You can also download the packages directly from the website.<\/li>\n<\/ul>\nIf you choose to use any of these options to install CFEngine Community or Enterprise, you can either proceed to Step 2 and start CFEngine after installing, or go directly to Step 3 and create your first policy after bootstrapping.<\/p>\n
Including the public key of CFEngine<\/h3>\n
In order to install CFEngine through apt, apt must have access to the repository. The initial action is to include the CFEngine public GPG key in the apt key collection, ensuring that apt can trust the packages obtained from the repository.<\/p>\n
Obtain the key by using this command.<\/p>\n
<\/code><\/pre>\n\n- wget<\/span> https:\/\/cfengine.com\/pub\/gpg.key -O<\/span> ~\/cfengine-gpg.key<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nAfter that, utilize apt-key to include it.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> apt-key add<\/span> ~\/cfengine-gpg.key<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nIncluding the Package Repositories offered by CFEngine<\/h3>\n
Afterwards, you have to include the CFEngine repository as an apt source by executing the subsequent command:<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> sh<\/span> -c<\/span> “echo ‘deb https:\/\/cfengine-package-repos.s3.amazonaws.com\/pub\/apt\/packages stable main’ > \/etc\/apt\/sources.list.d\/cfengine-community.list”<\/span><\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nThis instruction appends the CFEngine repository to a file located in the directory for apt sources list.<\/p>\n
If the sh argument and -c option are not included, executing this command would result in a Permission denied error since sudo does not handle the output redirection. To overcome this problem, you can employ sh to run a shell with sudo and pass the command using the -c option.<\/p>\n
Go ahead and use the update command which will allow apt to recognize the fresh packages available in the CFEngine repository.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> apt<\/span> update<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nInstalling the Package using apt<\/h3>\n
Now that the CFEngine package has been added to the apt registry, you have the option of installing CFEngine using apt.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> apt<\/span> install<\/span> cfengine-community<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nYou may disregard any warnings regarding the package being developed on an older operating system. It is still functional.<\/p>\n
Confirming the Installation<\/h3>\n
After the installation is finished, you can find the CFEngine components in \/var\/cfengine\/bin. Among them, the agent (cf-agent) is the primary one with which you will mainly interact. This executable assesses the policy you create, modifies the system accordingly, and keeps a record of its actions. By default, the agent will activate every five minutes, retrieve any updated policy if needed, and apply it.<\/p>\n
Make use of the given command to ensure that the agent has been installed successfully.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cf-agent –version<\/span><\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nThe screen will display the printed version number.<\/p>\n
<\/code><\/pre>\nOutput<\/div>\n
<\/code><\/pre>\nCFEngine Core 3.21.0<\/p>\n
<\/code><\/pre>\n\n
Note<\/p>\n
Please note that the current version is 3.21.0 as of now. Your version number might be different.<\/div>\n<\/div>\n
If you are unable to run the cf-agent command, make sure to verify if \/var\/cfengine\/bin\/ is included in your PATH variable and if cf-agent exists in that specific directory. Additionally, you can examine the installation log file located at \/var\/log\/CFEngine-Install.log to get some insights into any potential issues that occurred during the installation process.<\/p>\n
Step 2 involves commencing CFEngine.<\/h2>\n
To initiate CFEngine, you must bootstrap the agent by executing the provided command.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cf-agent –bootstrap<\/span> 127.0<\/span>.0.1<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nThe specified instruction instructs the agent to initiate the CFEngine elements and obtain the policy from this particular device with the IP address 127.0.0.1.<\/p>\n
In the coming days, you may need multiple machines to retrieve policy from a shared server. At that time, you will replace the IP address 127.0.0.1 with the actual IP address of the server. However, for now, while you are getting started with CFEngine and learning, you will use just one machine and the IP address 127.0.0.1 as described in this tutorial.<\/p>\n
After successfully setting up CFEngine on your server, it’s time to begin creating your policy.<\/p>\n
Step 3 involves the creation of your initial policy.<\/h2>\n
To automate a task in system administration with CFEngine, you’ll need to generate a policy file. This file is specifically written in CFEngine’s own Domain Specific Language (DSL). If you want to understand the capabilities and structure of this policy language, refer to the CFEngine reference documentation.<\/p>\n
Policy files are different from scripts because they work in a declarative manner. By describing the desired state for the system, CFEngine will evaluate if it is already fulfilled and will only make alterations if required. Instances of what you might want to express in policy include:<\/p>\n
\n- Ensure the user sammy exists.<\/li>\n
- Keep the curl package updated (and installed).<\/li>\n
- Ensure telnet is not installed.<\/li>\n
- Render a script file from a template and some data.<\/li>\n
- Stop a process, like httpd, if it\u2019s running.<\/li>\n
- Enforce strict permissions on the \/usr\/bin folder.<\/li>\n<\/ul>\n
For each of these instances, you need to create a policy and save it in the appropriate location on your server (\/var\/cfengine\/masterfiles). Afterward, CFEngine will execute the policy.<\/p>\n
