# changelog

author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.2-0
changelog:
  - Fixed README typos
    - Cleaned up code
    - Added acceptance tests
    - Added support for `auth_membership`
    - Fixed code regression from d49cf32
      - Thanks for the notification from John Warburton
    - Validated noop message was correct
    - Fixed sort order when checking user lists against the system


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 1.0.4-0
changelog:
  - 1.0.3 was tagged, bumping to 1.0.4
  - Fix addresses https://github.com/onyxpoint/puppet-gpasswd/issues/7
  - Before this fix, users could not specify groups in the system
    GID range, SYS_GID_[MAX,MIN] in /etc/login.defs. Added system_groups
    feature to gpasswd.
  - Added beaker tests to ensure groups can be created within the system range.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.6-0
changelog:
  - Refactored the module to work with Puppet > 5.5.6
    - Puppet 5.5.7 broke the Type/Provider interface in the 'group' type so
      required an emergency refactor


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.3-0
changelog:
  - Validate functionality under Puppet 5
  - Test against Oracle Enterprise Linux
  - Change default state of the acpid package to reference
    `simp_options::package_ensure`, defaulting to `installed`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Fixed bug whereby aide reports/errors were not being sent to syslog.
    AIDE can now be configured to report to syslog, itself.
  - Use FIPS-appropriate hash algorithms when in FIPS mode
  - No longer hide AIDE initialization failures (which are primarily
    configuration errors) when a manifest with the aide class is applied.
  - Improved acceptance tests.
  - Commented out SUSE acceptance test node, as the node configuration
    is broken.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Retain output database upon AIDE database update for SCAP
    Security Guide OVAL check
    xccdf_org.ssgproject.content_rule_aide_build_database


author: Trey Dockendorf <tdockendorf@osc.edu> - 6.1.3-0
changelog:
  - Add `aide::cron_command` to allow user modification.
  - Ensure that the package is explicitly installed before any dependent
    resources.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Ensure that entries in 'at.allow' are not commented out by default
  - Updated the Gemfile to pin to the latest working Beaker


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.0.0-0
changelog:
  - Added ability to select one or more audit profiles.  When multiple
    profiles are selected, their rules are effectively concatenated in
    the order in which the profiles are listed in
    auditd::default_audit_profiles.
  - The following API Changes were made in support of multiple audit
    profiles:
    - $::auditd::$default_audit_profile has been deprecated by
      $::auditd::$default_audit_profiles
    - auditd::config and auditd::config::audit_profiles::simp classes are
      now private.  In the unlikely event that you included just these
      classes in your manifest, you must now include auditd instead.
    - The following auditctl global configuration options that were in
      auditd::config::audit_profiles::simp are now in the auditd class,
      instead: $ignore_errors, $ignore_anonymous, $ignore_system_services,
      and $ignore_crond. They were moved because they are now applied to
      the set of audit profiles selected, not just the 'simp' audit
      profile.
    - The following auditd::config::audit_profiles::simp class parameters
      have been deprecated for clarity:
      - $audit_sudoers has been deprecated by $audit_cfg_sudoers
      - $audit_sudoers_tag has been deprecated by $audit_cfg_sudoers
      - $audit_grub has been deprecated by $audit_cfg_grub
      - $audit_grub_tag has been deprecated by $audit_cfg_grub_tag
      - $audit_yum has been deprecated by $audit_cfg_yum
      - $audit_yum_tag has been deprecated by $audit_cfg_yum_tag
    - Some previously hard-coded, internal configuration is now exposed
      as data-in-modules.
  - Added 'stig' audit profile which manages rules that match DISA STIG
    checks, exactly.
    - For executables explicitly listed in the RHEL7 STIG, includes watchs
      for binaries in the real paths (/usr/bin, /usr/sbin) and linked paths
      (/bin, /sbin). This is to address inconsistencies among the STIG and
      the Inspec and OSCAP scans. (All should use the real paths, but don't.)
  - Fixed bugs in 'simp' audit profile
    - Fixed umask syscall rules.  These rules require arch filters.
    - Fixed clock_settime syscall rules.  Per the sample STIG audit rules
      packaged in the auditd RPM, these rules require an 'a0' filter.
    - Fixed bug in which /var/log/tallylog was grouped with session
      instead of logins.
    - Fixed bug in which the /etc/pam.d watch rule had the wrong tag
  - Updated 'simp' audit profile settings for DISA STIG.
    - Expanded the list of successful syscall operations audited.
    - Expanded the list of module syscall operations audited
    - Added an option to monitor selinux commands, (i.e., chcon,
      semanage, setfiles, setsebool)
    - Added an option to audit the execution of password commands
      ('passwd', 'unix_chkpwd', 'gpasswd', 'chage', 'userhelper')
    - Added an option to audit the execution of privilege-related
      commands ('su', 'sudo', 'newgrp', 'chsh', 'sudoedit')
    - Added an option to audit the execution of postfix-related commands
      ('postdrop', 'postqueue')
    - Added an option to audit the execution of the 'ssh-keysign' command
    - Added an option to audit the execution of the 'crontab' command
    - Added an option to audit the execution of the 'pam_timestamp_check'
      command
    - Added an option to audit the execution of rename/remove operations
      for non-service users (rename', 'renameat', rmdir', 'unlink', and
      'unlinkat')
    - Added watch rules for /etc/hostname and /etc/NetworkManager (for
      centos7) pulled from the sample STIG audit rules packaged in the
      auditd RPM.
    - For executables explicitly listed in the RHEL7 STIG, includes watchs
      for binaries in the real paths (/usr/bin, /usr/sbin) and linked paths
      (/bin, /sbin). This is to address inconsistencies among the STIG and
      the Inspec and OSCAP scans. (All should use the real paths, but don't.)


author: Trey Dockendorf <tdockendorf@osc.edu> - 8.0.1-0
changelog:
  - Allow lowercase values for several parameters in accordance with the man
    pages and SCAP expectations.


author: Brandon Ess <brandon.ess@gmail.com> - 8.1.0-0
changelog:
  - Align group ownership of the auditd log directories with the setting for
    auditd itself so that the designated group can access the log files.


author: Nick Miller <nick.miller@onyxpoint.com> - 8.1.0-0
changelog:
  - Changed the $package_ensure parameter from 'latest' to 'installed'
  - It will also respect `simp_options::package_ensure`


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 8.1.0-0
changelog:
  - Removed unnecessary dependencies from metadata.json.  Now, when users install
    auditd stand-alone i.e. `puppet module install`, they will not have
    extraneous modules clutter their environment.
    - herculesteam/augeasproviders_grub
    - simp/rsyslog


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.1.0-0
changelog:
  - Allow users to opt-out of hooking the audit dispatchers into the SIMP rsyslog
    module using `auditd::config::audisp::syslog::rsyslog = false` or,
    alternatively, setting `simp_options::syslog = false`.
  - Add a `write_logs` opttion to the `auditd_class` and multiplex between the
    `log_format = NOLOG` setting and `write_logs = false` since there were
    breaking changes in these settings after `auditd` version `2.6.0`.
  - Add support for `log_format = ENHANCED` for `auditd` version >= `2.6.0`.
    Older versions will simply fall back to `RAW`.


