What are your best practices and future plans for deploying unixoid desktops?

Question

I have been setting up Linux desktops for a non-profit radio observatory. For me, this was the first time I had to think about "deploying" several identical machines, centralizing login, home directories and so on. It quickly became clear to me that, perhaps contrary to intuition, the "everything is textual" philosophy does not necessarily make that an easy task, and I wondered what seasoned admins do about this.

In my case, I was installing Ubuntu 10.04 LTS on each machine. After installation, I ran a custom script that alters config files, removes and installs software and copies some files, like background images or browser bookmarks, from the server. I think, however, that my questions are distro-independent.

Problems

I was mainly encountering two problems: Firstly, inconsistent tools and config files, both across distributions and across versions, and secondly some crucial software not exposing settings to config files in an easy and intuitive manner.

Let me give two short examples for what I mean:

The ifconfig tool is being replaced by ip. All scripts relying on the presence of the former will break if, for example, run on a current ArchLinux box. So, I would need to check which tools in which versions are present on a machine I run a script on... this somehow feels like reinventing autoconf on a small scale.

For the second problem, consider that I wanted to give the desktops some sort of "common identity". In my post-install-config-script, I use the following lines to achieve this:

scp user@server:/export/admin/*.jpg /usr/share/backgrounds/
scp user@server:/export/admin/ubuntu-wallpapers.xml /usr/share/gnome-background-properties/
sed 's/warty-final-ubuntu\.png/MyBackground\.jpg/' -i /usr/share/gconf/defaults/10_libgnome2-common
sed 's/warty\-final\-ubuntu\.png/MyBackground\.jpg/' -i /usr/share/gconf/defaults/16_ubuntu-wallpapers
sed 's/ubuntu-mono-dark/ubuntu-mono-light/' -i /usr/share/gconf/defaults/16_ubuntu-artwork
sed 's/Ambiance/Clearlooks/' -i /usr/share/gconf/defaults/16_ubuntu-artwork

I suppose that creating a CI is a common task for organizational admins. So, how come there is no central config facility, perhaps even cross-desktop? Having to set two (identical!) undocumented values in two distinct config files strikes me as odd.

Questions

In an organizational environment, how do you handle central, unified configuration across multiple clients?

Do systems like Debian's FAI offer significant advantages (aside from not having to change CDs) over my method of "install first, run script afterwards"?

What are good practices for the transition between major versions of your distribution? And, apart from the technical stuff: Is there a desktop environment that promises long-term stability as far as the user experience is concerned? I don't think I can migrate my users to KDE 4 or GNOME 3, but XFCE still has some functional drawbacks...

Is there a *nix system that adresses this type of configuration issues? For example, I'd assume there are systems that ask you for some imagery of your organization (logos, background images, colour and font sets etc) and apply them to the login manager, users' desktops, web apps (!) and so on. Note: In our case, I have to work with fat clients, so a purely thin-client solution won't help.

Answer 1

Using Puppet or CFEngine or Chef is the right solution for your problem. Of course it will consume some time and trial & error approach to write the Puppet script which just work. These tools are widely used for automating complex installations on cloud and have simplified the lives of admins like us. :)

Answer 2

First off, don't expect this is going to be easy working with multiple distributions.

I've not run large desktop rollouts. For me the best tradeoff was using a LAN boot/tftp to bootstrap the system then running the install over NFS. Most Linux distro's ask you for all the initial config up front - then you can leave the installer to run for, say 40 minutes, unattended (no "Do you really want run this program?" prompts). At that point I was looking after Redhat and Suse machines - and had an RPM prepped with all the custom configs which I installed after the standard installation completed. However its quite possible to automate all of this on a variety of distros.

I'm not a big fan of the Ubuntu distribution for various reasons but Canonical's Lanscape is a very impressive tool. And if you're going to be doing a lot of large scale Ubuntu installs/managing multiple Ubuntu desktops its definitely worth a closer look.

Answer 3

I've been working a lot with software called CFEngine. It's an open source configuration manager which reads "rules" that you set and insures that every machine it is tied in to and respects those rules. It's completely open source and so useful our company has decided to use the supported version of the software called Nova.

This is a broad view of how it works. Let's say you have 4 computers on your managed network. They all need to have a file /etc/syslog.conf, owned by root, all the same (according to a master) and chmod 777. You would create this rule in CFEngine's configuration file. From your central computer, you have the "master" /etc/syslog.conf file. Every X amount of time, your computer's version of CFEngine will go through the network and ask each box about it's /etc/syslog.conf file. The local copy of CFEngine running on each client will query the file in question and report back it's contents, permissions, etc. If they do not EXACTLY match your caster copy, CFEngine will push your copy to the client and check the files again. They will match and he will move on to your next rule.

As for simplicity, the syntax used in CFEngine's "rules" (which they call promises) may take a little getting used to, but they are well worth learning (adds another great skill to your skillset).

Answer 4

So, how come there is no central config facility,

Gnome has GConf which can perform all such minor tasks:

http://wiki.novell.com/index.php/Locking_Down_the_GNOME_Desktop

http://library.gnome.org/admin/system-admin-guide/stable/gconf-9.html.en

Ubuntu LTS is the almost the only option for long term support on the desktop.

Deploying multiple machines is almost possible with just a simple dd, the desktops distributions are slowly making this a less attractive route.

Also consider an option now is the so called fat client.