# changelog

author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.2-0
changelog:
  - Fixed README typos
    - Cleaned up code
    - Added acceptance tests
    - Added support for `auth_membership`
    - Fixed code regression from d49cf32
      - Thanks for the notification from John Warburton
    - Validated noop message was correct
    - Fixed sort order when checking user lists against the system


author: Nick Markowski <nmarkowski@keywcorp.com> - 1.0.1-alpha
changelog:
  - You can now pass 'instance' and 'server_config' to the simp activemq, and
    reasonable defaults were set.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0-0
changelog:
  - Updated module to the latest for enhanced features and deprecation
    of the tanukiwrapper dependency.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Fixed bug whereby aide reports/errors were not being sent to syslog.
    AIDE can now be configured to report to syslog, itself.
  - Use FIPS-appropriate hash algorithms when in FIPS mode
  - No longer hide AIDE initialization failures (which are primarily
    configuration errors) when a manifest with the aide class is applied.
  - Improved acceptance tests.
  - Commented out SUSE acceptance test node, as the node configuration
    is broken.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Retain output database upon AIDE database update for SCAP
    Security Guide OVAL check
    xccdf_org.ssgproject.content_rule_aide_build_database


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Ensure that entries in 'at.allow' are not commented out by default
  - Updated the Gemfile to pin to the latest working Beaker


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Changed default log facility to local5.
  - Added a drop rule for crond events


author: Ralph Wright <rwright@onyxpoint.com> - 7.0.0-0
changelog:
  * Mon Dec 26 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
  - Refactor to work in Puppet 4 Changes
  - Updated acceptance tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - In response to the DISA STIG Requirements
    - Added 'open_by_handle_at' to the 'access' key
    - Added watches on /varlog/faillock and /var/log/tallylock
    - Added watches on /usr/sbin/insmod and /bin/kmod
    - Added permissions modification notification for 'chmod'
  - Renamed auditd::add_rules to auditd::rule
  - Split the audit permissions rules into separate lines
  - Disabled chmod auditing by default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.1-0
changelog:
  - Changed auditd::failure_mode to '1' by default since the compliant audit
    rules were causing routine system restarts. The new value will default to
    sending printk messages when the buffer is full.
  - Changed all rules that were exit,always to be always,exit


author: Nicholas Hughes <nicholasmhughes@github.com> - 7.0.1-0
changelog:
  - Audit kernel module tools from /usr/bin as well as /bin and /sbin
  - Correct auditing /var/log/tallylock, it should have been /var/log/tallylog


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Fix bug whereby audit.rules file was not being regenerated prior
    to auditd service start in CentOS/RedHat 6.
  - Update puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Updated to use augeasproviders_grub 3
  - Added the ability to log calls to the 'rpm' and 'yum' commands


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.3-0
changelog:
  - Fixed an issue where the filenames used by 'concat' could contain '/' which
    made them unfit for system use.
  - Also added 'audit' options to the file resources that control the 'autofs'
    service restarts.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Ripped out all NFS materials
  - NFS can now work with the configuration of autofs but there should not have
    been a strong dependency the other way


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Allowed for control of specific versions of the packages in this
    module with two new parameters:
    - samba_package_ensure
    - autofs_package_ensure
  - Support Puppet 5


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-5
changelog:
  - Updated to use the new 'simp' environment.
  - Changed calls directly to /etc/init.d/rsyslog to '/sbin/service rsyslog' so
    that both RHEL6 and RHEL7 are properly supported.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.0-6
changelog:
  - Added enable_clamav parameter to toggle: package install,
    freshclam/clamscan cron jobs, clamav rsync, antivirus selboolean.
  - The clamav user, group now manageable and package name mutable.
  - Added validation to init.pp


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Chris Tessmer <ctessmer@onyxpoint.com> - 1.0.0-0
changelog:
  - Move Forge org from `onyxpoint` to `simp`
    - Provide Ruby 1.8.7 compatibility
    - Ensure that a report is written on every run.
    - Updated to properly handle the hash references


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-0
changelog:
  - New map format
    - New output format
      - Added compliant values
      - Added missed parameters
      - Added missing class references
      - Added server-side storage
    - Added a conversion utility in the 'utils' directory


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.1.0-0
changelog:
  - Documented the report format in the README
    - Added the defaut SIMP compliance profiles to the module data
    - Enhanced the lookup mapper function to take an optional default map
    - Passed the internal data as the default map
    - Added client metadata to the compliance report for easier analysis
    - Fixed several minor processing bugs
    - Added the documented, but missing, regular expression match capability
    - Confine puppet version in metadata.json


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 2.3.0-0
changelog:
  - Converted compliance profiles to JSON.  This allows non-string values
    and faster deserialization.
  - Provided scripts in 'utils/' to convert the compliance profiles from
    YAML to JSON and vice versa.


