying operations. Mutual authentication (mutual auth) refers to the client verifying the server and vice versa.

Agent describes whether additional software daemons are required. Depending on the management software these agents are usually deployed on the target system or on one or many central controller servers. Although Agent-less = No is colored red and might seem to be a negative, instead, having an agent can be considered quite advantageous to many. Consider the impact if an agent-less tool loses connectivity to a node while making critical changes—leaving the node in an indeterminate state that compromises its (production?) function.

Language License Mutual auth. Encryption Verify mode Agent-less GUI First release Latest stable release Ansible Python GPLv3+ 2012-03-08 2026-06-18 2.18.18 Bcfg2 Python BSD 2-clause 2004-08-112015-06-11 1.3.6 Capistrano Ruby MIT 20052022-08-07 3.17.1 cdist Python GPLv3+ 20102021-08-24 6.9.8 Chef Ruby, Erlang Apache 2.0 2009-01-15 0.5.02026-07-13 18.11.11 (client), 15.10.114 (server) CFEngine C GPLv3 TLS: Uses TLS. 19932026-07-10 3.28.0, 2026-05-08 3.27.1, 2026-05-08 3.24.4 Consfigurator Common Lisp (SBCL) GPLv3+ 2024-07-26 1.4.2 Guix Scheme (Guile) GPLv3+ It requires the guix daemon on the target Guix system. 2022-12-19 1.4.0 ISconf Python GPL Improved security which would include an encrypted, mutually authenticated, peer-to-peer message bus is tracked here 19982006-08-13 4.2.8.233 Juju Python, Go AGPL 2010-09-172025-06-09 3.6.7 Local ConFiGuration system (LCFG) Perl GPL LCFG does not provide its own transport mechanism; it relies on an external program, most often Apache. Using Apache it should be possible to do mutual authentication in several ways; however the documentation at The Complete Guide to LCFG, Section 9.4: Authorization and Security, shows access control based on IP address ranges, implying that the client does not authenticate itself to the server via an SSL certificate; it also does not mention if the LCFG client checks the validity of the server's SSL certificate (such as via a per-site fingerprint distributed with the client, or a chain of trust to an accredited CA). It mentions that there can be a per-client password in the profile, but also states that "The contents of the LCFG profile should be considered public". LCFG supports encrypted communications channels (SSL via Apache); however the documentation at The Complete Guide to LCFG, Section 9.4: Authorization and Security, states that "The contents of the LCFG profile should be considered public". 1994Weekly Releases NOC Project Python BSD 2.0 2012-03-08 2015-05-20 15.05.1 OCS Inventory NG with GLPI Perl, PHP, C++ GPL Server authenticates to client, but client does not authenticate to server. See OCS Inventory NG Installation and Administration guide, page 114. 20032026-04-23 Open pc server integration (Opsi) Python, Java GPL 20042013-03-01 4.0.3 PIKT C GPLv2+ PIKT uses shared secret keys for mutual authentication. "As an option, you can use secret key authentication to prove the master's identity to the slave. [...] If one managed to crack any system in the PIKT domain, one would have access to all common secrets. To solve this problem, you may use per-slave uid, gid, and private_key settings." - from Security Considerations. "For file installs, file fetches (to diff against the central configuration), and command executions, you can optionally encrypt all such data traffic between master and slave." - from Security Considerations. 19982007-09-10 1.19.0 Puppet Ruby, C++ & Clojure (server-side also Ruby before 4.0) Apache since 2.7.0, GPL before then 2005-08-302026-06 8.20.0 (client), 2024-04 8.9.9 (server) Pyinfra Python MIT License 2016-08-10 0.1 2025-01-30 3.2 Quattor Perl, Python Apache 2.0 "Client to server authentication and vice versa: on one hand, this allows to enforce access policies to sensitive data according to the client "name", on the other hand, clients are guaranteed to talk to the original server." - from Quattor Installation and User Guide: Version 1.1.x , page 70 "[...] secure information transfer, since data are encrypted: this prevents eavesdroppers from obtaining information in transit over the network." - from Quattor Installation and User Guide: Version 1.1.x , page 70 2005-04-012026-04-07 26.2.0 Radmind C BSD "SSL certificates can also be used to authenticate both the Radmind server and the managed clients, regardless of DNS or IP-address variation." - from Radmind: The Integration of Filesystem Integrity Checking with Filesystem Management "For network security, Radmind supports SSL-encrypted links. This allows nodes on insecure networks to be updated securely." - from Radmind: The Integration of Filesystem Integrity Checking with Filesystem Management 2002-03-262008-10-08 1.13.0 Rex Perl Apache 2010-11-05 0.9.0 2025-07-05 1.16.1 Rudder C, Scala, Rust GPLv3, Apache 2.0 2011-10-31 2026-07-09 9.1.3 SmartFrog Java Apache 2.0 See Using the new SmartFrog Security 2004-02-112012-03-13 3.18.016 SaltSalt is an open source tool to manage your infrastructure. Easy enough to get running in minutes and fast enough to manage tens of thousands of servers Python Apache 2.0 Both 2011-03-17 0.6.02026-07-01 v3008.-2 Spacewalk Java (C, Perl, Python, PL/SQL) GPLv2 2008-06 2019-01-14 2.9 STAF C++ CPL There is a feature request for a Secure TCP/IP Connection Provider, and one of the developers stated on 2007-04-05 that "You will need to download the source code for OpenSSL and point the build files at it. Other than that, it should just work.", so it looks like there may be working encryption if you build from scratch instead of using the prebuilt binaries. It is unclear what if any authentication building against OpenSSL would give STAF. 1998-02-162012-12-16 3.4.16 SynctoolSynctool aims to be easy to understand and use. It is built in Python and uses SSH and Rsync. Python GPLv2 20032019-08-11 6.3 Uyuni Java, Python, PL/SQL (Perl) GPLv2, Apache 2.0 Both 2018-06 2024-01-31-01 2024.01 Language License Mutual auth Encrypts Verify mode Agent-less Have a GUI First release Latest stable release