\n- Automate distribution of the policy file by transferring it to your other bootstrapped hosts.<\/li>\n
- Enforce your requirements regularly (running the policy every five minutes by default). For example, if someone deleted the user sammy, or changed the permissions on \/usr\/bin, these changes would be restored automatically within five minutes.<\/li>\n
- Only make changes, such as writing to a file, if it\u2019s necessary (that is, if the state is not already as desired).<\/li>\n
- Handle many platform differences for you (for example, the commands used to install packages, create users, and other operations vary depending on the operating system).<\/li>\n<\/ul>\n
In this stage, you will generate a policy called “Hello World” that will display the text “Hello!” on the terminal.<\/p>\n
Create a new file named “hello_world.cf” in your home directory using either nano or your preferred text editor.<\/p>\n
<\/code><\/pre>\n\n- nano<\/span> ~\/hello_world.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nTo the document, include the subsequent information.<\/p>\n
“hello_world.cf” file in the home directory.<\/div>\n
bundle agent main\r\n{\r\n reports:\r\n \"Hello!\";\r\n}\r\n<\/code><\/pre>\nCFEngine policy is not evaluated from top to bottom; rather, it is declarative in nature.<\/p>\n
In CFEngine policy language, a promise refers to each statement made about the managed aspect. Organized into bundles, promises offer the flexibility to selectively run different parts of the policy and determine their order of execution.<\/p>\n
In this policy, “reports” is a type of commitment that is in charge of displaying the message on the terminal. When “agent” is mentioned after “bundle,” it indicates that this bundle is intended for the cf-agent component. The bundle is named “main.” The bundle sequence determines the order in which bundles are assessed. By default, it already includes the main bundle, so there is no need to make any modifications.<\/p>\n
To save and exit the file, employ nano and press CTRL+X to exit. Then, press Y to save and ENTER to confirm the filename, ultimately closing the file.<\/p>\n
Because CFEngine usually operates as the root user, it aims to prevent unauthorized system alterations by enforcing strict permissions on policy files. Allowing other users to modify the policies that CFEngine uses would grant them the ability to make privileged changes to the system. To prevent this, you can utilize chmod to modify the file permissions and ensure that only specific users are able to edit this file.<\/p>\n
<\/code><\/pre>\n\n- chmod<\/span> 600<\/span> hello_world.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nTo execute the policy, employ the subsequent command.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cf-agent ~\/hello_world.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nThe CFEngine agent locates your bundle by recognizing its main name. Subsequently, the agent examines the promises within the bundle and assesses them. During the evaluation of promises, the agent verifies if any system modifications are required. In this scenario, there was only one promise, and the agent concluded that it should display a message on the terminal to fulfill it.<\/p>\n
You will get the output as stated below.<\/p>\n
<\/code><\/pre>\nOutput<\/div>\n
<\/code><\/pre>\nR: Hello!<\/p>\n
<\/code><\/pre>\nCFEngine has a default setting where it maintains a record of actions performed and avoids reassessing promises that were evaluated recently (within the past minute). If you attempt to execute the policy again, no output will be displayed. To deactivate this locking mechanism, you can utilize the –no-lock command line option.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cf-agent –no-lock hello_world.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nAfter successfully creating and implementing your initial policy, it appears that it only facilitates console output without modifying the system itself. However, the upcoming phase will involve making those necessary changes.<\/p>\n
Step 4 involves creating a policy to effectively handle the content within a text file.<\/h2>\n
In the previous phase, you developed a policy which involved displaying a message on the terminal. Nonetheless, if we consider a more practical scenario, it would be to guarantee the existence of a file with certain content on every host within your infrastructure. In this stage, you will generate a policy that generates a text file (\/tmp\/my_file.txt) containing the words Hello, CFEngine!.<\/p>\n
Please create a new policy file at the location ~\/file_management.cf.<\/p>\n
<\/code><\/pre>\n\n- nano<\/span> ~\/file_management.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nInclude the provided information.<\/p>\n
The cf file for managing files in the specified directory.<\/div>\n
bundle agent manage_my_file\r\n{\r\n files:\r\n \"\/tmp\/my_file.txt\"\r\n content => \"Hello, CFEngine!$(const.n)\";\r\n}\r\n<\/code><\/pre>\nInstead of naming the bundle as “main”, it should be called “manage_my_file”. It is advisable to assign distinct and meaningful names to each bundle as you continue to write policies. Remember, there can only be a single main bundle.<\/p>\n
Since this policy deals with files, it has a promise type of files. For file promises, the attribute content specifies the expected content of the file. The final section of the string, $(const.n), expands the special variable const.n, resulting in the addition of a new line at the file’s end.<\/p>\n
Please save and exit the file.<\/p>\n
Just like before, establish the policy file’s stringent permissions.<\/p>\n