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 2.3.1-0
changelog:
  - Refactor report generator to use a shared file format parser/compiler.
  - Add vendored 'profiles-in-modules' support


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Removed deprecated audit metaparameter
  - Added basic acceptance test
  - Made sure the cron::user class doesn't use the pam module if pam is false
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Prevent log duplication and log where intended.
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.1.1-0
changelog:
  - The simp_options::fips catalyst did not disable fips; changed enable
    variable to default to simp_options::fips
  - Moved check for OS family from params to init
  - Added package remove for dracut-fips packages if fips is disabled


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Created a work-around for an undocumented issue where /boot is not
    on its own partition but is added to the kernel parameters with
    fips=1. This situation ends up creating a kernel panic on the
    system until the boot= entry is removed from the kernel boot line.
  - Added tests against GCE since that is the default image configuration
    on those systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Including the FIPS module was causing FIPS mode to be enabled by default.
    This had high potential for causing issues, as evidenced by our acceptance
    tests, so we now mirror the 'enabled' state of the module based on whether or
    not FIPS is already enabled on the target system.
  - Update puppet dependency in metadata.json


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.
  - Fixed a bug with the radius_rsync_user passgen.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-0
changelog:
  - Ensure Puppet 4 compatibility. This changes the (always incorrect, but
    allowed) '2' and '3' paths to 'v2' and 'v3'.
    - Be sure to check and update your Hiera data!
  - Fixed the case where the `radius_version` fact does not exist.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Refactored module
  - Application certs now managed in /etc/pki/simp_apps/freeradius/x509


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Changed calls to auditd to the new layout (breaking change)
  - Added acceptance tests
  - Ensure GDM starts at boot time on EL7
  - Add notice that two runs are required


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.1-0
changelog:
  - Added the following services on EL7:
    - `display-manager`
    - `upower` - replaced hal, used by gnome
    - `rtkit-daemon` - used by pulseaudio and gdm


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Updated polkit setting to use the new defined type from the polkit module
  - Added polkit dependency
  - `dconf update` execs now catch failures


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Moved the simp dconf profile below the user profile so users can change
    their own settings in the desktop
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - module was rewritten
    - takes advantage of the data in modules paradigm
    - has a single point of entry
  - packages now default to 'installed' or the package_ensure catalyst
    from simp_options
  - gnome::dconf::add
    - deprecated in favor of gnome::config::dconf
    - this class is now a temporary shim to ensure backwards compatibility
  - gnome::config::dconf
    - allows setting more than one key/value pair (only one could be set
      in dconf::add)
    - class name is not a verb
    - dconf settings controlled by this class can be modified in data,
      including removing default settings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Add libxkbcommon-x11 to required package list for CentOS/RedHat 7.4.
  - Remove unnecessary CentOS data-in-module files.  The OS family fact
    for CentOS is RedHat, so these files are not used.


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Massive Refactor
  - Refactored the module to use the latest best practices and eliminate issues
    with doing an 'include' of the individual sub-classes.
  - Worked around a bug with the yum provider and the 'purged' parameter
  - Fixed some class ordering
  - Added acceptance tests for EL6 and EL7
  - Updated the rspec tests to properly work around OEL issues with facts


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.3.1-0
changelog:
  - Updated module for auto lua spec generation
  - Added missing requires file and added dependency on simplib
  - Modified module to auto-generate lua spec


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Fixed bug in the set provider for the xt_recent type that required manual
    modifications to the permissions for the /sys/module/xt_recent/parameters/*
    files, in order for the scanblock capability to be enabled.
  - Fixed bugs in the xt_recent type and its set provider that caused
    Puppet to believe /sys/module/xt_recent/parameters/ip_list_perms
    file content had changed when it had not.
  - Eliminated use of deprecated Puppet.newtype
  - Updated to compliance_markup version 2


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.2-0
changelog:
  - Added a workaround for Puppet 4.10 type issues
    - There was a bug in Puppet where all lookup() Hash keys were being converted
      into Strings even if they were another data type
    - This is fixed in Puppet > 4.10.2 but this patch will remain for backwards
      compatibility
  - Update puppet dependency in metadata.json
  - Remove OBE pe dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-4
changelog:
  - Updated to properly handle the SSL protocols in Apache. We now add a
    + if one is warranted and just keep the entry if it starts with a +
    a minus or is 'all'.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts
  - Strong typed
  - Updated pki scheme; application certs now managed in
    /etc/pki/simp_apps/jenkins/x509


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Fix most of the puppet strings problems
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.3-0
changelog:
  - Allow users to modify the owner, group, and mode of files that may be used by
    multiple subsystems


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.0-0
changelog:
  - Added support for CentOS 6
  - Fix several bugs in the following categories:
    - Use of wrong variables (cut and paste errors or typos)
    - Improper parameter validations
    - Parameters not being used in erb files.
    - OBE names of ipsec settings.
    - Missing quotes/braces around settings that can contain whitespace
  - Expose more ipsec settings.
  - Allow IPv6 addresses


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.2-0
changelog:
  - Bug fixes:
    - Set up FIPS-compliant configuration, not just when
      simp_options::fips is true, but also when the server is already
      in FIPS mode.
    - Insert token password into the NSS database after configuring
      the NSS database for FIPS.
  - Updated the tests.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.1-0
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.1-0
changelog:
  - Strongly typed module
  - Moved docs to strings/yardoc format
  - Removed verb from vm_create class to vm


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored to pass all lint tests and be compatible with hiera and puppet 3.
  - Added rspec tests for test coverage.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Added lastaction logic to logrotate::rule.
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.1-0
changelog:
  - Updated the defaults  settings for compress, rotate and dateext in rule.pp
    to pull values from init.pp. (They were hard coded to them before)
  - changed templates to add nodateext if dateext is set to false.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.3.1-0
changelog:
  - Module forked from voxpupuli/puppet-mcollective
    (https://github.com/voxpupuli/puppet-mcollective)
  - Added in mco_autokey generation.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.4.0-0
changelog:
  - Update to the 2.2.0 release of the voxpupuli module
  - Updated mcollective::defaults to insert the RPM-compatible core_libdir if
    using a RedHat family system


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.0.0-0
changelog:
  - SIMP-2133: Ensured capabilities synced with 5.X, master.
  - SIMP-2133: Gemfile updated to use latest assets.
  - SIMP-1595: Updated dependency boundaries.
  - SIMP-2097: Bumped major version to 3.0.0.


