CFEngine Reference Manual Auto generated, self-healing knowledge CFEngine Core 3.5.0a1.cd6175a CFEngine Enterprise 3.1.0a1.3879733 cfengine.com Under no circumstances shall CFEngine AS be liable for errors or omissions in this document. All efforts ¨ have been made to ensure the correctness of the information contained herein. Copyright c 2008,2010 to the year of issue CFEngine AS © i Table of Contents 1 CFEngine 3.5.0a1.cd6175a { Getting started::::::::::::::::::: 1 1.1 Software components ::::::::::::::::::::::::::::::::::::::::::::::::: 1 1.1.1 cf-agent ::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 1 1.1.2 cf-execd ::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.3 cf-know* :::::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.4 cf-monitord :::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.5 cf-promises :::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.6 cf-runagent :::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.7 cf-serverd:::::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.8 cf-report::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.9 cf-key ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 2 1.1.10 cf-hub:::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 3 1.2 Core concepts::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 3 1.3 A renewed CFEngine :::::::::::::::::::::::::::::::::::::::::::::::::: 3 1.4 Installation:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 4 1.5 Syntax, identifiers and names :::::::::::::::::::::::::::::::::::::::::: 5 1.6 The work directory :::::::::::::::::::::::::::::::::::::::::::::::::::: 5 1.7 Decisions ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 6 1.7.1 CFEngine hard classes:::::::::::::::::::::::::::::::::::::::::::: 6 1.7.2 Class combination operators and precedence :::::::::::::::::::::: 7 1.7.3 Global and local classes :::::::::::::::::::::::::::::::::::::::::: 7 1.8 Filenames and paths::::::::::::::::::::::::::::::::::::::::::::::::::: 9 1.9 Upgrading from CFEngine 2 ::::::::::::::::::::::::::::::::::::::::::: 9 1.10 Testing as a non-privilieged user ::::::::::::::::::::::::::::::::::::: 10 1.11 The `bare necessities' of a CFEngine 3::::::::::::::::::::::::::::::: 11 1.12 Familiarizing yourself :::::::::::::::::::::::::::::::::::::::::::::::: 11 1.13 Remote access troubleshooting :::::::::::::::::::::::::::::::::::::: 14 1.13.1 Server connection ::::::::::::::::::::::::::::::::::::::::::::: 14 1.13.2 Key exchange ::::::::::::::::::::::::::::::::::::::::::::::::: 15 1.13.3 Time windows (races) ::::::::::::::::::::::::::::::::::::::::: 16 1.13.4 Other users than root:::::::::::::::::::::::::::::::::::::::::: 17 1.13.5 Encryption :::::::::::::::::::::::::::::::::::::::::::::::::::: 17 2 A simple crash course in concepts :::::::::::::::::::::::::::: 19 2.1 Rules are promises ::::::::::::::::::::::::::::::::::::::::::::::::::: 19 2.2 Best practice for writing promises ::::::::::::::::::::::::::::::::::::: 20 2.3 Containers ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 21 2.4 When and where are promises made? ::::::::::::::::::::::::::::::::: 22 2.5 Types in CFEngine 3 ::::::::::::::::::::::::::::::::::::::::::::::::: 23 2.6 Datatypes in CFEngine 3 ::::::::::::::::::::::::::::::::::::::::::::: 24 2.7 Variable expansion in CFEngine 3 ::::::::::::::::::::::::::::::::::::: 24 2.7.1 Scalar variable expansion :::::::::::::::::::::::::::::::::::::::: 24 2.7.2 List variable substitution and expansion :::::::::::::::::::::::::: 24 ii CFEngine reference manual 2.7.3 Special list value cf_null ::::::::::::::::::::::::::::::::::::::: 27 2.7.4 Arrays in CFEngine 3 ::::::::::::::::::::::::::::::::::::::::::: 27 2.8 Name spaces :::::::::::::::::::::::::::::::::::::::::::::::::::::::: 28 2.9 Normal ordering:::::::::::::::::::::::::::::::::::::::::::::::::::::: 29 2.9.1 Agent normal ordering :::::::::::::::::::::::::::::::::::::::::: 29 2.9.2 Server normal ordering :::::::::::::::::::::::::::::::::::::::::: 30 2.9.3 Monitor normal ordering :::::::::::::::::::::::::::::::::::::::: 31 2.9.4 Knowledge normal ordering:::::::::::::::::::::::::::::::::::::: 31 2.10 Loops and lists in CFEngine 3 ::::::::::::::::::::::::::::::::::::::: 31 2.11 Pattern matching and referencing:::::::::::::::::::::::::::::::::::: 33 2.11.1 Runaway change warning::::::::::::::::::::::::::::::::::::::: 36 2.11.2 Commenting lines ::::::::::::::::::::::::::::::::::::::::::::: 36 2.11.3 Regular expressions in paths:::::::::::::::::::::::::::::::::::: 37 2.11.4 Anchored vs. unanchored regular expressions :::::::::::::::::::: 39 2.11.5 Special topics on Regular Expressions ::::::::::::::::::::::::::: 39 2.12 Distributed discovery:::::::::::::::::::::::::::::::::::::::::::::::: 40 3 How to run