Although cfengine is certainly good for these purposes, it also is widely considered the best open-source tool available for configuration management.
Using cfengine, sysadmins with a large installation of, say, 800 machines, can have information about their environment quickly that otherwise would take months to gather, as well as the ability to change the environment in an instant.
Because cfengine is a framework, the system administrator must write the necessary commands in cfengine configuration files in order to move and manipulate data.
A common method for running the cfagent is to execute it from cron using the cfexecd in non-dæmon mode.
The primary reason for using both is to engage cfengine's logging system.
As an example, let's take a look at the files command as it would appear in the file: This would set all machines' /etc/passwd and /etc/shadow files to the permissions listed in the file (644 and 600).
It also would change the owner of the file to root and fix all of these settings if they are found to be different, each time cfengine runs.
In this article, I focus on a make-it-so-and-keep-it-so approach.