author: Maintenance
changelog:
  2.0.0-3
  - Moved mit-tests to /usr/share/simp...
  - Updated pp files to better meet Puppet's recommended style guide.


author: Maintenance
changelog:
  2.0.0-4
  - Created a Cucumber test to ensure that firefox installs correctly
    and is at the latest version when including mozzila in the puppet
    server manifest.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.3.0-0
changelog:
  - Created work-around for https://bugzilla.redhat.com/show_bug.cgi?id=1278082
  - Users can modify the chroot path in named-chroot.service
  - Asserted service, chroot, and non-chroot as private classes


author: Nick Miller <nick.miller@onyxpoint.com> - 4.3.1-0
changelog:
  - Changed the Exec['restart-systemd'] to Exec['systemctl-daemon-reload']
    to avoid a conflict with puppetlabs-postgresql


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 4.3.3-0
changelog:
  - This patch corrects the following shortcomings to ensure compatability
    with Red Hat Enterprise Linux 7 and its clones:
      - Ensures all required directories exist in the chroot
      - Remove dependencies for the non-existent `named-chroot-setup.service`
      - Use new-style daemon invocation, executing in the foreground and
        logging to stderr.  See daemon(7).
      - Since new-style daemons don't require a PID file, nor does the binary
        generate one in foreground mode, remove it from the service file.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed the module
  - Made chrooting logic less complicated
  - ALL of the spec tests


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized, lint errors corrected,
    and rspect tests have been updated to the new 'expect' syntax.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.2-0
changelog:
  - Ensure that no calls to 'function_defined' are present in any templates for
    Puppet 4 compatibility


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Strong typing w/new IP types
    - All parameters that were 'yes' or 'no' are now optional booleans
  - Removed most validation from templates
  - Added more tests for all manifests
  - Cleaned up regex in the careful restart script


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Added management of bind-utils and bridge-utils
    - Packages in this module now use the package_ensure catalyst
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed.
  - Fix bug whereby the STATDARGS parameter in NFS sysconfig server
    configuration was not set.
  - Fix bug whereby the LOCKD_ARG parameter in NFS sysconfig server
    configuration was improperly set.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - gssproxy ensured running when secure_nfs is true, el > 7.1
  - Confine puppet version in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - corrected error for lookup
  - Fixed comments and aligned variables to make it look pretty.
  - update simplib version to include new types.
  - renamed pam::access::manage to pam::access::rule
  - renamed pam::limits::add to pam::limits::rule
  - Added strong types and updated Global catalists.
  - Removed NSCD logic.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - When using list separator  you can't have spaces between
    identifiers in access.conf if your separator is not a space.
    It then includes spaces as part of the name so we are removing spaces
    from the access file.  Dylan also added changes that wrap the use
    of separator in boolean.


author: Jeanne Greulich <jgreulich.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - Global catalyst updates
  - Strong Type updates
  - Changed default for pki directory to /etc/pki/simp from /etc/pki


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed pki::pki_dir parameter to pki::base_dir
  - Updated acceptance tests
  - Fixed bugs in ordering


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Set perms on simp_apps to 644/755; apps were being denied access to
    their own certs because they could not access /etc/pki/simp_apps.
  - We have made the decision to centralize application certificates
    when simp is managing pki (simp_options::pki => true or 'simp').
    This update re-tools pki::copy to better handle managing certs
    in /etc/pki/simp_apps.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed default location of keydist certs from the files directory of the pki
    module unless $pki is set to 'simp', when it will pull from pki_files in a
    different module path instead.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - SIMP certs are now managed in /etc/pki/simp/x509, and application
    certs in /etc/pki/simp_apps/<app_name>/x509.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - There was a bug in the 'identity' variable for polkit::local_authority where
    it would not properly accept arrays of users or groups.


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored manifests to pass all lint tests for puppet 3 and hiera compatibility.
  - Added spec tests.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Add EL7 and polkit 106+ support by allowing javascript rules
    - Added define to allow for easy placement of custom rules
    - Added templated define to ease generation of basic rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Allow default identity and identities prefixed with unix-netgroup.
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.2-0
changelog:
  - Removed `audit` metaparameter
  - Implemented `package_ensure` catalyst
  - Cleaned up some code formatting
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 7.3.1-0
changelog:
  - Use global catalyst to configure package_ensure.
  - Add 'puppet_enterprise::profile::database' class definition to the pe_classlist
    and move the postgresql components under that class.
  - Add 'puppet_enterprise::profile::primary_master_replica' class definition
    to the class list to work around an issue in production


author: Kendall Moore <kendall.moore@onyxpoint.com> 7.3.1-0
changelog:
  - Added manifest to manage simp-specific puppet master auth requirements
  - Disabled puppetserver setting to enable legacy auth.conf by default
  - Remove legacy auth.conf placed by the `puppet-agent` package


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.3.1-0
changelog:
  - Ensure legacy auth.conf is backed up before removing it. This is a
    follow up to SIMP-3049 based on feedback to SIMP-3196.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.3.1-0
changelog:
  - Removed Puppet CRL download, the puppet agent now checks for the expiration of
    the cert automatically


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.3.1-0
changelog:
  - fixed the path to the pki_files and krb_files in the auth.conf
    so remote systems could download files.
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.4.0-0
changelog:
  - README updates:
    - Informed users of legacy auth.conf deprecation
    - Provided instructions to reproduce custom auth.conf entries
      in puppet