CFEngine 3 examples :::::::::::::::::::::::::::: 43 4 A complete configuration :::::::::::::::::::::::::::::::::::: 45 4.1 `promises.cf'::::::::::::::::::::::::::::::::::::::::::::::::::::::: 45 4.2 `site.cf' ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 47 4.3 `update.cf' ::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 53 4.4 `failsafe.cf'::::::::::::::::::::::::::::::::::::::::::::::::::::::: 55 4.5 What should a failsafe and update file contain? :::::::::::::::::::::::: 56 4.6 Recovery from errors in the configuration ::::::::::::::::::::::::::::: 56 4.7 Recovery from errors in the software :::::::::::::::::::::::::::::::::: 58 5 Control promises :::::::::::::::::::::::::::::::::::::::::::: 61 5.1 common control promises ::::::::::::::::::::::::::::::::::::::::::::: 61 5.1.1 bundlesequence ::::::::::::::::::::::::::::::::::::::::::::::: 61 5.1.2 goal_patterns :::::::::::::::::::::::::::::::::::::::::::::::: 63 5.1.3 ignore_missing_bundles :::::::::::::::::::::::::::::::::::::: 63 5.1.4 ignore_missing_inputs ::::::::::::::::::::::::::::::::::::::: 64 5.1.5 inputs::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 64 5.1.6 version ::::::::::::::::::::::::::::::::::::::::::::::::::::::: 65 5.1.7 lastseenexpireafter ::::::::::::::::::::::::::::::::::::::::: 65 5.1.8 output_prefix :::::::::::::::::::::::::::::::::::::::::::::::: 66 5.1.9 domain::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 66 5.1.10 require_comments:::::::::::::::::::::::::::::::::::::::::::: 67 5.1.11 host_licenses_paid ::::::::::::::::::::::::::::::::::::::::: 67 5.1.12 site_classes :::::::::::::::::::::::::::::::::::::::::::::::: 68 5.1.13 syslog_host:::::::::::::::::::::::::::::::::::::::::::::::::: 68 5.1.14 syslog_port:::::::::::::::::::::::::::::::::::::::::::::::::: 69 5.1.15 fips_mode :::::::::::::::::::::::::::::::::::::::::::::::::::: 69 5.2 agent control promises::::::::::::::::::::::::::::::::::::::::::::::: 70 5.2.1 abortclasses:::::::::::::::::::::::::::::::::::::::::::::::::: 70 iii 5.2.2 abortbundleclasses :::::::::::::::::::::::::::::::::::::::::: 71 5.2.3 addclasses :::::::::::::::::::::::::::::::::::::::::::::::::::: 72 5.2.4 agentaccess ::::::::::::::::::::::::::::::::::::::::::::::::::: 73 5.2.5 agentfacility :::::::::::::::::::::::::::::::::::::::::::::::: 73 5.2.6 allclassesreport ::::::::::::::::::::::::::::::::::::::::::::: 74 5.2.7 alwaysvalidate ::::::::::::::::::::::::::::::::::::::::::::::: 74 5.2.8 auditing :::::::::::::::::::::::::::::::::::::::::::::::::::::: 75 5.2.9 binarypaddingchar:::::::::::::::::::::::::::::::::::::::::::: 76 5.2.10 bindtointerface ::::::::::::::::::::::::::::::::::::::::::::: 76 5.2.11 hashupdates:::::::::::::::::::::::::::::::::::::::::::::::::: 77 5.2.12 childlibpath :::::::::::::::::::::::::::::::::::::::::::::::: 77 5.2.13 checksum_alert_time :::::::::::::::::::::::::::::::::::::::: 78 5.2.14 defaultcopytype ::::::::::::::::::::::::::::::::::::::::::::: 78 5.2.15 dryrun ::::::::::::::::::::::::::::::::::::::::::::::::::::::: 79 5.2.16 editbinaryfilesize ::::::::::::::::::::::::::::::::::::::::: 79 5.2.17 editfilesize :::::::::::::::::::::::::::::::::::::::::::::::: 80 5.2.18 environment:::::::::::::::::::::::::::::::::::::::::::::::::: 80 5.2.19 exclamation:::::::::::::::::::::::::::::::::::::::::::::::::: 81 5.2.20 expireafter:::::::::::::::::::::::::::::::::::::::::::::::::: 82 5.2.21 files_single_copy :::::::::::::::::::::::::::::::::::::::::: 82 5.2.22 files_auto_define :::::::::::::::::::::::::::::::::::::::::: 82 5.2.23 hostnamekeys :::::::::::::::::::::::::::::::::::::::::::::::: 83 5.2.24 ifelapsed :::::::::::::::::::::::::::::::::::::::::::::::::::: 84 5.2.25 inform ::::::::::::::::::::::::::::::::::::::::::::::::::::::: 84 5.2.26 intermittency ::::::::::::::::::::::::::::::::::::::::::::::: 85 5.2.27 max_children :::::::::::::::::::::::::::::::::::::::::::::::: 85 5.2.28 maxconnections :::::::::::::::::::::::::::::::::::::::::::::: 86 5.2.29 mountfilesystems:::::::::::::::::::::::::::::::::::::::::::: 87 5.2.30 nonalphanumfiles:::::::::::::::::::::::::::::::::::::::::::: 87 5.2.31 repchar :::::::::::::::::::::::::::::::::::::::::::::::::::::: 88 5.2.32 refresh_processes :::::::::::::::::::::::::::::::::::::::::: 88 5.2.33 default_repository ::::::::::::::::::::::::::::::::::::::::: 89 5.2.34 secureinput:::::::::::::::::::::::::::::::::::::::::::::::::: 89 5.2.35 sensiblecount ::::::::::::::::::::::::::::::::::::::::::::::: 90 5.2.36 sensiblesize :::::::::::::::::::::::::::::::::::::::::::::::: 90 5.2.37 skipidentify :::::::::::::::::::::::::::::::::::::::::::::::: 91 5.2.38 suspiciousnames ::::::::::::::::::::::::::::::::::::::::::::: 91 5.2.39 syslog ::::::::::::::::::::::::::::::::::::::::::::::::::::::: 92 5.2.40