Rundeck is a server application you host on a system you designate a central administrative control point. Internally, Rundeck stores job definitions and execution history in a relational database. Output from command and job executions is saved on disk but can be forwarded to remote stores like S3 or Logstash.
Rundeck distributed command execution is performed using a pluggable node execution layer that defaults to SSH but plugins allow you to use other means like MCollective, Salt, WinRM, or your custom method. Rundeck server configuration includes settings to define the outbound user allowed by the remote hosts. Remote machines are not required to make connections back to the server.
The Rundeck application itself is a Java-based webapp. The application provides both graphical interface and network interfaces used by the Rundeck shell tools.
Access to the Rundeck application requires a login and password. The default Rundeck installation uses a flat file user directory containing a set of default logins. Logins are defined in terms of a username and password as well as one or more user groups. An alternative configuration to the flat file user directory, is LDAP (e.g., ActiveDirectory) but Rundeck authentication and authorization is customizable via JAAS. Users must also be authorized to perform actions like define a job or execute one. This is controlled by an access control facility that reads policy files defined by the Rundeck administrator. Privilege is granted if a user's group membership meets the requirements of the policy.
Two installation methods are supported:
System package: RPM and Debian packaging is intended for managed installation and provides robust tools that integrate with your environment, man pages, shell tool set in your path, init.d startup and shutdown.
Launcher: The launcher is intended for quick setup, to get you running right away. Perfect for bootstrapping a project or trying a new feature.
Rundeck can also install as a WAR file into an external container like Tomcat.
Assuming the system requirements are met, Rundeck can be installed either from source, system package or via the launcher.
The following operating systems are known to support Rundeck:
Root (or Administrator on Windows) is not required or recommended. We recommend using a dedicated user account such as "rundeck".
If there is need for root access, please set up the Rundeck user to have access via sudo.
Rundeck is a Java-Servlet based server and therefore requires the Java runtime.
The install process requires that the latest version of Java 1.7 be installed. Both the Open JDK and Sun/Oracle JVMs can be used. You must have the JAVA_HOME environment variable defined in your environment before running the launcher. The RPM will use the java found on your path. See Setting JAVA_HOME if you want to run a different version of java.
Verify your Java version to check it meets the requirement:
$ java -version
java version "1.7.0_55" OpenJDK Runtime Environment (rhel-188.8.131.52.el6_5-x86_64 u55-b13) OpenJDK 64-Bit Server VM (build 24.51-b03, mixed mode)
When the server starts, it binds to several TCP ports by default:
To check if the ports are free on a Unix host, run:
$ netstat -an | egrep '4440|4443'
If the ports are in use on the server, you will see output similar to below:
tcp46 0 0 *.4440 *.* LISTEN
The installation procedures describe how to choose different ports, if there is a conflict.
In addition, TCP port 22 (by default) needs to be open on the clients for SSH.
Clients should be set up to allow the Rundeck server user to connect to the clients using SSH via public-key authentication. It should not prompt for a password. See Configure remote machine for SSH in the Administration chapter.
There are various ways for installing SSH on Windows; we recommend Cygwin.
Checkout the sources from GitHub
You can build either the launcher jar (self-running archive), or a RPM.
Build the RPM:
To build clean:
Documentation can be built using:
make clean docs. Documentation build requires pandoc. The RPM build depends on the the documentation as well.
Note: The latest install documentation is available at http://rundeck.org/downloads.html.
Note, the java JDK must be installed. Install any JDK that is 1.7+.
If you want to install Rundeck on Linux via a binary installer, you can generally do so through the RPM tool that comes with your distribution.
# rpm -i rundeck-2.x.x.noarch.rpm rundeck-config-2.x.x.noarch.rpm
To install it using yum, first install the yum repo package and then run yum install:
# rpm -Uvh http://repo.rundeck.org/latest.rpm # yum install rundeck
Use the launcher as an alternative to a system package:
Define RDECK_BASE environment variable to the location of the install
export RDECK_BASE=$HOME/rundeck; # or where you like it
Create the directory for the installation.
mkdir -p $RDECK_BASE
Copy the launcher jar to the installation directory.
cp rundeck-launcher-2.0.0.jar $RDECK_BASE
Change directory and run the jar.
cd $RDECK_BASE java -XX:MaxPermSize=256m -Xmx1024m -jar rundeck-launcher-2.0.0.jar
Wait for the Started message.