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.4.0-0
changelog:
  - Add SHA256-based option to generate the minute parameter for
    a client's puppet agent cron from its IP address. This option
    is intended mitigate the undesirable clustering of client puppet
    agent runs, when the number of IPs to be transformed is less
    than the minute range over which the randomization is requested
    (60) and/or the client IPs are not linearly assigned.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Most of this content was from simplib
    - The dns autoconfiguation content was moved to a profile in simp/simp
  - First cut


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Switched to using puppetlabs/concat
  - Fixed the startup script for EL6
  - Fixed minor ordering issues
  - Renamed the service to 'rsyncd' to match the service name in EL7
  - Cleaned up rsyslog calls to remove logic


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Fixed minor bug in rsync provider that caused  'Unknown failure
    using insync_values?' Puppet message to be generated.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated pki to use new scheme
  - Application certs now managed in /etc/pki/simp_apps/rsyslog/x509
  - Added trailing newline to drop rules


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.3-0
changelog:
  - rsyslog::server::enable_selinux now optional, for robustness
  - Updated logrotate to use new lastaction API


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.3-0
changelog:
  - Fixed bug in which default iptables rsyslog rule did not work
    with rsyslog version 7.4.7.  Some versions of rsyslog include
    the ' ' separator in the message payload, which impacts the
    startswith rule.
  - Fixed bug whereby puppetserver log messages were not being
    collected in puppetserver-specific logs.
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - Add ability to specify full rule content for rsyslog::rule::local
    and rsyslog::rule::remote defined types.
  - Fixed bug in which ioBufferSize parameter was listed twice
    in the rsyslog rule generated by rsyslog::rule::local.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.0.3-0
changelog:
  - Ensure that policycoreutils-python is only installed if not installed
    elsewhere. This deconflicts with various hotfixes that were needed in other
    modules.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.1.0-0
changelog:
  - Fixed a bug wherein setenforce would run if selinux was disabled
  - Changes in selinux state incur a reboot notification


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Moved management of mcstrans and restorecond to the selinux module
  - Change default packages ensure to use the catalyst
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.1.0-0
changelog:
  - Rework manifests to ensure mcstrans and restorecond services are not
    running when selinux is disabled.
  - Allow this module to manage restorecond package installation.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.1.1-0
changelog:
  - call simp::nsswitch in simp and simp-lite scenario instead of just nsswitch
    to set nsswitch according to simp_options instead of just the nsswitch defaults.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-0
changelog:
  - Fail compilation for a subset of SIMP capabilities, if they are
    used on unsupported operating systems.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.3.0-0
changelog:
  - In simp::sysctl, add parameters for net.ipv6.conf.all.accept_source_route
    and net.ipv6.conf.default.accept_source_route and set them to 0 by
    default.  This satisfies STIG CCI-0000366.
  - Small test fixes to allow acceptance tests to run on servers in FIPS mode


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 5.0.1-0
changelog:
  - Prevent log duplication and log where intended
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Renamed `add_site` to `site`
  - Strongly typed module
  - Updated module assets
  - Wrote a basic class acceptance test


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Fixed dependency logic with mod_ldap to not install it on CentOS 7
  - Rsyslog calls no longer include implied logic
  - Rsync now calls the correct share


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.1-0
changelog:
  - Create namespaced, Puppet 4 versions of externally-used Puppet 3
    functions and mark the Puppet 3 functions as deprecated. They will
    be removed in a later release.
    - apache_auth should be replaced with simp_apache::auth
    - apache_limits should be replaced with simp_apache::limits
    - munge_httpd_networks should be replaced with simp_apache::munge_httpd_networks
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: SIMP Team <simp-project.com> - 0.1.0
changelog:
  - This is the initial code for a `simp_gitlab` module, which installs
    GitLab Omnibus and incorporates it into SIMP.


author: Ralph Wright <rwright@onyxpoint.com> - 0.1.1-0
changelog:
  - A few minor fixes for seemless install
  - Added option to install SIMP dashboards
  - Added option to allow SIMP dashboards to be installed


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Update to latest Grafana (4.2.0) and Elasticsearch (5.4.0)
  - simp_grafana::version now defaults to 'latest'
  - Confine puppet version in metadata.json


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Workaround 2-pass grafana rpm install issue in acceptance tests
  - Update README to reflect SIMP 6 global catalysts.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-0
changelog:
  - First cut after being split off from the original simp-logstash module.
  - Provides a much cleaner abstraction between this and the upstream Logstash
    material from Elastic.


author: Jeanne Greulich <jgreulich@onyxpoint.com> - 3.0.0-0
changelog:
  - Update major version release for SIMP 6
  - Removed stunnel and replaced it with TCP TLS input
  - Added TLS enabled JSON input
  - Updated tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Updated to LogStash 5.X and Elasticsearch 5.X
  - Fixed type bug in simp_logstash::output::elasticsearch::action.
  - Fixed enum typo in enum for simp_logstash::output::elasticsearch::script_type
  - Fixed puppet strings problems.
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.2
changelog:
  - Added the ability to override ciphers in the create_home_directories script
    for EL6 since the cipher order does not happen from strongest to weakest and
    breaks secure LDAP connections
  - Added a check for create_home_directories to ensure that directories are not
    archived if the server doesn't respond for TLS reasons.


