Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
1–10 of 75 posts
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#2We've started using Salt for configuration management and it's everything we'd hoped for. It took some time to get our state tree figured out but now it works like a charm.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#3So far I have only used salt at home in a lab environment, however it is promising. I especially love that I can dictate my directory structure for configuration by my own standards.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#4I've kicked salt's tyres recently and really like it. I think me favourite aspects are being able to use jinja and the fact that everything is all in the same place for the definitions. (As opposed to spread around various json/ruby files in chef for example.)
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#5I highly recommend Salt stack. It's a great piece of software: straightforward and gets the job done. After using Puppet, Chef and cfengine, I'm glad there's salt :)
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#6Salt starts off with negative marks because they decided to type the letters A-E-S in their codebase: https://github.com/saltstack/salt/blob/develop/salt/crypt.py...
Specifically, they appear to be doing AES-CBC with HMAC-SHA256. There's nothing obviously wrong with it (randomized IVs from os.urandom, both authentication and encryption and with distinct keys...) but I would hope the standard for cryptography is higher than "nothing obviously wrong with it". Specifically, I would hope that the standard for cryptography is somewhere along the lines of using a peer-reviewed cryptosystem that has stood the test of time such as TLS, OpenPGP or even NaCl (given the name, particularly the latter would be pretty good). I'm not saying TLS doesn't have flaws; I'm saying appropriately configured TLS is better than rolling your own crypto.
I'm not entirely sure why they did that, but my best guess is that ZeroMQ pretty much doesn't support TLS.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#7Salt starts off with negative marks because they decided to type the letters A-E-S in their codebase: https://github.com/saltstack/salt/blob/develop/salt/crypt.py... Specifically, they appear to be doing AES-CBC with HMAC-SHA256. There's nothing obviously wrong with it (randomized IVs from os.urandom, both authentication and encryption and with distinct keys...) but I would hope the standard for cryptography is highe…
> I'm not entirely sure why they did that, but my best guess is that ZeroMQ pretty much doesn't support TLS.
Yup, ZeroMQ doesn't support TLS.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#8I'm currently a reasonably happy puppet user, but I do like the look of Salt. Puppet's configuration DSL always struck me as a little over-wrought (and slightly too inconsistent to remember easily). I would have preferred YAML/XML/ini files.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#9Salt starts off with negative marks because they decided to type the letters A-E-S in their codebase: https://github.com/saltstack/salt/blob/develop/salt/crypt.py... Specifically, they appear to be doing AES-CBC with HMAC-SHA256. There's nothing obviously wrong with it (randomized IVs from os.urandom, both authentication and encryption and with distinct keys...) but I would hope the standard for cryptography is highe…
> I'm not entirely sure why they did that, but my best guess is that ZeroMQ pretty much doesn't support TLS. Yup, ZeroMQ doesn't support TLS.
You know it's weird, I've been noodling with ZeroMQ for about a year now and I just never connected those mental dots myself. Bugger.
Re: Getting started with Salt: a Puppet/Chef alternative built in Python on ZeroMQ
#10Just when I narrowed my options down to ansible and chef…
This seems to be more in line with chef/puppet, with a dedicated daemon on the client.