CFEngine: Server Configuration Automation Tool (Setup Guide) - 헤이든의 전산실 (Hayden's Server Room)

Managing a growing fleet of servers? Repeating the same configurations manually leads to errors and wastes time. There’s a tool that’s been solving this problem since 1993: CFEngine(Server Configuration Automation Tool).

While younger tools like Ansible and Puppet get more attention, CFEngine continues to power critical infrastructure at thousands of companies worldwide. Let’s explore why this veteran automation tool still matters.

CFEngine

Table of Contents

1. What is CFEngine? The Original Lightweight Automation Tool

CFEngine is a configuration management system created by Mark Burgess in 1993 at the University of Oslo. Mark Burgess is considered the godfather of configuration management, and CFEngine pioneered this field.

CFEngine is open-source software under the GNU GPL license, implementing Infrastructure as Code (IaC) principles. Think of it as writing code that declares “our servers should be in this state,” and CFEngine maintains that state automatically.

It runs on Linux, Unix, Windows, AIX, Solaris, and more—managing everything from servers to desktops, embedded devices, and IoT systems.

2. Why CFEngine? Clear Differences from Other Tools

In today’s DevOps landscape with Ansible, Puppet, and Chef everywhere, what makes CFEngine different?

Exceptionally Lightweight Agent

Written in C, CFEngine uses just a few MB of memory with minimal CPU overhead. Its execution speed is the fastest among configuration management tools.

Compared to Ruby-based Puppet or Chef consuming tens of MB, CFEngine runs smoothly even in resource-constrained environments.

Promise Theory: A Philosophical Foundation

CFEngine’s core concept is Promise Theory. Proposed by Mark Burgess in 2004, this theory models systems where autonomous components make and keep promises to each other.

The difference from traditional command-and-control:

Traditional Approach (Command):

# Tell the server what to do right now
Server, run apt-get install apache2!

CFEngine Approach (Promise):

# Server promises to maintain this state
packages:
  "apache2"
    policy => "present",
    comment => "Apache web server shall be installed";

Promise Theory takes a bottom-up approach. Instead of central control, each component autonomously fulfills its responsibilities.

Pull-Based Autonomous Architecture

CFEngine uses an agent-based pull model. Here’s what that means:

Push (Ansible): Admin pushes commands to servers from a control node
Pull (CFEngine): Each server autonomously fetches policy from the hub and applies it

Hosts fetch policies and data files from the hub, then send reporting data back. This architecture provides immunity to external attacks and prevents distributed policy inconsistencies.

3. Getting Started: Installation to First Run

Let’s get hands-on. Installation is simpler than you might think.

Understanding the Architecture

A CFEngine environment consists of a CFEngine Hub (Policy Server) and multiple Hosts (Clients).

Hub: Central server storing and distributing policies
Host: Servers that fetch and execute policies from the hub

All CFEngine files live in /var/cfengine. Key components:

Program	Full Name	Purpose
cf-agent	Agent	Executes policies
cf-execd	Execution Daemon	Periodically runs cf-agent
cf-serverd	Server Daemon	Distributes policies and files
cf-monitord	Monitor Daemon	Monitors system statistics

Installation by OS

Ubuntu / Debian

First, add the CFEngine package repository.

# Add GPG key
wget -O- https://cfengine.com/pub/gpg.key | sudo apt-key add -

# Add repository
sudo add-apt-repository "deb https://cfengine.com/pub/apt/packages stable main"

# Update and install
sudo apt-get update
sudo apt-get install cfengine-community

After installation, CFEngine components appear in /var/cfengine/bin.

RedHat / CentOS / Rocky Linux

# For 64-bit RPM distributions (recommended)
sudo rpm -i cfengine-community-3.26.0-1.el6.x86_64.rpm

Quick Install Script

For hosts with internet access, use the quick install script.

wget -O- http://cfengine.package-repos.s3.amazonaws.com/quickinstall/quick-install-cfengine-community.sh | sudo bash

Verify Installation

# Check CFEngine agent version
/var/cfengine/bin/cf-agent --version

# Example output:
# CFEngine Core 3.26.0

If cf-agent doesn’t work, verify /var/cfengine/bin/ is in your PATH and the cf-agent binary exists.