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.0.3
changelog:
  - Updated create_home_directories to handle multiple URIs
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Rename from 'openldap' to 'simp_openldap' so that we can migrate to an
    alternate backend in the future


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed the 'acl' log level from the default list since it was causing low
    server response time on some EL7 systems
  - Corrected the openldap::server::conf::conn_max_pending_auth to be set to 1000
    instead of 100


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Updated logrotate to use new lastaction API
  - Updated all ldap DNs to uppercase DC=
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Per CVE-2014-3566, SSLv3 and TLSv1 ciphers should be disallowed. Recent-ish
    updates to openldap-servers, shipped with SIMP-6.0.0-0, includes a parameter
    to specify a minimum bound of TLS protocol in slapd.conf, TLSProtocolMin.
    (see https://access.redhat.com/solutions/1234843)
  - This commit includes puppetry to remove TLSv1.0, SSLv3, and SSLv2 from the
    TLS cipher suites, and set a minimum TLS protocol of TLSv1.2, given
    openldap-servers is >= 2.4.40.
  - Updated syncdn and binddn defaults in server::conf


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Fixed an issue where pki::copy was not correctly hooked into the server logic
    and a system PKI update would not properly propagate into the OpenLDAP
    service restart.


author: Nick Miller <nick.miller@onyxpoint.com> - 1.0.1-0
changelog:
  - Added more strict Puppet and PE requirements, pinning to Puppet 4.7+ and
    PE 2016.4.0+
  - Updated openssl::cipher_suite to be set to the fips_ciphers fact if it's
    available to expand the 'FIPS' shortcut, which causes issues with some
    applications (openldap)


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.0.2
changelog:
  - Fixed directory for log rotate of central log server
  - add warning if possible log looping detected


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Fix bug whereby audit logs were not being forwarded to remote syslog servers. 
  - Fix bugs whereby simp_rsyslog::log_collection and simp_rsyslog::log_openldap
    parameters were overriding simp_rsyslog::default_logs instead of being merged.
  - Work around rsyslog inconsistent message parsing behavior that prevented
    iptables logs from being written to iptables.log and/or being forwarded,
    for some versions of rsyslog.
  - Ensure local audispd log messages are not duplicated.
  - Adjust local rule ordering to ensure local sudosh and apache (httpd)
    log messages are written to their own log files.
  - Restore writing of local puppet and puppet-server messages to their
    own files, by adjusting local security rsyslog rule from simp_rsyslog::local.
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - Updated the concat_output and fragmentdir functions to properly
    handle String/Array conversions in Ruby 2.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed from using Puppet[:vardir] to Facter.value(:puppet_vardir), which
    accounts for the different vardirs on agent and server.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.5.0-0
changelog:
  - Added a 'simplib::assert_metadata_os' function that will fail the compile if
    the passed module does not support the operating systems defined in the
    module's metadata.json.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.5.0-0
changelog:
  - Add simplib-specific deprecation functions for both Puppet 3 functions
    (simplib_deprecation()) and Puppet 4 functions (simplib::deprecation()).
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::inspect() replaces deprecated inspect()
    - simplib::ipaddresses() replaces deprecated ipaddresses()
    - simplib::parse_hosts() replaces deprecated parse_hosts()
    - simplib::passgen() replaces deprecated passgen()
    - simplib::strip_ports() replaces deprecated strip_ports()
    - simplib::to_integer() replaces deprecated to_integer()
    - simplib::to_string() replaces deprecated to_string()
    - simplib::validate_uri_list() replaces deprecated validate_uri_list()
    - simplib::validate_net_list() replaces deprecated validate_net_list()
    - simplib::validate_port() replaces deprecated validate_port()
  - Add single-line json output option to simplib::inspect()


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.5.0-0
changelog:
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::ip_to_cron() replaces deprecated ip_to_cron()
    - simplib::rand_cron() replaces deprecated rand_cron()
  - Add algorithm options to simplib::ip_to_cron() and
    simplib::rand_cron() to allow the user to select the transformation
    algorithm, instead of defaulting to an IP number modulus, when the
    entity to be transformed is an IP address.  The IP number modulus
    algorithm produces undesirable clustering when used to randomize IP
    addresses in a system for which the number of IPs to be transformed
    is less than the range over which the randomization is requested.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.6.0-0
changelog:
  - Convert all 'sysctl' 'kernel.shm*' entries to Strings
    - shmall and shmmax were causing Facter and newer versions of Puppet to crash
    - See FACT-1732 for additional information
  - Add Puppet function `simplib::assert_metadata_os()`
  - Add data type `Simplib::Puppet::Metadata::OS_support`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.7.0-0
changelog:
  - Add Simplib::Macaddress data type
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::join_mount_opts() replaces deprected join_mount_opts()
    - simplib::nets2cidr() replaces deprecated nets2cidr()
    - simplib::validate_re_array() replaces deprecated validate_re_array()
    - simplib::validate_sysctl_value() replaces deprecated validate_sysctl_value()
  - Deprecate validate_umask(), advising the user to convert to the
    Simplib::Umask data type
  - Deprecate validate_macaddresses(), advising the user to convert
    to the Simplib::Macaddress data type
  - Fix bug in which simplib_deprecation() used the wrong environment variable.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.8.0-0
changelog:
  - Convert a subset of Puppet 3 functions to Puppet 4 and emit a
    simplib deprecation warning when the Puppet 3 versions are called:
    - simplib::nets2ddq() replaces deprecated nets2ddq().
    - simplib::validate_array_member() replaces
      deprecated validate_array_member()
    - simplib::validate_between() replaces deprecated validate_between().
      The new version fails validation, instead of returning false.
      This behavior consistent with both how the method is used by SIMP
      modules and the error behavior of all other simplib validate
      functions.
    - simplib::validate_bool() replaces deprecated validate_bool_simp()
    -  simplib::validate_deep_hash replaced validate_deep_hash.
  - In simplib::validate_deep_hash, fixed validate_deep_hash bug in
    which unknown keys in the Hash to check were not detected.