<\/code><\/pre>\n\n- chmod<\/span> 600<\/span> file_management.cf<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nPlease execute the file while including some extra command line options.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cf-agent –no-lock –info<\/span> ~\/file_management.cf –bundle<\/span> manage_my_file<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nIn order to manage my file, it is essential to specify the bundle using –bundle manage_my_file as there is no longer a primary bundle.<\/p>\n
When using the –info option, CFEngine will provide informational notifications regarding the modifications it is implementing on the system.<\/p>\n
The changes will be described in the output of this command.<\/p>\n
<\/code><\/pre>\nOutput<\/div>\n
<\/code><\/pre>\ninfo: Using command line specified bundlesequence info: Created file ‘\/tmp\/my_file.txt’, mode 0600 info: Updated file ‘\/tmp\/my_file.txt’ with content ‘Hello, CFEngine!<\/p>\n
<\/code><\/pre>\nCFEngine successfully generated my_file.txt in the \/tmp folder, containing the message Hello, CFEngine!.<\/p>\n
If you execute the same command once more, you will no longer see any notifications regarding the file creation or update. CFEngine understands that the file’s contents are already accurate and doesn’t make any alterations.<\/p>\n
\n
Note<\/p>\n
Note: When creating and testing policy files, it is common to use –no-lock and –info together. To simplify the process, shortcuts are available, such as -KI, which is the same as using –no-lock –info.<\/div>\n<\/div>\n
After creating a functional system policy, you may wish to run it independently without needing your oversight. This will be carried out in the upcoming phase.<\/p>\n
Step 5 involves the automation of policy runs.<\/h2>\n
Using CFEngine’s automation features can save you from the hassle of manually executing policy via the command line constantly.<\/p>\n
You can achieve automation of policy runs by placing your policy files in the designated location and making updates to a JSON file. This JSON file will regularly instruct the CFEngine component to perform tasks in the background, eliminating the need for you to manually run commands from the command line.<\/p>\n
To copy the policy file you made in the previous step, use the given command and move it to the suggested destination.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> cp<\/span> file_management.cf \/var\/cfengine\/masterfiles\/services\/<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nIt is advised to store your custom policy files in the services\/ subdirectory within \/var\/cfengine\/masterfiles\/ in order to keep them distinct from the default CFEngine policy, which includes policy not authored by you.<\/p>\n
When the CFEngine agents retrieve new policy files, they duplicate them from this directory on the hub. Even if you are only operating on one machine, the agent operates similarly: it will search for files in \/var\/cfengine\/masterfiles and duplicate them to \/var\/cfengine\/inputs. For beginners, it is advisable to utilize these paths. Modifying the paths or placing policy files in different locations would necessitate additional effort to guarantee that permissions, copying, and file location are all handled accurately.<\/p>\n
Afterwards, generate a JSON file that augments the policy file’s location and specifies the bundle to be executed.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> nano<\/span> \/var\/cfengine\/masterfiles\/def.json<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nInclude the provided information in that document.<\/p>\n
The file def.json is located in the directory \/var\/cfengine\/masterfiles.<\/div>\n
{<\/span>\r\n \"inputs\"<\/span>:<\/span> [<\/span> \"services\/file_management.cf\"<\/span> ]<\/span>,<\/span>\r\n \"vars\"<\/span>:<\/span> {<\/span>\r\n \"control_common_bundlesequence_end\"<\/span>:<\/span> [<\/span> \"manage_my_file\"<\/span> ]<\/span>\r\n }<\/span>\r\n}<\/span>\r\n<\/code><\/pre>\nTo ensure your policy runs regularly (every five minutes), you need to ensure that the agent locates and reads the file and runs your bundle.<\/p>\n
The def.json file’s inputs key informs the agent about which policy files to access. In this scenario, the agent will access the policy file named file_management.cf that you generated in the previous step.<\/p>\n
The vars option allows for variable definition. By incorporating the control_common_bundlesequence_end variable in the default policy, any bundle names added there will be assessed after all the default bundles in the bundlesequence. Hence, cf-agent can choose the policy files to read and the bundles within them to evaluate automatically, eliminating the need to specify these details via the command line.<\/p>\n
Once you are making changes to the policy within \/var\/cfengine\/masterfiles\/, automation will handle the remaining tasks. In particular, cf-agent will regularly check for the updated policy files that you have written. The agent will read and assess the policy, ensuring all the commitments are enforced and making necessary modifications to the machines, like editing files and creating users.<\/p>\n
According to the policy outlined in this tutorial, whenever the agent is executed, it will confirm the existence of \/tmp\/my_file.txt, along with the specific content mentioned in the policy file.<\/p>\n
Please save the file and then close it.<\/p>\n
To verify the functionality of automation, remove the text file that was generated during the initial execution of the file management policy.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> rm<\/span> \/tmp\/my_file.txt<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\nYou will be able to verify if CFEngine has successfully regenerated my_file.txt in the background after a five-minute duration.<\/p>\n
<\/code><\/pre>\n\n- cat<\/span> \/tmp\/my_file.txt<\/li>\n<\/ol>\n
<\/code><\/pre>\n <\/p>\n
<\/code><\/pre>\n<\/code><\/pre>\nOutput<\/div>\n
<\/code><\/pre>\nHello, CFEngine.<\/p>\n
<\/code><\/pre>\nInstead, you can also choose to expedite the process of creating the file.<\/p>\n
<\/code><\/pre>\n\n- sudo<\/span> rm<\/span> \/tmp\/my_file.txt