Rudder: automate system security and configuration with GUI, API and YAML

Rudder is an open source solution for managing system security and configuration, with a strong focus on continuous checks and compliance.

🎥 https://www.youtube.com/watch?v=u5kQYFqShrk
🧑 Nicolas Charles
📅 Config Management Camp 2026

With its GUI, it makes it easier for users to define security configurations and get feedback. Its API allows integration with most softwares that interact with your infrastructure.
This talk will present Rudder and its use cases, then focus on the new version, Rudder 9.0, and conclude with a demo of configuring and hardening new instances on AWS

Transcript

1. Automate system security and configuration with GUI, API and YAML
2. © 2025 Rudder. All right reserved. Rudder is a system infrastructure automation platform to ensure and improve security posture. Designed for ops to secure in-depth with proofs, it allows to implement and maintain your security model. 2 Security Configuration Management Audit and remediation of your hardening Patch & Vulnerability Management Proactive vulnerability remediation Policy & Benchmark Compliance Deployment and proof of compliance
3. All rights reserved Product license Rudder has an open-core model GPLv3 - https://github.com/Normation/rudder • Most of it is free and open source (web interface, linux agent, binaries, API) with packages available for main distros • Some plugins, and older OS support are open source, without binaries freely available (won’t be in this presentation) • Some plugins are closed sources (won’t be in this presentation)
4. All rights reserved How it works? In Rudder, we manage Nodes: A Node is a system with a rudder agent installed and registered to the Rudder server (it needs an operating system) Nodes are classified within Groups (dynamic queries on inventories)
5. All rights reserved How it works? We define the desired states, in Audit or Enforce mode State definition is a lot like a playbook: • Don’t include targets • use agent native methods to inspect/modify the system
6. All rights reserved How it works? We apply these states to the Groups using Rules (there can be as many groups and rules as necessary) The Agent compares these states with the actual status of the Nodes, optionally fixes, and reports the results. Rudder computes the compliance based on these results
7. All rights reserved How it works?
8. All rights reserved Why a GUI? Goal: onboard everyone and make it “easy” to share knowledge and information It’s not expected that everyone will become an expert of Rudder, infrastructure management, and compliance but can at least: • Have a look in the tool and understand what is going on • Check what’s being done • Collaborate with others based on their expertise knowledge • Onboard new members
9. All rights reserved GUI Everything can be done within the GUI • Nodes management/Inventory/Grouping • Defining Techniques/Directives/Rules • Checking compliance • Rudder User management There are access rules • Access in read/write/nothing to pages
10. All rights reserved API Everything can be done with the REST API • Avoid unnecessary clicks • Automate Rudder • Export/Import data from/to Rudder Acces rules apply also on the API
11. All rights reserved YAML We are at the YAMLConf, right ? • Techniques are written in YAML (and/or the graphical editor) • In Git • Compiled by the Rudder server to be understood by the agent We developed the YAML syntax while writing CIS benchmarks - to ensure that the language is powerful enough to express everything
12. Demo! A Rudder server in the cloud, with some hardening configurations. A new instance is created and is automatically configured. An API call to define some properties for this instance A website appears!
13. All rights reserved Product Roadmap We release minor versions every 6 months, and major ~ 2 years Rudder 9.0 was released in October 2025: • Focus on compliance (augeas module (in the next talk)) • Share data more easily (CSV export) • HTTPS protocol for client/server communication (used in SecNumCloud environment) • Better templating engine & command execution
14. All rights reserved Product Roadmap Rudder 9.1 is scheduled for April 2026 • Improved traceability on all actions • Improved dashboard • Support for SLES 16
15. All rights reserved Product Roadmap A Technique Marketplace is on its way! • Expect it for early of Q2 2026
16. All rights reserved Want to test it? We have a repo with packages for most distros on https://repository.rudder.io • Getting started: https://docs.rudder.io/get-started/current/home.html • Community chat: chat.rudder.io
17. Thank you! Any questions?