author: Maintenance
changelog:
  2.0.0-1
  - Updated the spec file to add in the 'lib' directory and set the directory
    permissions more cleanly.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.1-0
changelog:
  - Changed the default UsePrivilegeSeparation setting in sshd_config to use the
    vendor default of 'sandbox'
  - Changed the default value of simp_options::trusted_nets to ['ALL'] to prevent
    permanent lockouts when a console isn't available.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Reverted 'ssh::server::conf::trusted_nets' to 'ALL' by default to prevent
    lockouts from cloud systems


author: Nicholas Hughes - 6.1.0-0
changelog:
  - Set permissions back to what the RPM sets and security scans expect
    - /etc/ssh/moduli
    - /var/empty/sshd
    - /var/empty/sshd/etc
    - /var/empty/sshd/etc/localtime


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Convert internally-used Puppet 3 functions to Puppet 4
    - ssh_config_bool_translate is now ssh::config_bool_translate
    - ssh_format_host_entry_for_sorting now ssh::format_host_entry_for_sorting
  - Create Puppet 4 versions of externally-used Puppet 3 functions and
    mark the Puppet 3 functions as deprecated. They will be removed in
    a later release.
    - ssh_autokey should be replaced with ssh::autokey
    - ssh_global_known_hosts should be replaced with ssh::global_known_hosts


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated to use new pki scheme.
  - Application certs now managed in /etc/pki/simp_apps/sssd/x509
  - Strongly typed


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Worked around a bug in EL6 where the ldap client library incorrectly handles
    128 bit ciphers in the cipher list


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Sssd::DebugLevel now handles all variants specfied in sssd.conf man page
  - All instances of debug_level are now typed as Sssd::DebugLevel


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts.
  - Refactored the module.
  - Fixed bug whereby 'chroot = false' is written to stunnel.conf when
    selinux is enabled.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Moved `stunnel::add` to `stunnel::connection` for syntactic correctness
  - Updated to work with the new IPTables module


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated pki::copy to use the new scheme.
  - Application certs now managed in /etc/pki/simp_apps/stunnel/x509
  - Removed parameters from README because we are puppet-strings-ified.
  - Removed redundant parameter $libwrap


author: Ryan Russell-Yates, Liz Nemsick - 6.0.1-0
changelog:
  - Flesh out README
  - Remove OBE 'pe' requirement from metadata.json
  - Update puppet version in .travis.yaml


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0
changelog:
  - Added a define, stunnel::instance
    - Creates standalone connections with their own configurations
      and services
    - Adds systemd support
    - Possible to chroot when selinux is permissive/enforcing
    - Backwards compatible with existing stunnel configurations
  - stunnel::connection is unofficially deprecated until the SIMP-7
    release, at which point stunnel::instance will replace
    stunnel::connection
  - Update puppet requirement in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0
changelog:
  - Added acceptance test to switch between SELinux enabled and disabled
    - Renamed them to make more sense
  - Updated SysV scripts for safety concerns
  - PKI now is now owned by the proper $setuid
  - Renamed templates to make more sense
  - Manage PID dir in Puppet when possible
    - Fixed bug where PID dir was being created with SELinux contexts
      even when SELinux was disabled
  - Added systemd unit to `connection` for use on EL7 systems
  - Switched tenplates to use a safe name
  - Added support for Puppet 5


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1
changelog:
  - Add feature to systemd init script to kill stunnels started from
    the previous version of the module
  - Fixed bug where `stunnel::config::pid` was being ignored


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.1-0
changelog:
  - Fixed the validation command on the concat resource to actually validate the
    temp file prior to putting it in place


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Nick Miller, Ryan Russell-Yates, Liz Nemsick - 3.1.1-0
changelog:
  - Add acceptance test for symlinked services
  - Flesh out README
  - Remove OBE 'pe' requirement from metadata.json
  - Update puppet version in .travis.yaml


author: Trevor Vaughan - 3.2.0-0
changelog:
  - Enabled the new, kinder, svckill by setting the default mode to 'warning'
  - Added a `svckill::enable` parameter to be able to disable svckill from Hiera
    easily


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - In the service kill provider, not all services queried by 'Name'
    with systemctl would return a name.  That caused a break in symlink
    logic, rendering a majority of aliases to remain undetected.  Error
    detection has been added and the symlink logic has been re-worked.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - Implemented simplib::knockout on the ignore list so users can
    remove items in the default list via hiera.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.1-0
changelog:
  - Fix bug whereby svckill provider's insync_values? emits
    'Unknown failure' message during normal operation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.4-0
changelog:
  - Fix bug in which svckill provider can fail on a server for which
    there are are no aliased, SystemD services.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-1
changelog:
  - Updated to not cast lpattern to an Array in tcpwrappers.allow.erb
    for compatibility with Ruby 2.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.1-0
changelog:
  - Inclusion of FIPS in the initrd kickstart option list is now optional.
    By default, we no longer set fips=1 in initrd.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.0-0
changelog:
  - Added a feature to manage the PKCS#11 slot provided by the TPM
  - Also added a class that takes advantage of it


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.1-0
changelog:
  - Added a check to the ima_log_size fact to make sure that the file
    needed exists before executing