author: Mark Leary <leary.mark@gmail.com> - 8.1.1-0
changelog:
  - Revert back to using the native service provider for the auditd service since
    puppet fixed the service handling.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Ripped out all NFS materials
  - NFS can now work with the configuration of autofs but there should not have
    been a strong dependency the other way


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Allowed for control of specific versions of the packages in this
    module with two new parameters:
    - samba_package_ensure
    - autofs_package_ensure
  - Support Puppet 5


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.1.2-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - Add package_ensure parameter to use simp_options package_ensure value
    for managing the installation of packages.
    If simp_options is not being used it will default to install (
    previously set to latest)
    If not using simp_options the value  can be changed  by setting clamav::package_ensure
    to latest in hiera.
  - update Gemfile to use puppet ~> 5.0
  - update .rubyversion to 2.4.4


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::action_mail_acct entries
    - Added auditd::config::audit_profiles::simp::audit_sudoers
    - Added auditd::config::audit_profiles::simp::audit_selinux_cmds
    - Added auditd::failure_mode
    - Corrected auditd::enable identifiers


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::config::audit_profiles::simp::audit_session_files
    - Added auditd::config::audit_profiles::simp::audit_session_files_tag


author: Nick Miller <nick.miller@onyxpoint.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Added auditd::config::audit_profiles::simp::audit_crontab_cmd
    - Added auditd::config::audit_profiles::simp::audit_pam_timestamp_check_cmd
    - Added auditd::config::audit_profiles::simp::audit_passwd_cmds
    - Added auditd::config::audit_profiles::simp::audit_postfix_cmds
    - Added auditd::config::audit_profiles::simp::audit_priv_cmds
    - Added auditd::config::audit_profiles::simp::audit_ssh_keysign_cmd


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.4-0
changelog:
  - DISA STIG changes:
    - Updated for pupmod-simp-auditd 8.0.0.  This enforces the
      'stig' audit profile, instead of the 'simp' audit profile.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.4-0
changelog:
  - Change 'sudosh' to 'tlog' to support the switch to supported session logging
    software
  - Added support for Puppet 5 and OEL
  - DISA STIG changes:
    - Added selinux::login_resources
    - Added gdm::settings
    - Added gdm::banner
    - Added gdm::simp_banner
    - Added gdm::dconf_hash
    - Added gnome::dconf_hash


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 2.4.0-0
changelog:
  - Open-Source SCE version 2.0
    - Add bugfix for environments that are just Strings vs Environment objects.
    - Add compliance_markup::loaded_maps() function to return all of the loaded
      compliance data from the puppetserver for debugging
    - Add compliance_markup::telemetry() function to return filenames used to
      load compliance data
    - Add compliance_markup::debug::dump hiera parameter that dumps the cached
      result hash for hiera debugging.
    - Remove pupmod::ca_crl_pull_interval from nist_800_53_rev4.json's since
      the parameter is deprecated.
    - refactor loader to look in:
      - "/SIMP/compliance_profiles"
      - "/simp/compliance_profiles"
      and for backwards compatbility:
      - "/lib/puppetx/compliance"


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.4.1-0
changelog:
  - Fixed the following incorrect parameter types
    - simp::yum::schedule::minute
    - simp::yum::schedule::hour


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 2.4.1-0
changelog:
  - Fix the following keys:
    - simp::mountpoints::tmp::secure
    - simp::root_user::manage_group
    - simp::root_user::manage_perms
    - simp::root_user::manage_user
    - ssh::server::conf::pki


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Removed deprecated audit metaparameter
  - Added basic acceptance test
  - Made sure the cron::user class doesn't use the pam module if pam is false
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 0.1.0
changelog:
  - This module supports adding lists of packages to the catalog after the all
    the manifests have been compiled.  Its purpose is to support policy
    enforcement for the SIMP project and is not meant for general purpose use.


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Prevent log duplication and log where intended.
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $dhcp::dhcpd::package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Remove support for Puppet less than 4.10.4
  - Add Puppet Strings documentation
  - Update badges and contribution guide URL in README.md


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.1.1-0
changelog:
  - The simp_options::fips catalyst did not disable fips; changed enable
    variable to default to simp_options::fips
  - Moved check for OS family from params to init
  - Added package remove for dracut-fips packages if fips is disabled


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Created a work-around for an undocumented issue where /boot is not
    on its own partition but is added to the kernel parameters with
    fips=1. This situation ends up creating a kernel panic on the
    system until the boot= entry is removed from the kernel boot line.
  - Added tests against GCE since that is the default image configuration
    on those systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Including the FIPS module was causing FIPS mode to be enabled by default.
    This had high potential for causing issues, as evidenced by our acceptance
    tests, so we now mirror the 'enabled' state of the module based on whether or
    not FIPS is already enabled on the target system.
  - Update puppet dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Added support for OEL and Puppet 5
  - Add a message to the reboot_notify resource to be more helpful


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.0-0
changelog:
  - Added $dracut_ensure, $fipscheck_ensure and $nss_ensure parameters
    - Changed the packages from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Changed calls to auditd to the new layout (breaking change)
  - Added acceptance tests
  - Ensure GDM starts at boot time on EL7
  - Add notice that two runs are required


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.1-0
changelog:
  - Added the following services on EL7:
    - `display-manager`
    - `upower` - replaced hal, used by gnome
    - `rtkit-daemon` - used by pulseaudio and gdm


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Moved the default banner selection to `simp_banners`
  - Added support for setting dconf options for GDM
  - Moved package list to data in modules for easy merging and overwriting
  - Added acceptance tests that go through the stages of setting up both
    GDM and GNOME for inspection
  - Update version range of auditd dependency in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Updated polkit setting to use the new defined type from the polkit module
  - Added polkit dependency
  - `dconf update` execs now catch failures


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Moved the simp dconf profile below the user profile so users can change
    their own settings in the desktop
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - module was rewritten
    - takes advantage of the data in modules paradigm
    - has a single point of entry
  - packages now default to 'installed' or the package_ensure catalyst
    from simp_options
  - gnome::dconf::add
    - deprecated in favor of gnome::config::dconf
    - this class is now a temporary shim to ensure backwards compatibility
  - gnome::config::dconf
    - allows setting more than one key/value pair (only one could be set
      in dconf::add)
    - class name is not a verb
    - dconf settings controlled by this class can be modified in data,
      including removing default settings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Add libxkbcommon-x11 to required package list for CentOS/RedHat 7.4.
  - Remove unnecessary CentOS data-in-module files.  The OS family fact
    for CentOS is RedHat, so these files are not used.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.0.0-0
changelog:
  - Removed all GDM and Dconf settings - BREAKING
    - Dconf has been moved to its own module
  - Ensure that all settings are 100% GNOME specific
  - Fixed a typo in the `dconf_hash` where `automount-never` was specified
    instead of `autorun-never`
  - Add support for OEL and Puppet 5


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.3.1-0
changelog:
  - Updated module for auto lua spec generation
  - Added missing requires file and added dependency on simplib
  - Modified module to auto-generate lua spec


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.2.0-0
changelog:
  - Fixed permission on incrond service file to clear errors in system log.
  - Updated package to use package ensure to control updates.  This changed the
    default ensure of package to installed from latest.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.0-0
changelog:
  - Added a native type `incron_system_table` to allow for client side glob
    expansion on paths
  - Pushed all validation of parameters off to the native type from
    `incron::system_table`
  - Updated acceptance tests to verify that incron is actually working
  - Bumped the supported puppet version to '< 6'


