Rudder

Rudder is an open-source configuration management and continuous compliance platform for Linux-heavy infrastructure teams who want every server to stay in a known state and to see, at any moment, which rules are compliant and which are not. As “rudder configuration management” searches suggest, it competes with Ansible, Puppet, Chef and Salt, but its focus is different: a web interface, agents that check and fix configuration every few minutes, and compliance reporting per rule and per node.

Rudder is developed by the French company Normation (now operating as Rudder). The core is free and open source under GPL-3.0; paid enterprise plans add features such as the Windows agent, extended OS support, CVE assessment, change requests and LDAP/SSO login. The free core is enough to manage and audit a fleet of current Linux servers.

Rudder at a glance

What it does

• Applies configuration through Rules, which link Directives (configured settings) to Groups of nodes.
• Ships ready-made techniques for common tasks (packages, services, files, users, SSH, sudoers, cron, NTP) and a Technique Editor for building your own without writing code.
• Runs an agent on each node that checks and, if you want, enforces the desired state every few minutes, or only audits without changing anything.
• Shows compliance per rule, per directive and per node, with the exact check that failed.
• Collects a hardware and software inventory from every node and builds dynamic groups from it (for example “all Debian 12 web servers”).
• Offers a REST API and a command-line agent for automation and CI pipelines.
• In paid plans: CVE assessment, patch campaigns, security benchmarks, change requests with approval, multi-tenancy and external authentication.

How sysadmins use it

Enrol a Linux server

1. Add the Rudder repository on the node and install the agent: apt-get install rudder-agent
2. Point it at the server and send an inventory:

rudder agent policy-server 10.0.0.5
rudder agent inventory

3. A few minutes later the node appears as pending in the web interface. Review its inventory and accept it.

Enforce an SSH baseline

1. Create a group, for example all nodes whose OS is Linux, or a dynamic group based on hostname pattern.
2. Create a directive from the SSH server technique and set the options you require (no root login, no password authentication).
3. Create a rule linking the directive to the group. Start in audit mode to see who is non-compliant without changing anything.
4. Once the report looks right, switch the rule to enforce mode; the agents correct drift on their next run.

Run the agent on demand

rudder agent run        # update policies and apply them now
rudder agent run -l     # apply the current local policies without updating
rudder agent info       # show the policy server and node ID

Install and first run

Server. Use a dedicated 64-bit Linux host. On Debian or Ubuntu, import the repository key, add the Rudder 9.1 apt source and install the package:

wget --quiet -O /etc/apt/keyrings/rudder_apt_key.gpg 
  "https://repository.rudder.io/apt/rudder_apt_key.gpg"
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/rudder_apt_key.gpg] 
  http://repository.rudder.io/apt/9.1/ $(lsb_release -cs) main" 
  > /etc/apt/sources.list.d/rudder.list
apt-get update
apt-get install rudder-server
rudder server create-user -u admin

Then log in to the web interface over HTTPS with the user you created and check Settings > General > Allowed Networks so your nodes are allowed to connect.

Requirements. OpenJDK 17 or later and PostgreSQL 13 or later (installed as dependencies). Memory: 3 GB minimum under 50 nodes, 4 GB for 50 to 1,000 nodes; 2 to 4 CPU cores. The PostgreSQL database grows with the number of nodes, directives and the retention period, so watch /var/lib/pgsql (or your distribution’s equivalent), /var/rudder and /var/log/rudder.

Ports.

• TCP 443 to the server: web interface, API, and reports, inventories and file downloads from nodes.
• TCP 5309 from Linux nodes to the server for policy updates.
• TCP 5309 from the server to nodes is optional and only used to trigger agent runs remotely; firewall it on public interfaces or disable it.

Gotchas. Remote triggering requires the server to resolve node hostnames in DNS. Use the server’s IP address in rudder agent policy-server unless reverse DNS is reliable.

Limitations

• No macOS support, and the server runs only on Linux.
• Windows agents and agents for older Linux releases (for example Ubuntu 22.04, RHEL 8) are part of paid plans, not the free core.
• CVE scanning, patch campaigns, change requests and LDAP/SSO are paid features.
• It is agent-based by design; there is no agentless push mode like Ansible.
• Smaller community than Ansible or Puppet, so fewer third-party examples.
• Minor versions are maintained for a limited time after the next release; plan upgrades roughly twice a year.

Rudder vs alternatives

FAQ

Is Rudder open source?

Yes. The core is free and open source under GPL-3.0. Some enterprise features are only available in paid plans.

Is Rudder free?

The open-source core is free to use on supported Linux servers and agents. Windows agents, older OS support and features such as CVE assessment require a paid plan.

Rudder vs Ansible: what is the difference?

Ansible pushes changes over SSH when you run a playbook. Rudder agents check and fix configuration continuously and report compliance in a web interface, which suits audit and security work.

Does Rudder support Windows?

Yes, with a Windows agent for Windows Server 2016 to 2025 and Windows 10/11, but it is part of the paid plans. The Rudder server itself runs only on Linux.

How do I install the Rudder server?

Add the official Rudder repository for your Linux distribution, install the rudder-server package, create the first user with rudder server create-user, and log in over HTTPS.

Is Rudder the same as RudderStack?

No. RudderStack is an unrelated customer-data platform. Rudder from rudder.io is the infrastructure configuration and compliance tool described here.

What is the latest version of Rudder?

The latest stable release is 9.1.4 from August 2026. Version 9.2 is in beta.

Last checked against official sources: 1 October 2026 (developer website: rudder.io). Versions and licence terms change — confirm on the developer's site before deploying in production.