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.0-0
changelog:
  - Improvments to the facts:
    - Add tests for following facts:
      - tpm
      - ima_log_size
      - has_tpm
    - Confine tpm fact on the existance of the `tpm-tools` package
    - Migrate to the built in facter timeout
  - Improvements to the `tpm_ownership` provider
    - Added instances feature
      - run `puppet resource tpm_ownership` and see the resource
    - New properties to the type to reflect system state
    - Changed default owner_pass to 'well-known'
    - Removed 'ensure' parameter in favor of the 'owned' param
    - Improved documentation
  - Improvements to the `tpm::ownership` class
    - Added 'owned' parameter to pass to the tpm_ownership type
  - New `tpm::tboot` class to enable Trusted Boot
    - See `tpm::tboot` for details
    - Automatically lock the kernel package and other kernel related packages to
      avoid automatically invalidating launch policy
  - Depend on augeasproviders_grub instead of generic and deprecated
    augeasproviders


author: Chris Tessmer <chris.tessmer@onypoint.com> - 4.1.0-4
changelog:
  - migration to simplib and simpcat (lib/ only)
  - Fixed a set of bugs that were introduced to the 'job.erb' template.
  - Code cleanup


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Use strongly typed parameters
  - Fix bug whereby optional, respawn limit was not properly specified
    in upstart jobs.
  - Refined upstart::job::sys_limit validation to reject non-integer numbers.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Initial release of module
  - This module is a collection of conf files regarding users and user creation.
    - Most of the content used to be in simplib


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Provided the ability to simply add shells to /etc/shells
  - Removed all entries from /etc/securetty by default to match the latest
    standard best practices. This removed ZSH.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.1
changelog:
  - Fixed useradd::libuser::defaults_crypt_style to only be a String of the
    allowed values
  - Ensure that the 'modules' field is not printed if the passed Array is empty
  - Ensure that defaults_hash_rounds_min is less than defaults_hash_rounds_max
    and that both are within an allowed range
  - Update useradd::login_defs::pass_min_len to 15 to match the rest of the module updates


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Fix bug in libuser.conf where userBranch was referencing groupbranch variable
  - Added/fixed author on all manifests
  - Created Acceptance test
  - Updated spec/spec_helper_acceptance.rb
  - Added Managed by Puppet comment to all file templates
  - updated default nodeset
  - Added notes to login_defs.pp regarding min and max passwd length
  - Cleaned up documentation and made style changes


author: Brandon Riden <brandon.riden@onyxpoint.com - 0.2.0
changelog:
  - Allow users to specify colors as strings instead of ansi codes in sysconfig/init
  - Updated sysconfig_init.pp to reflect these changes as well as add notes
  - Updated template to convert color strings to ansi code


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed unecessary code and deps after major dep releases
  - Locked versions of all build and test deps


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fixed bug whereby manifest would fail to compile if the force_dot_files
    parameter of ::vsftpd::config was set
  - Fixed bug whereby vsftpd.conf configuration values to be set to 'NO'
    were not written out to that file
  - Fixed bug whereby listen configuration parameter for vsftpd.conf was
    not set based on $listen_ipv4 parameter of ::vsftpd
  - Convert to explicit parameter types


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - New pki scheme
  - Real integers and simplib types implemented
  - Application certs now managed in /etc/pki/simp_apps/vsftpd/x509


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - By default, use TLS 1.2 instead of TLS 1.0.
  - Eliminate the use of deprecated validate_net_list() through
    better strongly-typed parameters for IP addresses and hosts.
  - Add CentOS 6 acceptance tests.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fix bug in xinetd.service.erb that caused an inadvertant newline between the
    IP address and port in a redirect configuration line in the generated file.
  - Fix bug in xinetd.service.erb in which the instances and mdns configuration
    lines were omitted from the generated file.
  - Fixed bug in xinetd.service.erb in which includedir and include were specified
    within a service declaration and formatted incorrectly.
  - Fixed bug in validation of syslog facility
  - Fixed bugs in validation of ::xinetd $passenv and $disable parameters
  - Fixed bugs in validation of ::xinetd::service $x_id and $rpc_version parameters
  - Minor cleanup


author: Nick Miller <nick.miller@onyxpoint.com> - 4.0.1-0
changelog:
  - Updated data types to use new Simplib types
  - Corrected simp_options lookups to not have a context prefix of '::'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.2-0
changelog:
  - Update to Puppet 4 custom functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp config updates:
    - When SIMP was not installed via RPM, warn operator about
      potential system lockout and then prevent 'simp bootstrap'
      from running, until the operator manually verifies the
      problem has been addressed/is not an issue.
    - Update location to FakeCA


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp config changes:
    - Reworked YUM-related queries to reflect changes to simp::yum.
      Now, for non-ISO installs, you have the option to set up
      SIMP repos that pull from SIMP internet repositories.
      Otherwise, the configuration of YUM repositories for the
      SIMP server and SIMP clients is left to the installer.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0
changelog:
  - simp bootstrap update:
    - Tweak post-bootstrap text to remove instructions to run
      puppet and to make it more clear that the user must reboot.
    - Do not tell user existing certificates have been preserved,
      when none exist.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.0.1
changelog:
  - simp config update:
    - We noticed inconsistent behavior when spawning commands with
      pipes, particularly a pipe to xargs.  Item execute has been
      re-tooled to reject pipes, and provide users with a way to
      chain commands while mitigating code flux due to change in API.
    - Added the run_command method to Cli::Config::Item
    - Action items updated:
      - update_os_yum_repositories_action
      - check_server_yum_config_action


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.2
changelog:
  - Changed chown command to also handle PE
    - Thanks to Bryan Belanger for the PR!
  - Made the Puppetserver tmp dir code consistent with the rest of the chmods