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Stop managing the systemd unit file, because deviating from the RPM defaults
    violates the STIG
  - Set /etc/incron.d to 0755, the RPM default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.0-0
changelog:
  - Add the ability to set the 'max_open_files' ulimit
  - Add Incron::Mask Data Type denoting valid incron masks
  - Add `incron::purge` parameter to optionally delete all unmanaged files in
    `/etc/incron.d`. This may be enabled by default in the future but is
    currently disabled to preserve the existing functionality.
  - Added support for the new options starting with 0.5.12
    - Automatically strip out options that are not supported by earlier versions
      for seamless backward compatibility


author: Some Dude <7zbayf+sw1l67jjhlbk@sharklasers.com> - 6.1.0-0
changelog:
  - Fixed a bug in the order of the IPTables rules in scanblock module
    - Previously, IPTables would not block connections from banned IPs that
      were accessing open ports.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1
changelog:
  - This commit moves the logic that parses the `iptables::ports` Hash into a
    define, to make it possible to use the same hash format in other modules
    without copying code.
  - There was also a bug where compilation would fail if `proto` was specified in
    the defaults section of the Hash.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1
changelog:
  - Fixed bugs in the chain retention and optimization code that would cause
    iptables to fail to reload in some situations.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.3
changelog:
  - Fix issue where a `jump` target went to an empty ruleset and the chain was
    dropped
  - Retain all native IPTables jump points by default
  - Add `==` method for IPTables Rulesets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5
changelog:
  - Perform deep rule comparison on rulesets that are otherwise identical
  - Remove chances for memory leaks due to the design of iptables_rule
  - Set init script permissions back to the RPM defaults of 0755


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.6
changelog:
  - Changed $package_ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3-0
changelog:
  - Removed the static banners from the module and tied the module to the
    `simp/simp_banners` module
  - Add support for OEL and Puppet 5


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Update static assets
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Fix most of the puppet strings problems
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.3-0
changelog:
  - Allow users to modify the owner, group, and mode of files that may be used by
    multiple subsystems


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.4-0
changelog:
  - Changed the packages from 'latest' to 'installed'
  - Ensure parameters will also now respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.2-0
changelog:
  - Bug fixes:
    - Set up FIPS-compliant configuration, not just when
      simp_options::fips is true, but also when the server is already
      in FIPS mode.
    - Insert token password into the NSS database after configuring
      the NSS database for FIPS.
  - Updated the tests.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.1-0
changelog:
  - Strongly typed module
  - Moved docs to strings/yardoc format
  - Removed verb from vm_create class to vm


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Use kmod::load instead of ruby script for loading the kernel module
  - Modernize some code
    - Moved all parameters to init.pp while also
      maintaining previous functionality
  - Spec test cleanup
  - New acceptance test (no nested virtualization)
  - Corrected some documentation and examples


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Added a `libvirt_br_netfilter_loaded` fact to determine if the `br_netfilter`
    kernel module is loaded on the target system
  - Documentation update
  - Data in modules update
  - Use `ensure_packages` for package installation
  - Fully decouple `libvirt::ksm` from the main `libvirt` class
  - Add support for Puppet 5 and OEL


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Added lastaction logic to logrotate::rule.
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.1-0
changelog:
  - Updated the defaults  settings for compress, rotate and dateext in rule.pp
    to pull values from init.pp. (They were hard coded to them before)
  - changed templates to add nodateext if dateext is set to false.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Move SIMP-specific logrotate rules to a SIMP-managed configuration
    directory, /etc/logrotate.simp.d, and ensure logrotate processes
    that directory first. This ensures SIMP rules take priority, when
    duplicate rules are specified.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added OEL and Puppet 5 support
  - Add some previously impossible to configure options
    - the hourly rotate period
    - dateyesterday
    - shred and shredcycles
    - su and su_user and su_group (inapplicable on EL6)
  - Added Logrotate::Periods type alias which allows hourly rotation


author: Maintenance
changelog:
  2.0.0-4
  - Created a Cucumber test to ensure that firefox installs correctly
    and is at the latest version when including mozzila in the puppet
    server manifest.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Added $package_ensure parameters to mozilla::firefox and mozilla::thunderbird
    - Changed the package from 'latest' to 'installed'
    - Each package ensure parameter will also respect `simp_options::package_ensure`
    - Removed the architecture qualifier from the name of each package resource


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed the module
  - Made chrooting logic less complicated
  - ALL of the spec tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.3-0
changelog:
  - Provide override file for named-chroot.service instead of
    modifying the vendor-provided service file.
  - Use simplib::assert_metadata() for OS validation
  - Replace Puppet3 version of passgen() with  simplib::passgen()


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed $named::install::ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.2-0
changelog:
  - Ensure that no calls to 'function_defined' are present in any templates for
    Puppet 4 compatibility


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Strong typing w/new IP types
    - All parameters that were 'yes' or 'no' are now optional booleans
  - Removed most validation from templates
  - Added more tests for all manifests
  - Cleaned up regex in the careful restart script


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Added management of bind-utils and bridge-utils
    - Packages in this module now use the package_ensure catalyst
  - Update puppet requirement in metadata.json


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.0.3-0
changelog:
  - Static asset updates for puppet 5
  - Update badges and contribution guide URL in README.md
  - Update to onyxpoint OEL boxes in acceptance tests


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - gssproxy ensured running when secure_nfs is true, el > 7.1
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed all stunnel connections to use 'stunnel::instance' methods so that
    they are not interrupted by an issue with the global stunnel configuration
    and they can set the TCP_NODELAY option as suggested for small transaction,
    high bandwidth connections.
  - Added parameters to allow users to tweak the stunnel socket options for all
    NFS stunnel connections.
  - Added support for OEL and Puppet 5


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - On systemd systems, the stunnel service is now a dependency of the NFS
    servers and mounts managed by this module.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Added `nfs::client::mount::autodetect_remote` to override all autodetection
    of whether or not the remote host was the current NFS server so an NFS
    server can mount NFS directories from other servers.
  - Added `nfs::client::mount::stunnel` to allow users to dictate the stunnel
    connection state for specific mounts.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - Update systemd fixtures and CI assets
  - Add logging for exportfs failures
  - Ensure that reexports happen after the NFS service has been started


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Added OEL and Puppet 5 support
  - Change rpcbind service name on EL7 from `rpcbind.socket` to,
    `rpcbind.service`, but only on EL7.4+
  - Changed all packages ensure parameter from 'latest' to 'installed'
    - They also respect `simp_options::package_ensure`
    - Added $nfs::install::tools_ensure and $nfs::lvm2::ensure


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - Update static assets for puppet 5
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Manage ntpdate via `ntpd::ntpdate`
    - Manage `/etc/ntp/step-tickers`
    - Manage `/etc/sysconfig/ntpdate`
      - New params ntpdate_sync_hwclock, ntpdate_retrym and ntpdate_options should
        cover all options from RedHat
      - `SYNC_HWCLOCK=yes` is now set here instead of `/etc/sysconfig/ntp`
  - Add `$package_ensure` parameter to control the `ntp` package version
  - Move some multiline strings into variables (style recommendation)
  - The module now only requires one puppet run to apply completely
  - Added essential-level acceptance test


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Fixed bug in which ntpd::ntpd_options was not applied to ntpd::servers
    when ntpd::servers is an array.


