Can you mention why you don't think puppet is the right solution?
Clearly the defaults on any package will not suit every enterprise, and
some customisation is required. Puppet can do that just as well as a vi
session, or a local configuration package.
In my operation every client has 1-10 servers (so none are big enough to
benefit from many common configuration patterns). That is, each server
is unique in hardware, domain name and in most other configuration details
(every client seems to have different requirements and so needs different
software with different integration behavior). Plus due to organizational
boundaries, we are hyper-concerned about security (each system is behind
network firewalls plus host-based firewalls plus several extra layers
to protect ssh).
For example, several clients want a web-based user management tool and
some of their networks are LDAP (each with a different schema, of course),
AD (also with different schemas), or traditional unix passwd. So ideally,
we need a configuration management tool that can flexibly work with
databases, LDAP _and_ files (and that doesn't need to be refactored with
every major upgrade of Debian). So I remain very skeptical of centralized
approaches that provide leverage primarily for homogeneous use cases.
I'm overwhelmed by excessive heterogeneity. The only thing in common
to all of our systems is Debian policy which is the baseline for all of
our customizations!
At Debconf10, I came to learn that puppet is possibly light-weight
enough that it might help even for our situation. So it is now on the
TODO list. But I remain very skeptical that another level of abstraction
can do anything but increase complexity.