Bootstrapping: Starting CFEngine

After installation, bootstrap the agent. Bootstrapping tells the agent which policy server to fetch policies from.

# For single-server testing (bootstrap to itself)
sudo /var/cfengine/bin/cf-agent --bootstrap 127.0.0.1

# Or to a separate policy server
sudo /var/cfengine/bin/cf-agent --bootstrap 192.168.1.12

Successful bootstrapping shows: “Bootstrap to ‘192.168.1.12’ completed successfully!”

Note: You might see “Policy is not found in /var/cfengine/inputs” initially—this is resolved during bootstrapping.

Verify It’s Running

# Check CFEngine processes
ps aux | grep cf-

# You should see these processes running:
# cf-execd (execution daemon)
# cf-serverd (server daemon)
# cf-monitord (monitor daemon)

4. Writing Your First Policy: Hands-On Examples

Let’s write actual working policies. We’ll start with a simple file creation example.

Understanding Promise Structure

In CFEngine, everything is expressed as promises. Basic structure:

bundle agent bundle_name
{
  promise_type:
    context::
      "promiser"
        attribute1 => "value",
        attribute2 => body,
        comment => "Description of what this promise does";
}

bundle agent: Defines a bundle for the agent to execute
promise_type: Type of promise (files, packages, commands, etc.)
promiser: Subject of the promise (file path, package name, etc.)
attribute: Promise details

Example 1: Creating a Simple File

Create /var/cfengine/masterfiles/services/my_first_policy.cf:

bundle agent my_first_policy
{
  files:
    "/tmp/cfengine_test_file"
      create => "true",
      perms => m("644"),
      owner => "root",
      comment => "Creates a CFEngine test file";
}

This policy promises:

/tmp/cfengine_test_file will exist
File permissions will be 644
File owner will be root

Example 2: Managing Web Server Directories

A more practical example:

bundle agent webserver_setup
{
  files:
    linux::
      "/var/www/html"
        create => "true",
        perms => mog("755", "www-data", "www-data"),
        comment => "Create web server root with proper permissions";
        
      "/var/www/html/index.html"
        create => "true",
        edit_line => insert_lines("Hello from CFEngine!"),
        perms => m("644"),
        comment => "Create default index file";
        
  packages:
    debian::
      "apache2"
        policy => "present",
        comment => "Install Apache web server package";
}

Applying the Policy

After writing your policy, include it in the main policy.

Edit /var/cfengine/masterfiles/def.json:

{
  "inputs": [
    "services/my_first_policy.cf"
  ]
}

Validate policy syntax:

sudo /var/cfengine/bin/cf-promises -f /var/cfengine/masterfiles/promises.cf

# No output means no errors

Execute policy immediately:

# -K: Ignore locks
# -I: Inform (verbose output)
sudo /var/cfengine/bin/cf-agent -KI

# Example output:
# info: Created file '/tmp/cfengine_test_file', mode 0644

Verify results:

ls -la /tmp/cfengine_test_file
# Output: -rw-r--r-- 1 root root 0 Oct 15 10:30 /tmp/cfengine_test_file

By default, the cf-execd daemon runs cf-agent every 5 minutes, so policies apply automatically and continuously.

5. 2025 Latest Features: CFEngine’s Evolution

CFEngine continues evolving. Here are the key features in recent versions.

Enhanced Security (CFEngine 3.26.0)

Released in May 2025, CFEngine 3.26.0 eliminates the default admin user, requiring administrators to create their own credentials during initial setup.

Installation outputs a setup code that must be entered to create the initial admin account. If you miss it:

cf-hub --new-setup-code

Recent versions add 2FA (Two-Factor Authentication), audit logs, and strict password policies.