2010-11-19 13:35:51.127::INFO: Started SocketConnector@0.0.0.0:4440
Update your shell environment
If you get an error message that resembles the one below, you probably are using an unsupported Java version.
Exception in thread "main" java.lang.UnsupportedClassVersionError: Bad version number in .class file
See the startup and shutdown section for instructions on using the
rundeckd shell tool to manage the rundeck launcher process.
The launcher jar can take a number of options to specify how the server should start. If you execute with a "-h" you will see the usage information:
java -XX:MaxPermSize=256m -Xmx1024m -jar rundeck-launcher-2.1.0.jar -h
usage: java [JAVA_OPTIONS] -jar rundeck-launcher.jar [-c PATH] [-d] [--installonly] [-s PATH] [-b PATH] [-p PATH] [-h] [-x PATH] [--skipinstall] [--serverdir PATH] [--datadir PATH] Run the rundeck server, installing the necessary components if they do not exist. --skipinstall Skip the extraction of the utilities from the launcher. --installonly Perform installation only and do not start the server. -b,--basedir <PATH> The basedir -c,--configdir <PATH> The location of the configuration. -d Show debug information -h,--help Display this message. -p,--projectdir <PATH> The location of Rundeck's project data. -s,--sbindir <PATH> The install directory for the tools used by administrators. -x,--bindir <PATH> The install directory for the tools used by users.
These options can be used to customize the directories used by the launcher. By default all the directories are organized by convention within the current working directory where the launcher jar is located.
You can also customize the launcher behavior by using some java system properties.
Specify these properties using the normal
-Dproperty=value commandline options to the
server.http.portThe HTTP port to use for the server, default "4440"
server.https.portThe HTTPS port to use or the server, default "4443"
server.http.hostAddress/hostname to listen on, default is all addresses "0.0.0.0"
server.hostnameHostname to use for the server, default is the system hostname
server.web.contextWeb context path to use, such as "/rundeck". Default is "/".
rdeck.baseRundeck Basedir to use, default is the directory containing the launcher jar
server.datastore.pathPath to server datastore dir
default.user.nameUsername for default user account to create
default.user.passwordPassword for default user account to create
rundeck.jaaslogin"true/false" - if true, enable JAAS login. If false, use the realm.properties file for login information.
loginmodule.nameCustom JAAS loginmodule name to use
loginmodule.conf.nameName of a custom JAAS config file, located in the server's config dir.
rundeck.config.nameName of a custom rundeck config file, located in the server's config dir.
rundeck.ssl.configPath to the SSL config properties file to enable SSL. If not set, SSL is not enabled.
rundeck.jetty.connector.forwardedtrue/false. Set to true to enable support for "X-forwarded-*" headers which may be sent by a front-end proxy to the rundeck server. See Using an SSL Terminated Proxy.
rundeck.jetty.connector.ssl.excludedProtocolsComma-separated list of SSL protocols to disable. Default: 'SSLv3'. See Disabling SSL Protocols.
rundeck.jetty.connector.ssl.includedProtocolsComma-separated list of SSL protocols to include. Default is based on available protocols. See Disabling SSL Protocols.
rundeck.jetty.connector.ssl.excludedCipherSuitesComma-separated list of Cipher suites to disable. No default. See Disabling SSL Protocols.
rundeck.jetty.connector.ssl.includedCipherSuitesComma-separated list of Cipher suites to enable. Default is based on available cipher suites. See Disabling SSL Protocols.
For more information about using SSL, see Configuring Rundeck for SSL.
Rundeck supports a number of user directory configurations. By default, the installation uses a file based directory, but connectivity to LDAP is also available. See Administration - Authentication.