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Added $package_ensure and $oddbob::mkhomedir::package_ensure parameter
    - Changed the packages from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick-simp@gmail.com> - 2.1.0-0
changelog:
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.3-0
changelog:
  - Changed Openscap::Profile type to use regex match on profiles rather than the Enum.
  - Added hieradata to module to specify scap_profile and ssg_data_stream based
    on OS (RedHat 6, RedHat 7, CentOS 6, and CentOS 7)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Added an `oscap` fact for gathering the following information:
    - OpenSCAP Version
    - OpenSCAP Supported Specifications
    - SCAP Profiles from /usr/share/xml/scap/*/content/*-ds.xml
  - Added logic to ensure that a valid profile is chosen based on the new fact
  - Added unit and acceptance tests
  - Updated data to reflect valid choices on a default EL6 load


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Add package_ensure parameters to packages managed by this modoule
    - $scap_ensure - openscap-utils
    - $ssg_ensure - scap-security-guide
  - Add missing $scap_tailoring_file parameter to openscap::schedule


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Replace authconfig and authconfig-tui links to a no-op script, instead
    of removing them.  This does not break tools that use authconfig.
  - Use simp_options::package_ensure, when available


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.2.0-0
changelog:
  - Update the pam::unlock_time parameter to accept 'never' as a value per the
    man page and in accordance with the DISA STIG


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.1-0
changelog:
  - Allow users to change the password hash algorithm
  - Allow users to enable/disable enforcing password policies for `root`
  - Update compliance tests to work with inspec profiles and compliance engine
    enforcement.


author: Jeanne Greulich <jgreulich.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - Global catalyst updates
  - Strong Type updates
  - Changed default for pki directory to /etc/pki/simp from /etc/pki


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed pki::pki_dir parameter to pki::base_dir
  - Updated acceptance tests
  - Fixed bugs in ordering


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Set perms on simp_apps to 644/755; apps were being denied access to
    their own certs because they could not access /etc/pki/simp_apps.
  - We have made the decision to centralize application certificates
    when simp is managing pki (simp_options::pki => true or 'simp').
    This update re-tools pki::copy to better handle managing certs
    in /etc/pki/simp_apps.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed default location of keydist certs from the files directory of the pki
    module unless $pki is set to 'simp', when it will pull from pki_files in a
    different module path instead.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - SIMP certs are now managed in /etc/pki/simp/x509, and application
    certs in /etc/pki/simp_apps/<app_name>/x509.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.2-0
changelog:
  - Ensure that /etc/pki/simp_apps is recursively purged so that old certificates
    are not left on the system
  - Adds a new param, `$certname`, that controls the name of the certs in keydist
    that will be copied over. This used to be set to `$facts['fqdn']` without an
    option to change it, now it will default to `$trusted['certname']`


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - pki::copy's source parameter now accepts any string to allow for use of NSS
    and remote file sources.
  - Cleanup unneeded fixtures
  - Update version range of auditd dependency in metadata.json


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored manifests to pass all lint tests for puppet 3 and hiera compatibility.
  - Added spec tests.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Add EL7 and polkit 106+ support by allowing javascript rules
    - Added define to allow for easy placement of custom rules
    - Added templated define to ease generation of basic rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Allow default identity and identities prefixed with unix-netgroup.
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.2-0
changelog:
  - Removed `audit` metaparameter
  - Implemented `package_ensure` catalyst
  - Cleaned up some code formatting
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.1.0-0
changelog:
  - Added main_cf_hash parameter so a list of additional settings for main.cf
    file can be added without the need for entering a resource for each one.
  - Added the smtpd_client_restrict entry to main.cf per the STIG.
  - Updated simpcat to concat.
  - Rearranged code into sub-classes to make it easier to follow.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/postfix/* perms from 0640 to 0644
    - /usr/libexec/postfix management is no longer recursive
    - /var/spool/mail perms from 0755 to 0775
  - Cleanup unneeded fixtures and update CI assets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.2.0-0
changelog:
  - Ensure that only IPv4 is used if IPv6 is disabled on the system
  - Add support for OEL and Puppet 5


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 5.2.0-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 7.6.1-0
changelog:
  - Cleanup unneeded fixtures and update CI assets
  - Remove unused simp/tcpwrappers and simp/logrotate dependencies


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.1-0
changelog:
  - Fixed the new `simp_generate_types` script to ensure that the permissions on
    the created directory are correctly set.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.6.1-0
changelog:
  - Fixed bug in which the JAVA tmpdir path for the puppetserver was
    incorrectly set.  This could cause puppetserver RPM upgrades to fail.


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 7.7.0-0
changelog:
  - Unconditionally manages the puppet service
  - Remove the (apparently) broken status logic on the puppet service


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.7.0-0
changelog:
  - Add `ensure` parameter to `pupmod::conf``
  - Ensure that `trusted_server_facts` is removed for Puppet 5.+ (PUP-6112)


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.7.0-0
changelog:
  - Remove deprecated `[master] ca` setting when `ca = true` in Puppet 5.5.6+
  - Remove `[master] ca` setting in Puppet 6+
  - Update badges and contribution guide URL in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.7.0-0
changelog:
  - Fix warning about automatic data type munging in the puppet server sysconfig
    template
  - Add workaround for Puppet 5 background exec issue to the generate_types exec


author: Brandon Riden <brandon.riden@onyxpoint.com> - 7.7.1-0
changelog:
  - Set pupmod::master::generate_types: enable => false by default to fix
    bug causing puppet servers to crash.
    - pupmod::master::extra_webserver_sections


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.8.0-0
changelog:
  - Fixed issues with incron rules and the simp_generate_types calls.
    - This was mostly due to bugs in the newer version of incrond. However, this
      module is now extensively tested for safety but will only trigger type
      generation on environment creation or updates to the puppet binaries.
  - Fix bug where some SSL settings could not be set for the puppet server
    `webserver` components.
  - Added the following *advanced usage* parameters in case users need to set
    parameters that are not presently managed to work around future issues:
    - pupmod::master::server_webserver_options
    - pupmod::master::ca_webserver_options


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Most of this content was from simplib
    - The dns autoconfiguation content was moved to a profile in simp/simp
  - First cut


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.1.0-0
changelog:
  - Improve validation for resolv.conf parameters
  - Add type aliases, epp with typed parameters
  - Update data types in init.pp parameter list (backwards compatible)
    - NOTE: The data type for the parameters `$resolv::servers` and
      `$resolv::search` has changed from `Simplib::Netlist` to Arrays with more
      specific requirements.  This has not been considered a breaking API change,
      since the original data types were too permissive and non-valid data would
      have either been ignored or broken name resolution.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Fixed minor bug in rsync provider that caused  'Unknown failure
    using insync_values?' Puppet message to be generated.