New Policy Functions

CFEngine 3.26.0 includes 6 new policy functions based on user feedback, making policy writing easier.

cfbs analyze: Policy Analysis Tool

The cfbs analyze command analyzes your current policy set, showing which version you’re running and what files have been modified.

cfbs analyze

# Example output:
# Policy set path: .
# Reference version: 3.21.5
# Files missing from the version:
# └── controls/cf_monitord.cf
# Files from the version but with modifications:
# └── promises.cf
# Files not from any version (with both custom content and path):
# └── services/my_policy.cf

This makes version upgrades and policy migration much easier.

cf-remote: Remote Management Tool

cf-remote simplifies installing CFEngine on remote hosts and provides easy SSH access.

# Install with cf-remote
cf-remote --version 3.26.0 install --hub hub --bootstrap hub

# SSH to saved hosts
cf-remote connect -H hub

Mission Portal: Web-Based Management UI

CFEngine Enterprise’s Mission Portal provides a web UI for inventory management, event log viewing, and graphical report generation.

Access Mission Portal by browsing to https://[hub-ip-address].

Release Cycle and Support

CFEngine releases new versions every 6 months, with LTS (Long Term Support) releases every 18 months. LTS versions are supported for 3 years.

Version	Release Date	Type	Support Ends
3.26.0	May 2025	Non-LTS	Nov 2025
3.24	Summer 2024	LTS	Summer 2027
3.21	–	LTS	2026

6. Comparing Tools: Choosing What’s Right for You

The biggest question when adopting tools: “Which one should I use?” Let’s compare in detail.

Comprehensive Comparison

Feature	CFEngine	Ansible	Puppet	Chef
First Released	1993	2012	2005	2009
Written In	C	Python	Ruby	Ruby
Memory Usage	Very Low (few MB)	Low	High	High
Architecture	Agent-based Pull	Agentless Push	Agent-based Pull	Agent-based Pull
Config Language	CFEngine DSL	YAML	Puppet DSL	Ruby DSL
Learning Curve	Steep	Gentle	Moderate	Steep
Execution Speed	Very Fast	Slow	Moderate	Moderate
Scalability	Excellent (tens of thousands)	Limited (hundreds)	Good (thousands)	Good (thousands)
Security Track Record	Excellent	Good	Good	Fair
Community Size	Small	Very Large	Large	Medium
Enterprise Users	Facebook, LinkedIn, IBM	RedHat enterprises	Traditional enterprises	Some startups

Choose CFEngine When

CFEngine’s lightweight C agent delivers exceptional speed and scalability, with distributed architecture easily managing thousands of nodes.

1. Large-Scale Infrastructure

Managing thousands+ servers
Minimizing memory and CPU resources
Why Facebook, LinkedIn, Amazon, and JP Morgan chose it

2. Resource-Constrained Environments

IoT devices or embedded systems
Older hardware
Limited network bandwidth

3. Security-Critical Environments

Excellent security track record
Finance, healthcare, military sectors
Immunity to external attacks built into design

4. Self-Healing Systems

Promise Theory-based autonomous systems
Independent node operation during central failures
Continuous state convergence needed

Choose Ansible When

Ansible is agentless with simple YAML syntax, offering a gentle learning curve.

1. Quick Start Needed

No agent installation required
Works with SSH alone

2. Team Skill Level

DevOps beginners
Python-familiar teams
Organizations preferring simplicity

3. Small to Medium Infrastructure

Dozens to hundreds of servers
Simple configurations

4. Frequent Ad-Hoc Tasks

Push-based immediate execution
Ad-hoc command execution

What is ‘Ansible’? Open-Source IT Automation Tool for DevOps

Choose Puppet When

Puppet provides a mature platform with robust reporting, suitable for enterprise environments requiring strict compliance.

1. Enterprise Features Needed

Strong reporting and auditing
Detailed role-based access control (RBAC)

2. Traditional IT Environments

Slow-changing organizations
Long-term stability priority

Puppet: Server Configuration and Deployment Automation Tool (Setup)

Progress Chef: Infrastructure Automation & Configuration Management Platform

7. Real-World Use Cases: Solving Actual Problems

Beyond theory, let’s see how it’s actually used.

Case 1: Large-Scale Security Patching Automation

Major enterprises use CFEngine to manage thousands of servers.