Platform support Note: This means platforms on which a recent version of the tool has actually been used successfully, not platforms where it should theoretically work since it is written in good portable C/C++ or an interpreted language. It should also be listed as a supported platform on the project's web site.

AIX *BSD HP-UX Linux OS X Solaris Windows Others Ansible Can manage any machine with Python 2.4 or later and sshd. Control machine can be any non-Windows machine with Python 2.6 or 2.7 installed. This includes Red Hat, Debian, CentOS, OS X, any of the BSDs, and so on. Bcfg2 CFEngine (enterprise version only) cdist Chef Consfigurator Guix ISconf Juju Local ConFiGuration system (LCFG) OCS Inventory NG Open pc server integration (Opsi) PIKT Puppet Pyinfra Quattor Radmind Rex Rudder SmartFrog Salt Salt was added to the OpenCSW package repository in September of 2012 in version 0.10.2 of Salt Spacewalk STAF 10.2+ (?) Synctool Uyuni AIX *BSD HP-UX Linux OS X Solaris Windows Others

Short descriptions Not all tools have the same goal and the same feature set. To help distinguish between all of these software packages, here is a short description of each one.

Ansible Combines multi-node deployment, ad-hoc task execution, and configuration management in one package. Manages nodes over SSH and requires python (2.6+ or 3.5+) to be installed on them. Modules work over JSON and standard output and can be written in any language. Uses YAML to express reusable descriptions of systems.

Bcfg2 Software to manage the configuration of a large number of computers using a central configuration model and the client–server paradigm. The system enables reconciliation between clients' state and the central configuration specification. Detailed reports provide a way to identify unmanaged configuration on hosts. Generators enable code or template-based generation of configuration files from a central data repository.

CFEngine Lightweight agent system. Manages configuration of a large number of computers using the client–server paradigm or stand-alone. Any client state which is different from the policy description is reverted to the desired state. Configuration state is specified via a declarative language. CFEngine's paradigm is convergent "computer immunology".

cdist cdist is a zero dependency configuration management system: It requires only ssh on the target host, which is usually enabled on all Unix-like machines. Only the administration host needs to have Python 3.2 installed.

Chef Chef is a configuration management tool written in Erlang, and uses a pure Ruby DSL for writing configuration "recipes". These recipes contain resources that should be put into the declared state. Chef can be used as a client–server tool, or used in "solo" mode.

Consfigurator While Debian and derivatives are the best supported distributions, Consfigurator also work on other distributions and various unixes but they have less support for properties for configuring specific aspects of the system. Consfigurator can set properties to be applied in scheme. This requires Consfigurator to be installed on the target computer. A more restricted language is also available which works without needing Consfigurator to be installed on the target. Remote configuration is also supported: the hosts can be defined with scheme code.

Guix Guix integrates many things in the same tool (a distribution, package manager, configuration management tool, container environment, etc). To remotely manage systems, it needs the target machines to already run Guix or it can also alternatively deploy configurations inside Digital Ocean Droplet. The machines are configured with Scheme.

ISconf Tool to execute commands and replicate files on all nodes. The nodes do not need to be up; the commands will be executed when they boot. The system has no central server so commands can be launched from any node and they will replicate to all nodes.

Juju Juju concentrates on the notion of service, abstracting the notion of machine or server, and defines relations between those services that are automatically updated when two linked services observe a notable modification.

Local Configuration system (LCFG) LCFG manages the configuration with a central description language in XML, specifying resources, aspects and profiles. Configuration is deployed using the client–server paradigm. Appropriate scripts on clients (called components) transcribe the resources into configuration files and restart services as needed.

Open PC server integration (Opsi) Opsi is desktop management software for Windows clients based on Linux servers. It provides automatic software deployment (distribution), unattended installation of OS, patch management, hard- and software inventory, license management and software asset management, and administrative tasks for the configuration management.

PIKT PIKT is foremost a monitoring system that also does configuration management. "PIKT consists of a sophisticated, feature-rich file preprocessor; an innovative scripting language with unique labor-saving features; a flexible, centrally directed process scheduler; a customizing file installer; a collection of powerful command-line extensions; and other useful tools."

Puppet