Version Control for Important System Files?

TokyoCrusaders92 asks: "Like a lot of other organizations (800 staff, 5000 students) we have a mix of Windows, Novell & Linux (primarily Linux) for our IT infrastructure. We now have a multitude of config files, firewall rule bases, shell scripts, and so forth which are managed by multiple people and groups. Recently, we started using RCS for version control of the firewall rule-base, but this doesn't seem like it would scale up to larger groups of users. While thinking about this, it would seem that the critical features would include: version control; logging; multiple users; secure authentication; and integrity checking. What are other people using to manage their config files?"

Comments

Notepad

[Timesprout]

What more could you possibly need?

Re:Notepad

[smallfries]

GP uses a humorous post. Technical criticism is not applicable and is thus useless.

A CVS server

[kotj.mf]

How similar are your systems? I help manage several thousand distributed boxes that are reasonably identical, and we keep everything in a central CVS server: management scripts, config files, crontabs, what have you. There's no reason it couldn't be used for more heterogeneous systems, other than having to be more careful with file naming conventions.

puppet... maybe (not yet at least)

[getha]

Using something like subversion or any other version control system for such a task just leads to Yet Another Homebrew Administration System, that will probably lead your successors to tears and insanity. Use tools already there, and that are pertinent to the job.

version control; logging; multiple users; secure authentication; and integrity checking. All those features you need are mostly already there in puppet: http://puppet.reductivelabs.com/ (and maybe also in cfengine, but that's a nightmare). And the development on puppet is really picking up steam at the moment.

Problem for your situation is that it has no Windows or Novell support as of yet, but recently work on Windows at least seems to have started. And if your first priority is mainly config file management: that part should be fairly trivial.

Our system is great

[Heir Of The Mess]

We have a login script that calls another script that is the one that gets modified. To use different script you just change the name of the called script to the one you want. If the script gets changed then the person who changed it changes the name and we can tell how old it is by the date stamp on the file. So far we have these (oldest to newest):

sublogin.bat
sublogn2.bat
sblg2fix.bat
latestlg.bat
newlatst.bat
finalfix.bat
reverted.bat
fixwrked.bat
NtOnMyPC.bat
WksOnMyn.bat
NTONMYPC.bat
TryThis1.bat

Seriously though, subversion is good because it lets you do atomic checkins.

Those who don't know VMS...

[MrBoombasticfantasti]

Those who don't know VMS are wont to re-invent it... ;-)

See Files-11 for a flashback.

Re:Subversion

[Cyberax]

Subversion is the ideal solution - because it needs a lot of junk in .svn directories :( And it can mess with some scripts that do recursive grep or something similar.

SVK is better, but it is not as widely supported as SVN.

rsnapshot

[perlionex]

I use rsnapshot to do version control of my entire system. From the description:

rsnapshot is a filesystem snapshot utility for making backups of local and remote systems.

Using rsync and hard links, it is possible to keep multiple, full backups instantly available. The disk space required is just a little more than the space of one full backup, plus incrementals.

Personally, I configure rsnapshot to generate snapshots every 4 hours, and then daily, weekly, and monthly.

In your case, since you only want versioning for your configuration files, you can point rsnapshot at just the configuration directories (probably just /etc).

Re:rsnapshot

[hattmoward]

Those are snapshots, not versions. It is possible for a particular revision of a file to roll off your monthly rotation and be forgotten forever.

rcs

[pe1chl]

On systems where it matters, I keep config files etc in RCS.
In each directory where config files live that I want to keep, I create an RCS directory and rcs -i the file(s).
Nightly, I job runs that finds all files for which an RCS entry exists and that are newer than that entry, and a copy is checked in.

No need to think about checking in/out all the time, no problem that the RCS seems to believe that you don't want to keep the actual file around.
It does not save every edit but at least I have a copy of each day's state of the file.

svn trick

[bluegreenone]

I use subversion (and tortoisesvn as the client) to version my windows system files, in general it works well. There is a trick though. To get a directory under svn control you normally have to import that directory and then rename it so you can checkout an svn'ed copy under the same name. This can be a problem for certain system directories. In this case what you do is :

1. create the dir in the repository but leave it empty
2. checkout that url on the existing dir, since url is empty nothing is overwritten
3. now do an svn add then commit to get everything into the repository

This leaves you with a versioned dir without need for renaming or deletion

...
PATH train schedule online

cfengine

[eviltypeguy]

One word: cfengine

http://www.cfengine.org/