Scenario: Apply urgent security patches to 3,000 servers

CFEngine Policy Example:

bundle agent security_patch
{
  packages:
    debian::
      "openssl"
        policy => "present",
        version => "3.0.14-1",
        action => immediate;
        
  services:
    "apache2"
      service_policy => "restart",
      if => "openssl_updated";
}

Result: Each server autonomously checks and applies patches. Load distributed, automatic retries on failures.

Case 2: Automated Compliance Checking

CFEngine’s Security module enables automated scanning to identify and remediate security issues.

Scenario: Enforce PCI-DSS compliance settings

bundle agent pci_compliance
{
  files:
    "/etc/ssh/sshd_config"
      edit_line => set_config_values("sshd_secure"),
      classes => if_repaired("sshd_restarted");
      
    "/etc/passwd"
      perms => mog("644", "root", "root");
      
  commands:
    sshd_restarted::
      "/usr/sbin/service ssh restart";
}

Case 3: Multi-Cloud Environment Management

CFEngine supports diverse operating systems, enabling unified policy management across multiple clouds.

AWS EC2: Amazon Linux, Ubuntu
Azure: Windows Server, RedHat
GCP: Debian, CentOS
On-premises: AIX, Solaris

All managed from a single CFEngine Hub.

8. Start Free: Test Without Cost Concerns

CFEngine Enterprise is free for up to 25 hosts with no credit card required.

Community vs Enterprise Comparison

Feature	Community (Free)	Enterprise (Free up to 25)
Core Automation	✅	✅
Policy Language	✅	✅
Web UI (Mission Portal)	❌	✅
Advanced Reporting/Analytics	❌	✅
REST API	❌	✅
2FA Authentication	❌	✅
Audit Logs	❌	✅
Technical Support	Community	Paid Option

Starting Enterprise Free Trial

Visit: https://cfengine.com/download/
Click “Try Enterprise for Free”
Register email (no credit card)
Receive download link
Install and use freely up to 25 hosts

9. Learning Resources and Community: Getting Help

Resources for when you get stuck learning CFEngine.

Official Documentation

Main Docs: https://docs.cfengine.com
Installation Guide: https://docs.cfengine.com/docs/master/getting-started-installation.html
Policy Language Reference: https://docs.cfengine.com/latest/reference-language-concepts-promises.html
Release Notes: https://cfengine.com/tags/releases/

Community and Support

GitHub Discussions (Questions and discussions)

URL: https://github.com/cfengine/core/discussions
Feature suggestions, questions, discussions

Matrix Chat (Real-time communication)

Channel: CFEngine:matrix.org
Live interaction with other users

GitHub Repositories (Source code)

Core: https://github.com/cfengine/core
Masterfiles: https://github.com/cfengine/masterfiles
Bug reports, pull requests

CFEngine Build (Module sharing)

URL: https://build.cfengine.com
Community-created modules and policies

Diving Deeper into Promise Theory

Interested in Promise Theory?

Book: “Thinking in Promises” by Mark Burgess
Website: http://markburgess.org/promises.html
Wikipedia: https://en.wikipedia.org/wiki/Promise_theory

Conclusion: Is CFEngine Worth Starting?

Honestly, CFEngine isn’t as easy to learn as Ansible. Promise Theory is unfamiliar at first, and the community is smaller than Ansible or Puppet.

But I’d recommend it if you:

Run large-scale infrastructure – Managing thousands of servers? CFEngine’s lightweight agent and excellent scalability are major advantages. There’s a reason Facebook, LinkedIn, and Amazon chose it.

Need security-first environments – In finance, healthcare, or military sectors where security is paramount, CFEngine’s 30+ years of proven stability and excellent security track record inspire confidence.

Think long-term system design – Beyond simple automation, if you want truly autonomous self-healing systems, learning Promise Theory is worthwhile.

I recommend starting with the free Enterprise version to build a ~25-host test environment. Begin with small projects, gradually learning CFEngine’s philosophy. You’ll gain a new perspective on understanding distributed systems.

Post Views: 15