Rudder

Rudder is an open-source configuration management and security automation platform for Linux and Windows fleets, made by Paris-based Normation.

Rudder keeps servers and workstations in the security state an IT team has defined, then checks and corrects them continuously. It is developed by Normation SAS, an independent company in Paris, and its core engine is open source. Teams describe the end state they want, and an agent on each machine audits it or enforces it. The result is a fleet whose hardening, patch level and compliance can be shown at any moment, on-premises or in the cloud. Security configuration management is the base solution. Its Configuration builder writes configurations in a graphical editor or in YAML, and Hierarchical data management sets exceptions per node or group. Drift management detects anomalies and repairs them through self-healing. Patch and vulnerability management adds System updates, CVE assessment, Patch campaigns and Micropatching for targeted packages. Policy and benchmark compliance brings Pre-defined benchmarks such as CIS Benchmarks, custom security policies and OpenSCAP audits whose results appear in the interface. Live dashboards and the Rudder score summarise all three, while Activity logs and Full configuration versioning record every change. Rudder suits system administrators, security teams and DevSecOps engineers who look after Linux and Windows fleets and answer to auditors. It fits organisations whose hardening rules come from internal policy or an industry benchmark, where drift has to be caught without manual checks. Change requests let a peer review a configuration before it reaches production. Multi-tenant access limits a team or a customer to its own systems. Buyers start with the open-source Rudder Core or move to Rudder Enterprise or Rudder Corporate Security Suite, which add vendor support and the premium solutions. Patch nights, hardening audits and compliance reports are the recurring jobs it takes over. Staff sign in with their company directory through Active Directory, LDAP or SSO, and secrets stay in a HashiCorp Vault server that configurations reference. The Complete inventory runs nightly and can be synchronised with a CMDB, and the API lets engineers feed Rudder from their CI/CD stack or build their own reports. Agents keep auditing and enforcing while cut off from the server, and Relay servers connect remote networks. That suits estates spread across segmented sites, where every machine still has to prove its configuration to an auditor.