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.3
changelog:
  - Fix bug in hostname validation that prevented complex hostnames
    such as 'xyz-w-puppet.qrst-a1-b2' to fail validation.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-RC1
changelog:
  - Added the dist flag to the release due to distribution specific logic
  - This is required due to automatic distribution-specific requirements that end
    up bound to the simp RPM


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.2-0
changelog:
  - Removed core module binford2k-node_encrypt.  There are issues with
    the module and we don't currently use it anywhere in core.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - update puppetserver to 2.8.0-1
  - updated packages.yaml to pull puppet 4.10.6 rpms.
  - change diskdetect.sh kickstart file to use ext4 instead of xfs
  - add simp_snmp, simp_nfs and update augeasproviders_grub


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Removed pupmod-herculesteam-augeasproviders_base as a SIMP dependency
  - Removed the 'dist' from the /etc/simp/simp.version file


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Fix 'puppet resource service' bugs in %post
  - Add /var/run/puppetlabs to the list of directories to traverse,
    when fixing puppet uid/gid.
  - Fix simp_rpm_helper bugs that prevented SIMP module RPM uninstalls
    in certain scenarios


author: Trevor Vaughan <tvaughan@onyxpont.com> - 0.0.3-0
changelog:
  - Handle PE and Puppet Open source in the post section
  - Add dist to the release field to account for RPM generation on EL6 vs EL7
  - Updates to work better with PE and with the new method for detecting
    kickstart installs as added by Chris Tessmer <ctessmer@onyxpoint.com>


author: Nick Miller <nick.miller@onyxpoint.com>
changelog:
  - Added advice on how to recover from a failed boot due to selinux policy
  - Added tboot docs into the tpm HOWTO


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added information on performing system scans as well as a SSG response
    template to the Security CONOP


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0
changelog:
  - Move FakeCA down into /var/simp/environment/simp where it can be
    appropriately applied without getting wiped out by r10k or Code Manager
  - Make FakeCA use relative paths for writing keys
  - Ensure that a copy of the FakeCA core exists in /usr/share/simp so that users
    have a clean copy to work from


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.4-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 6.2.1 tag for which the RPM version was erroneously 6.2.3.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.5-0
changelog:
  - selinux policy in module simp-environment was changing settings on rsync files not in the
    simp environment and removing their selinux context.  This caused DNS, DHCP to fail 
    if they were running in an enviroment by a name other then simp.
  - moved selinux policy to simp-environment module and had simp rsync require this module
    so the selinux policy for /var/simp directory would be in one spot.
    file contexts are not overwritten by it.
  - updated the policy so it would explicitly set the context for files in simp environment and
    not overwrite settings that were not explicitly set.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.6-0
changelog:
  - Ensure that FakeCA works properly with Puppet Enterprise
  - Ensure that the RPM installation permissions work properly with Puppet
    Enterprise


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.7-0
changelog:
  - Enable the UDP localhost rsyslog server on the puppetserver to capture
    messages from the puppet services for processing and forwarding


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-2
changelog:
  - Now install the GPG keys to /usr/share/simp/GPGKEYS and /etc/pki/rpm-gpg
  - Copy the keys into the SIMP default web dirs if they exist and be sure to
    clean up after ourselves in the future.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.0-0
changelog:
  - Added new puppet gpg key from http://yum.puppetlabs.com/RPM-GPG-KEY-puppet
  - Ensure facter is in $PATH during post install


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-1
changelog:
  - Only copy in the SIMP and Puppet GPG keys into the system trust chain.
    Copying more than that is too presumptive.
  - Removed the 'dist' qualifier from the version since it was determined that
    the public GPG keys are OK to be common across all releases.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.2-0
changelog:
  - simp-gpgkeys is now its own module
  - Added a yaml file with a download source and a fingerprint to check cert integrity
    - And a travis file to check them


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.3-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 3.0.2 tag for which the RPM version was actually 3.0.3.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-4
changelog:
  - Removed all jenkins plugins since we were not properly maintaining them.
  - Updated all TFTPBoot material to support RHEL7.1 and CentOS/RHEL6.6.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Removed everything that *may* fall under a conflicting license. We will need
    to evaluate how to handle package building going forward.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-1
changelog:
  - Added a ClamAV specific RPM to handle the different license in ClamAV.
  - These should eventually be split.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Updated the README that is delivered with the SIMP rsync environments to talk
    a bit about the shares structure and to encourage users to read the HOWTO


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - The selinux policy in simp-environment was changing settings on rsync
    files not in the simp environment.  If DNS and DHCP were running in an
    environment other then simp, relabeling the filesystem would change the
    selinux context to default context for /var/simp. This, in turn, caused
    these services to fail if selinux was in enforcing mode.
  - The selinux policy and the logic to set it up were moved to simp-environment module
    so the selinux policy for /var/simp directory would be in one spot.
  - Simp-rsync now requires the simp-environment


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - puppetlast:
    - Now uses the new PuppetDB nodes endpoint over http
    - Gathers new information about the nodes, which can be now be sorted and
      isolated by status and environment
    - Expired nodes will no longer show up in the query
    - Errors and exit scenarios will now be handled more gracefully
    - Removed man page in favor of `puppetlast -h`


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - added example ldifs to be copied to /usr/share/simp
  - changed rake and gemfiles so pkg:rpm would work


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.4-0
changelog:
  - Fixed an incorrect dependency on /bin/ruby as opposed to /usr/bin/ruby
  - Changed all instances of #!/usr/bin/env ruby to #!/usr/bin/ruby per the
    Fedora packaging guidelines


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added script to upgrade SIMP 6.0.0 to SIMP 6.1.0
  - Removed obsolete scripts
    - hiera_config
    - hiera_upgrade
    - migrate_to_simplib


