2

We are standing up a replicant data center at work and need to ensure that the new data center is configured (nearly) identically to the original. The new data center will be differently addressed and named than the original and will have differing user accounts, but all the COTS, patches, and configurations should be the same.

We would normally ghost the original servers and install those images onto the new machines, however, we have a few problematic pieces of COTS that require we install them outside of an image due to how they capture the setup of the network during their installation and maintain it within their configuration information (in some cases storing it in various databases). We have tried multiple times and this piece of COTS cannot be captured within a ghost image unless the destination machine will have an identical network setup (all the same IPs, hostnames, user accounts, etc across the entire network) as the original. In truth, it is the setup of these special COTS that I want to audit the most because they are difficult to install and configure in the first place.

In light of the fact that we can’t simply ghost, I’m trying to find a reasonable manner to audit the new data center and check to see if it is setup like the original (some sort of system wide configuration audit or integrity check). I’m considering using something like Tripwire for Servers to capture the configuration on the source machines and then run an audit on the destination machines. I understand that it will still show some differences due to the minor config changes, but I’m hoping that it will eliminate the majority of the work.

Here are some of the constraints I’m working under:

  • Data center is comprised of multiple Windows and Linux machines of differing versions (about 20 total)
  • I absolutely cannot ghost or snap any other type of image of these machines … at least not in their final configuration
  • I want to audit the final configuration to ensure all of the COTS, patches, configurations, etc are installed and setup properly (as compared to the original data center)
  • I would rather not install any additional tools on these machines … I’d much rather run it from a standalone machine or off a DVD
  • Price of tools is important but not an impossible burden, however, getting a solution soon is important (I can’t take the time to roll my own tools to do this)
  • For the COTS that stores the network information, I don’t know all of the places it stores the network information … so it would be unlikely I could find a way in the near future to adjust its setup after the installation has occurred

Anyone have any thoughts or alternate approaches?

Can anyone recommend tools that would be usable for system wide configuration audits?

3
  • 2
    belongs on Server Fault Jan 30, 2010 at 17:16
  • 2
    In an industry overflowing with acronyms you've used one I've not come across before. What is "COTS"? Jan 30, 2010 at 18:29
  • @John you beat me to it, it had me scratching my head too. I think it means Commercial Off The Shelf [Software] ie shrink-wrapped\commercial third party software packages.
    – Helvick
    Jan 30, 2010 at 18:48

4 Answers 4

2

Perhaps you need something like Cfengine

1

how about virtualization, just replicate the virtual disks.

0

Yes .. sorry COTS is "Commercial Off the Shelf". What I'm really poking at with this reference is I don't have the ability to make changes under the covers of this software to make my life easier (for instance altering the installation and setup of that one unique piece of software that makes ghosting difficult).

3
  • Thanks for the clarification, which you might like to add as an edit to the question. You also need to let us know what operating system(s) you're dealing with because there is no real "one size fits all" solution to this problem, despite claims to the contrary by some commercial software producers. Jan 30, 2010 at 21:22
  • Also if you are looking at configuration management solutions that will allow you to audit software packages it would be useful to know what they are.
    – Helvick
    Jan 30, 2010 at 21:25
  • The machines are a combination of Windows (2003, 2008, XP - 32 and 64 bit varieties) and Linux (Redhat).
    – none
    Jan 31, 2010 at 0:39
0

Provided you are/can find someone handy with scripting, on debian machines you can use cruft to classify normal package files and extra, unwanted files. The list of extra files, and the files themselves, can then be diffed between the two machines.

You must log in to answer this question.