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.0.6-0
changelog:
  - Add `order => 'numeric'` setting to concat for rsyncd.conf
  - Add support for Puppet 5
  - Add support for and OEL


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in README.md


author: ralph-wright <ralph.wright@onyxpoint.com> - 7.2.0-0
changelog:
  - Remove all ActionSendStreamDriver* directives from the global
    configuration, to allow individual actions to control their specific
    stream settings.  This change was required to allow a host which is
    itself a syslog server to receive TLS-encrypted data, but forward
    these messages to a different remote syslog server as unencrypted data.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Reinstated ActionSendStreamDriverMode directive into the global
    configuration when sending TLS-encrypted messages for Rsyslog
    7 version, only. The sending of TLS-encrypted messages for CentOS 6
    will not work otherwise.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Fixed a bug in which removal of a rsyslog::rule from the catalog
    did not cause the rsyslog service to restart, when other rules
    corresponding to files in the same rsyslog configuration
    subdirectory were present.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.3.0-0
changelog:
  - Updated the tests to no longer reference sudosh as our custom test since we
    are moving away from using it and it could cause confusion.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> 7.3.0-0
changelog:
  - Updated rsyslog::rule::remote to select a more intelligent default
    for StreamDriverPermittedPeers, when TLS is enabled.  This improvement
    fixes the bug in which forwarding of logs to servers in different domains
    was not possible with the stream_driver_permitted_peers default.  Now,
    rsyslog::rule::remote::stream_driver_permitted_peers defaults to 'undef',
    instead of the domain of the Puppet client, and has the following default
    behavior:
    - When all of the remote servers are specified with hostname variants, the
      StreamDriverPermittedPeers directive for the forwarding action for each
      server will be set to that server's hostname.
    - If any of the remote servers is specified as an IP address variant, the
      StreamDriverPermittedPeers directive for the forwarding action for
      each server will be set to the domain of the Puppet client.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.3.0-0
changelog:
  - Fixed a bug in the systemd override file for rsyslog
  - Added fact for version of rsyslogd
  - Updated templates to use RainerScript rsyslogd v8 and later
  - Fixed the MainMsgQueueDiscardMark and MainMsgQueueWorkerThreads
    parameters


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.3.0-0
changelog:
  - Added logic to properly handle rsyslogd parameters for V8.6 and later
    as documented in CentOS 7.5 Release notes.  These include moving -x and -w
    options to global.conf and issuing deprecation warning for -l and -s
    options.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.3.0-0
changelog:
  - Changed rsyslog::install::ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.1.0-0
changelog:
  - Fixed a bug wherein setenforce would run if selinux was disabled
  - Changes in selinux state incur a reboot notification


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Moved management of mcstrans and restorecond to the selinux module
  - Change default packages ensure to use the catalyst
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.1.0-0
changelog:
  - Rework manifests to ensure mcstrans and restorecond services are not
    running when selinux is disabled.
  - Allow this module to manage restorecond package installation.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 2.2.0-0
changelog:
  - simp_options::selinux was supposed to indicate if the selinux module should
    be included. Class include lists set in the simp module would include selinux
    regardless of this setting.  This option was also being used to set the state
    of selinux.  This caused confusion so  simp_options::selinux setting was
    removed.  The selinux state, set by the ensure parameter, is defaulted to
    'enforcing'.  This will result in the same behavior as if simp_options::selinux
    was set to true.  See the pupmod-simp-simp module to see which scenarios
    include selinux by default.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.0-0
changelog:
  - Adds a `selinux_login` custom type that provides for the management of login
    to user role mappings.
  - Incorporated the fork of the `voxpupuli-selinux` module as `simp-vox_selinux`
    without conflict
  - Add support for OEL and Puppet 5
  - Fix bug with enforcement switching in the native type


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.5.0-0
changelog:
  - Created standalone SIMP client bootstrap script, bootstrap_simp_client.
  - Created simp::server::kickstart::runpuppet replacement,
    simp::server::kickstart::simp_client_bootstrap, that manages service
    files for kickstarting a SIMP client, using bootstrap_simp_client
    and either a sysv (simp_client_bootstrap) or a systemd
    (simp_client_bootstrap.service) service script. This replacement
    provides the following improvements:
    - Exponential backoff of requests to the Puppet server, to minimize
      Puppet server overload.
    - Configurable bootstrap timeout.
    - An option to force a client reboot on client bootstrap failure.
    - More effective puppet agent processing.  The bootstrapping
      takes fewer puppet agent runs.
    - Finer grained control of the bootstrap algorithm.
    - Error handling
      - Bootstrap operation errors are now detected and logged.
      - Failed puppet agent runs are now retried, instead of blindly
        continuing on.
    - Timestamped log messages in the bootstrap log file.  This includes
      messages from bootstrap_simp_client, puppet agent, and fixfiles.
      service start
  - simp::server::kickstart::runpuppet is deprecated and will be removed
    in a future release


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 4.5.0-0
changelog:
  - Add Windows support
  - Change /root perms to RPM default of 0550
  - Change /etc/rc.d/rc.local perms to RPM default of 0755


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.5.0-0
changelog:
  - Use the sudo::user_specification default host list which is correct for
    almost all cases
  - Update version range of auditd dependency in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 4.6.0-0
changelog:
  - Added tests and support for OEL and Puppet 5
    - Setting the default filebucket in a module no longer works, so
      ``simp::enable_filebucketing`` will do nothing in puppet version >= 5
  - Fixed some linting issues


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.6.0-0
changelog:
  - Switch from using 'sudosh' as the default logging shell to using 'tlog'
  - Add a 'simp::admin::default_admin_sudo_cmnds' option to allow users to easily
    change the default sudo-accessible commands from Hiera.
  - Ensure that the global filebucket setting occurs prior to class inclusion to
    match the new Puppet 5 method of setting resource defaults.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.6.0-0
changelog:
  - Fix a usability bug in which simp::server::kickstart did not allow
    the bootstrap scripts provided by simp::server::kickstart::runpuppet
    and simp::server::kickstart::simp_client_bootstrap to be configured
    via hieradata, when those classes were managed by simp::server::kickstart.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.6.0-0
changelog:
  - Added $simp::server::yum::createrepo_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Fixed dependency logic with mod_ldap to not install it on CentOS 7
  - Rsyslog calls no longer include implied logic
  - Rsync now calls the correct share


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.1-0
changelog:
  - Create namespaced, Puppet 4 versions of externally-used Puppet 3
    functions and mark the Puppet 3 functions as deprecated. They will
    be removed in a later release.
  - apache_auth should be replaced with simp_apache::auth
  - apache_limits should be replaced with simp_apache::limits
  - munge_httpd_networks should be replaced with simp_apache::munge_httpd_networks
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - set owned to simp_apache::user instead of simp_apache group on
    configuration files.
  - remove simpcat as dependency
  - cleaned up fixtures file


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Update systemd fixtures and CI assets
  - Update version range of auditd dependency in metadata.json


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.1.0-0
changelog:
  - Updated $app_pki_external_source to accept any string.  This matches the functionality
    of pki::copy.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $package_ensure parameters to simp_apache::install
    - $httpd_ensure  $mod_ldap_ensure  $mod_ssl_ensure
    - Changed the package from 'latest' to 'installed'
    - Each ensure parameter will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Wrap puppetlabs/docker to:
    - Provide SIMP defaults
    - Add ease-of-use for using different distributions of Docker
  - Document how to set up simp/iptables to ignore docker-generated rules


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Ensure that the docker_group and socket_group options are the same by default
    for the 'redhat' release type