The Rundeck installation process will have defined a set of temporary logins useful during the getting started phase.
user: Has access to run commands and jobs but unable to modify job definitions. Password: "user"
admin: Belongs to the "admin" group and is automatically granted the "admin" and "user" role privileges. Password: "admin"
If you installed Rundeck using the RPM installation method, it will have created a unix group called "rundeck".
$ groups rundeck rundeck : rundeck
Consult the usermod command to modify a user account.
To install the launcher on Windows as a service, follow these instructions:
cd C:\rundeck java -jar rundeck-launcher-x.x.x.jar --installonly
%RDECK_BASE%, but will just install it, not execute it.
--installonlydosen't create all folders, just run
java -jar rundeck-launcher-x.x.x.jarand stop the instance after the startup process finished.
%RDECK_BASE%\etc\profile.bataccording to your installation (for example
%RDECK_BASE%\server\config\rundeck-config.propertiesaccordingly to the docs
start_rundeck.bat) and place it under
set CURDIR=%~dp0 call %CURDIR%etc\profile.bat java %RDECK_CLI_OPTS% %RDECK_SSL_OPTS% -jar rundeck-launcher-2.6.10.jar --skipinstall -d
%RDECK_BASE%(you can place it elsewhere, but for the sake of the example let's use always the root dir)
cd C:\rundeck nssm.exe install RUNDECK
%RDECK_BASE%\start_rundeck.bat, working dir as
%RDECK_BASE%(optionally set "low" on the process tab, under priority, to avoid server cpu spike when starting rundeck)
This steps allow to "integrate" rundeck with IIS. This could be neccesary for example for these user cases:
If you are at least on 2008R2, you can install the ARR extension to proxy requests to the Jetty instance.
To do so, we need first to modify the port rundeck is running and specify the "prefix" for all urls generated by rundeck. Also, to avoid that anyone bypass IIS, rundeck must listen only on 127.0.0.1.
%RDECK_BASE%\start_rundeck.bat port (81) and host (127.0.0.1) as follows:
set CURDIR=%~dp0 call %CURDIR%etc\profile.bat java %RDECK_CLI_OPTS% %RDECK_SSL_OPTS% "-Dserver.http.host=127.0.0.1" "-Dserver.http.port=81" -jar rundeck-launcher-x.x.x.jar --installonly
But you can also put options in
%RDECK_BASE%\etc\profile.bat (in this case the "prefix" and the little bit that makes rundeck work behind a reverse proxy) as long as you define all of them.
... set RDECK_CLI_OPTS=-Xmx4096m -Xms1024m "-Drundeck.jetty.connector.forwarded=true" "-Dserver.web.context=/rundeck" ...
A tune is also needed in
grails.serverURL is needed to be the absolute url:
... grails.serverURL=http://yoursite/rundeck ...
Now, in IIS, (at the site level) create an URL Rewrite rule as follows:
route_to_rdeck(or whatever you prefer) matches the pattern (using regular expression):
rundeck.*(or a regex matching your "prefix")
append query string
Then, any request coming to http://yoursite/rundeck will be proxying to your rundeck instance running on port 81 on the same server, and you'll be sure that every request will come in only proxyied by IIS, since rundeck is only listening to 127.0.0.1.
If the rewrite module does not work, go to the
Application Request Routing settings on the IIS home, and enable the proxy.
Rundeck works with MSSQL too:
sqljdbc41.jar(572KB, mod date 2015-11-18) )
%RDECK_BASE%\server\config\rundeck-config.properties, set the following:
... rundeck.projectsStorageType=db dataSource.dbCreate = update dataSource.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver dataSource.url = jdbc:sqlserver://myserver;DatabaseName=RUNDECK dataSource.username = myusername dataSource.password = mypassword ...
When you need to update rundeck and you can not find the relevant section on the docs you are probably on a quite recent version. This worked successfully in all the steps from 2.6.5 to 2.6.10.
%RDECK_BASE%\server\lib, making a backup of any file you modified under those directories (e.g.
open a prompt, optionally setting RDECK_BASE and launch --installonly
java -jar rundeck-launcher-2.6.10.jar --installonly