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Update to puppetlabs/docker 1.0.5
    - Remove deprecated `manage_epel` parameter
  - Removed $iptables_docker_chain by default
    - The simp/iptables module has been updated so that this is not needed


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.1
changelog:
  - Update to puppetlabs/docker 1.1.0
    - $selinux_enabled changed from taking string to only taking booleans, 
      breaking the hiera interpolation trick that was used to set that parameter
      to the selinux status of the system.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Added a workaround to a long standing bug in puppetlabs/beaker that adds a
    'docker' user with the same gid as 'dockerroot' if it doesn't exist.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.3.0
changelog:
  - Drop support for CentOS 6 in order to cleanly solve an intermittent
    problem in which the GitLab local user's authorized keys lock file
    could not be created.
  - Modify sshd authorized keys file configuration so that the GitLab
    installer can manage the GitLab local user's authorized keys file
    and the directory in which it resides, independent of Puppet.
    Prior to this, both the GitLab installer (via Chef) and Puppet
    were simultaneously, but independently, managing the ownership,
    permissions, and selinux contexts of that authorized keys file
    and its directory.  Since the desired settings for the directory
    were different, intermittent problems such as the GitLab user
    not being able to create its authorized keys lock file arose.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.1
changelog:
  - Updated README to note that authorized key files need to be copied
    when upgrading from version 0.2.0.


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Update to latest Grafana (4.2.0) and Elasticsearch (5.4.0)
  - simp_grafana::version now defaults to 'latest'
  - Confine puppet version in metadata.json


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Workaround 2-pass grafana rpm install issue in acceptance tests
  - Update README to reflect SIMP 6 global catalysts.


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.5-0
changelog:
  - Update upper range of puppet/grafana module dependency to < 5.0.0
  - Update README to include section on rubygem-puppetserver-toml


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.6-0
changelog:
  - Fix bug in resource ordering of pki::copy and grafana::service
  - Use simplib::passgen() in lieu of deprecated passgen()
  - Update badges and contribution guide URL in README.md


author: Jeanne Greulich <jgreulich@onyxpoint.com> - 3.0.0-0
changelog:
  - Update major version release for SIMP 6
  - Removed stunnel and replaced it with TCP TLS input
  - Added TLS enabled JSON input
  - Updated tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Updated to LogStash 5.X and Elasticsearch 5.X
  - Fixed type bug in simp_logstash::output::elasticsearch::action.
  - Fixed enum typo in enum for simp_logstash::output::elasticsearch::script_type
  - Fixed puppet strings problems.
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.2
changelog:
  - Added the ability to override ciphers in the create_home_directories script
    for EL6 since the cipher order does not happen from strongest to weakest and
    breaks secure LDAP connections
  - Added a check for create_home_directories to ensure that directories are not
    archived if the server doesn't respond for TLS reasons.


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.0.3
changelog:
  - Updated create_home_directories to handle multiple URIs
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.5
changelog:
  - Allow users to properly disable autofs
  - Added parameter, autodetect_remote, that allows users to disable the logic
    that determines if system is an NFS server and mounts directories locally.
    This allows the mounting of home directories to another NFS server.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Add support for Puppet 5 and OEL
  - Upped stdlib dep to support version 5
  - Add reference.md
  - Added $simp_nfs::create_home_dirs::package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Per CVE-2014-3566, SSLv3 and TLSv1 ciphers should be disallowed. Recent-ish
    updates to openldap-servers, shipped with SIMP-6.0.0-0, includes a parameter
    to specify a minimum bound of TLS protocol in slapd.conf, TLSProtocolMin.
    (see https://access.redhat.com/solutions/1234843)
  - This commit includes puppetry to remove TLSv1.0, SSLv3, and SSLv2 from the
    TLS cipher suites, and set a minimum TLS protocol of TLSv1.2, given
    openldap-servers is >= 2.4.40.
  - Updated syncdn and binddn defaults in server::conf


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Fixed an issue where pki::copy was not correctly hooked into the server logic
    and a system PKI update would not properly propagate into the OpenLDAP
    service restart.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1-0
changelog:
  - Update to support Puppet 5 and OEL
  - Update systemd fixtures and CI assets
  - Fix acceptance test by not testing text of failure code, only the exit code
  - Remove unneeded simp/auditd dependency


author: Mark Fitch <CodePhase@users.noreply.github.com> - 6.2.1-0
changelog:
  - Ensure that the `concat` statement for `access.conf` is sorted in `numeric`
    order for consistency.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added the following package ensure parameters
    - $simp_openldap::client::openldap_clients_ensure
    - $simp_openldap::client::nss_pam_ldapd_ensure
    - $simp_openldap::slapo::lastbind::lastbind_ensure
    - $simp_openldap::slapo::ppolicy::ppolicy_ensure
  - Changed the defaults for all package ensures from 'latest' to the following:
    - `simp_options::package_ensure` when that parameter is present
    - 'installed' otherwise
  - Require Puppet versions greater than 4.10.4, and don't test on it
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 1.0.1-0
changelog:
  - Added more strict Puppet and PE requirements, pinning to Puppet 4.7+ and
    PE 2016.4.0+
  - Updated openssl::cipher_suite to be set to the fips_ciphers fact if it's
    available to expand the 'FIPS' shortcut, which causes issues with some
    applications (openldap)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.0-0
changelog:
  - Added simp_options::uid and simp_options::gid classes for ID limit
    consistency across the entire infrastructure


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.2.0-0
changelog:
  - Removed simp_options::selinux.  Conflicts between this setting
    and what was in the scenario class lists was causing unexpected results.


author: SIMP Team <simp-project.com> - 0.0.1
changelog:
  - This is the initial code for a `simp_pki_service` module, which is a
    SIMP-oriented installation of the Dogtag Certificate System.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Fix bug whereby audit logs were not being forwarded to remote syslog servers.
  - Fix bugs whereby simp_rsyslog::log_collection and simp_rsyslog::log_openldap
    parameters were overriding simp_rsyslog::default_logs instead of being merged.
  - Work around rsyslog inconsistent message parsing behavior that prevented
    iptables logs from being written to iptables.log and/or being forwarded,
    for some versions of rsyslog.
  - Ensure local audispd log messages are not duplicated.
  - Adjust local rule ordering to ensure local sudosh and apache (httpd)
    log messages are written to their own log files.
  - Restore writing of local puppet and puppet-server messages to their
    own files, by adjusting local security rsyslog rule from simp_rsyslog::local.
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.0-0
changelog:
  - Remove redundant rules for sudosh since the puppet module will correctly take
    care of adding those rules
  - Add support for tlog since it will be commonly replacing sudosh across the
    SIMP infrastructure


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.0-0
changelog:
  - Update simp_rsyslog::forward to allow configuration of the
    StreamDriverPermittedPeers directive in the forwarding rule actions
    for the remote rsyslog servers.  This allows the user to set the correct
    StreamDriverPermittedPeers value, when the default value is incorrect
    (e.g., when IP addresses are used in simp_rsyslog::log_servers or
    simp_rsyslog::failover_servers and one or more of those servers
    is not in the same domain as the client).


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Removed hardcoded strings
    - Make directory where logs are gathered configurable
    - Also make rules that organizes them configurable
  - Update systemd fixtures and CI assets
  - Add support for Puppet 5 and OEL
  - Use iptables module in acceptance tests instead of hand generated rules


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - Updated the concat_output and fragmentdir functions to properly
    handle String/Array conversions in Ruby 2.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed from using Puppet[:vardir] to Facter.value(:puppet_vardir), which
    accounts for the different vardirs on agent and server.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.0-0
changelog:
  - Added a function `module_exist` that will return whether or not a module
    exists in the current environment.
  - Fixed an issue in the 'runlevel' provider where the actual runlevel would not
    be changed at execution time


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.1-0
changelog:
  - Added timeout for changing runlevels based on issues discovered in the field
  - Fixed bugs in the EL6 runlevel persistence where, in some cases, the runlevel
    line might not get written to /etc/inittab


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.11.0-0
changelog:
  - Added a function `assert_optional_dependency` that allows users to fail if
    expected functionality is not present in the current environment's module
    set. This provides the ability for users to support multiple vendor modules
    without forking.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.11.0-0
changelog:
  - Fixed a bug in the `puppet_settings` fact where settings from all sections
    were interpolated using settings (like `$vardir`) from the `[main]` section.


author: Daniel Henninger <daniel@vorpalcloud.org> - 3.11.1-0
changelog:
  - Fixed bug where uid_min would throw errors under operating systems
    without /etc/login.defs.
  - Fixed bug where simplib_sysctl would throw an undefined method error
    on non-Linux OS's.  (both those with sysctl (MacOS X) and without (Windows))
  - Both patches of which were improved by Trevor Vaughan <tvaughan@onyxpoint.com>.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.11.1-0
changelog:
  - Fix reboot_notify tests
  - Ensure that reboot_notify updates resources based on a modified 'reason'
  - Fix the ipaddresses tests
  - Add better confinement on boot_dir_uuid
  - Add a docker nodeset
  - Add test for catching facter errors
  - Bumped the minimum version of Puppet to 4.10.4


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.12.0-0
changelog:
  - Add support for fs.inotify.max_user_watches to
    simplib::validate_sysctl_value()
  - Fix bug in simplib::assert_metadata where it could not be disabled
    - Thanks to Adam Hagen for filing the proposed patch in JIRA
  - Add a 'defined type' lookup capability, `simplib::dlookup` that provides a
    consistent method for retrieving defined type parameters from Hiera in an
    opt-in manner.
  - Fixed various YARD documentation issues


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.4.2-0
changelog:
  - Added some variables for sshd_config to meet STIG requirements.
    Most are just confirmation of defaults with the exception of
    ClientAliveInterval and ClientAliveMaxCount which have
    been set to activate Client Alive checks.
  - Added compliance tests to install setting from compliance
    markup module and then run inspec tests to check for compliance.
  - Update version range of auditd dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.3-0
changelog:
  - By default, do not specify the obsolete RhostsRSAAuthentication
    configuration parameter in sshd_config on systems running openssh 7.4
    or later.  Beginning with openshh 7.4, sshd emits an error message when
    this parameter is present in sshd_config.


author: Bryan Howard <bryan@alumni.caltech.edu> - 6.4.4-0
changelog:
  - PermitRootLogin accepts more values than 'yes' and 'no'. Add
    support for 'without-password', 'prohibit-password', and
    'forced-commands-only'.
  - It was not possible to set PasswordAuthentication to 'no'
    because the conditional treated false the same as undef, which are
    intended to be different.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.4-0
changelog:
  - Added a Ssh::PermitRootLogin data type
  - Updated tests
  - Added a check to fail on EL6 if 'prohibit-password' is set since it is not
    allowed on that platform.


author: Zach <turtles.be.the.best@gmail.com> - 6.5.0-0
changelog:
  - Altered 00_default_spec.rb to stop deleting all ssh keys in test
  - Replaced puppet_environment with puppet_collection in nodesets


author: Nick Miller <nick.miller@onyxpoint.com> - 6.5.0-0
changelog:
  - Added the following package ensure parameters
    - $ssh::client::package_ensure
    - $ssh::server::server_ensure
    - $ssh::server::ldap_ensure
  - Changed the defaults for all package ensures from 'latest' to the following:
    - `simp_options::package_ensure` when that parameter is present
    - 'installed' otherwise


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.5.1-0
changelog:
  - Add ssh_host_keys fact to gather configured `hostkey` values
    from sshd
  - Loop through all hostkeys and manage permissions for security and
    compliance


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.2-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/sssd/ owner is no longer managed
    - /etc/sssd/ perms went from 0640 to 0711
    - /etc/init.d/sssd went from 0754 to 0755 on EL6
  - Update version range of auditd dependency in metadata.json
  - Cleanup requires in metadata.json
  - Cleanup unneeded fixtures and update CI assets


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.1.3-0
changelog:
  - Added ldap_use_tokengroups, ldap_group_objectsid, ldap_user_objectsid to sssd::provider::ad
  - Updated required version of puppetlabs-stdlib to 4.19.0 since fact function is used


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.3-0
changelog:
  - Fixed a bug in which the ldap_account_expire_policy setting
    for the LDAP provider could not be configured to use the system
    default. Now, when sssd::provider::ldap::ldap_account_expire_policy
    is set to '', that configuration parameter will not be written
    to the sssd configuration file. This allows the system default to
    be applied.
  - Fixed a bug in which any boolean setting for the LDAP provider
    configuration could not be configured to be 'false'.
  - Fixed bugs in which sssd::provider::ldap::debug_timestamps and
    sssd::provider::ldap::ldap_search_timeout were erroneously typed to
    be strings, instead of a Boolean and an Integer, respectively.
  - Fixed bugs in which ad_enable_dns_sites, ad_enable_gc settings,
    dyndns_update, dyndns_update_ptr, krb5_use_enterprise_principal,
    and ldap_idmap_autorid_compat settings for the AD provider could
    not be configured to be 'false'.
  - Fixed bugs in which ad_gpo_map_interactive, ad_gpo_map_remote_interactive,
    ad_gpo_map_network, ad_gpo_map_batch, ad_gpo_map_service, ad_gpo_map_permit
    and ad_gpo_map_deny settings for the AD provider were incorrectly formatted.
  - Fixed a bug in which the dyndns_iface setting for the AD provider was not
    set from sssd::provider::ad::dyndns_ifaces.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.3-0
changelog:
  - Changed $sssd::install::package_ensure from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.4-0
changelog:
  - Generated a REFERENCE.md
  - Set the 'min_id' settings across the board to '1' to match the sssd defaults
    since they really have nothing to do with the target system's relationship
    with a centralized authentication service.
  - Update the sssd::provider::ldap::ldap_access_order parameter to support the
    ppolicy related options that were added in sssd 1.14.0
    - ppolicy
    - pwd_expire_policy_reject
    - pwd_expire_policy_warn
    - pwd_expire_policy_renew


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5-0
changelog:
  - Change the sssd::provider::ldap::ldap_access_order defaults to
    ['ppolicy','pwd_expire_policy_renew'] by default to prevent accidental system
    lockouts on upgrade.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Isolated the 'instance' logic away from the 'connection' logic
  - Added a private 'monolithic' class that arranges everything properly for the
    legacy stunnel connections
  - Ensure that 'instances' and 'connections' do not conflict by using a
    'reserve_port' class
  - Add a native type that will clean up all instances that would be randomly
    created by the 'stunnel::instance' defines and will come before both legacy
    and new stunnel connections so that we do not have random left over services
    that may conflict with new services


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0
changelog:
  - Fixed bug in which the stunnel systemd pre-exec script failed to
    execute completely, because one command did not have a fully
    qualified path.
  - Reworked stunnel systemd pre-exec scripts to only emit error
    messages when errors have occurred.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Ensure init.d script is absent if systemd system because puppet
    was finding it and running it and setting permissions on root to
    stunnel:stunnel.
  - Ensure pid file name is not left undefined to prevent unplanned results.
  - Added check to make sure chroot has not evaluated to '/'.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.1
changelog:
  - Added two new parameters to the stunnel::instance define:
    - systemd_wantedby: sent to the WantedBy systemd unit install directive
    - systemd_requiredby: sent to the RequiredBy systemd unit install directive
    - These should allow ordering during boot. For example, if you have NFS set up
      over stunnel, you want stunnel to start before NFS.
  - Fixed the systemd startup scripts to properly pre-create the PID directory if
    required


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.3.2
changelog:
  - Updated selinux settings in acceptance tests to reflect removal of
    simp_options::selinux setting and use selinux::ensure setting.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.2
changelog:
  - Fix the service name used by stunnel so that tcpwrappers would not
    incorrectly drop connections.


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.3.3
changelog:
  - Add support for Puppet5
  - Clean up acceptance tests to use facts for hostname, domain
  - Update badges and contribution guide URL in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0
changelog:
  - Add ability for users to override stunnel::connection and stunnel::instance
    options either globally or by specific identified instance.
  - Fixed stunnel::connection and stunnel::instance template bugs
    - sni is not applicable on EL6
    - retry is only applicable when exec is specified and
      needs to be translated from a boolean to 'yes'/'no'
    - session is only applicable on EL6


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.1-0
changelog:
  - Fixed the validation command on the concat resource to actually validate the
    temp file prior to putting it in place


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.0.6-0
changelog:
  - Added minimum size for sudo::user_specification::hostlist, because an
    empty list is not permitted.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Replaced all references to 'sudosh' with 'su' to reduce future confusion as
    we move away from using sudosh.


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 5.1.0-0
changelog:
  - Added support for Puppet 5 and OEL
  - Modified uspec template to handle the RedHat OS family instead of just RHEL
    or CentOS


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.1-0
changelog:
  - Fix bug whereby svckill provider's insync_values? emits
    'Unknown failure' message during normal operation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.4-0
changelog:
  - Fix bug in which svckill provider can fail on a server for which
    there are are no aliased, SystemD services.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.6-0
changelog:
  - Add simp_client_bootstrap service to the ignore list.  If this
    is omitted from the ignore list, svckill will kill the bootstrap
    process of SIMP clients, while they are boostrapping the system.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.3.0-0
changelog:
  - Added Redhat 7.5 services to default service ignore list.
  - Updated ruby version to 2.4.4
  - Updated Gemfile to ask for puppet 5
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.2-0
changelog:
  - Updates the metadata to support Puppet 5 and Oracle Linux
  - Migrates acceptance tests to suites
  - Adds OEL nodeset
  - Update module assets
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onypoint.com> - 6.1.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added support for UEFI PXEboot.
    - Added tftpboot::linux_model_efi.
      Added tftpboot::assign_host_efi.
    - Tested primarily on CentOS 7 (grub2). Testing of CentOS 6 UEFI
      boot with legacy grub is **pending**.
  - **Moved** the tftproot root directory from /tftpboot to /var/lib/tftpboot
    to satisfy the STIG RHEL-07-040520 check.
  - Added tftpboot::tftpboot_root_dir to allow users to override
    the new default root directory (e.g., to set it back to /tftpboot).
  - Added tftpboot::linux_install_dir and tftpboot::package_ensure
    to allow more fine-grained control of this module.
  - Explicitly set selinux context on tfptboot files/directories to
    tftpdir_t in order to restrict their access to read-only tftpd
    operation.
  - Internally, refactored configuration to use small, private classes.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.0.3-0
changelog:
  - Pulled latest fixes from saz time zone.  Needed for Centos 7.5 which
    requires localtime to be a link.


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.0-0
changelog:
  - Improvments to the facts:
    - Add tests for following facts:
      - tpm
      - ima_log_size
      - has_tpm
    - Confine tpm fact on the existance of the `tpm-tools` package
    - Migrate to the built in facter timeout
  - Improvements to the `tpm_ownership` provider
    - Added instances feature
      - run `puppet resource tpm_ownership` and see the resource
    - New properties to the type to reflect system state
    - Changed default owner_pass to 'well-known'
    - Removed 'ensure' parameter in favor of the 'owned' param
    - Improved documentation
  - Improvements to the `tpm::ownership` class
    - Added 'owned' parameter to pass to the tpm_ownership type
  - New `tpm::tboot` class to enable Trusted Boot
    - See `tpm::tboot` for details
    - Automatically lock the kernel package and other kernel related packages to
      avoid automatically invalidating launch policy
  - Depend on augeasproviders_grub instead of generic and deprecated
    augeasproviders


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.1-0
changelog:
  - Updated to support Puppet 5
  - IMA policy service
    - Moved the import_ima_rules systemd unit file from /usr/systemd to /etc/systemd
      on systemd based systems
    - Service is now stopped, but enabled, so will only take affect at reboot,
      not during puppet run


author: Nick Miller <nick.miller@onyxpoint.com> - 1.2.0-0
changelog:
  - tpm::ima::policy was not previously callable from tpm::ima
  - tpm::ima::policy will now disable many default IMA checks by default


author: Michael Morrone <michael.morrone@onypoint.com> - 3.1.0-0
changelog:
  - Removed direct module support for IMA, as that functionality has been
    ported to the ima module.  Instead, for backward compatibility, this
    module now uses the ima module, when tpm::ima is set to true.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.1.0-0
changelog:
  - Added support for tboot V1.9.6 and removed support for tboot.1.9.4.
    Use pupmod-simp-tpm 1.1.0 if tboot v1.9.4 is required.
  - Made creating the VLP and LCP optional because  they don't work in
    tboot v1.9.6.
  - Tboot V1.9.7 was released on Sept 06, 2018 but not packaged for Redhat.
    Tested with a locally compiled version and the creation of the policy
    was fixed in that version.
  - Added check for 20 character owner passwords because they are required.


author: Chris Tessmer <chris.tessmer@onypoint.com> - 4.1.0-4
changelog:
  - migration to simplib and simpcat (lib/ only)
  - Fixed a set of bugs that were introduced to the 'job.erb' template.
  - Code cleanup


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Use strongly typed parameters
  - Fix bug whereby optional, respawn limit was not properly specified
    in upstart jobs.
  - Refined upstart::job::sys_limit validation to reject non-integer numbers.


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.0.3-0
changelog:
  - Added Puppet 5 and OEL support
  - Dropped support for Hiera v4.  Dependency auditd has dropped support
    for Hiera v4, causing Puppet 4.7 tests to fail in this module.
  - Update badges and contribution guide URL in README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Initial release of module
  - This module is a collection of conf files regarding users and user creation.
    - Most of the content used to be in simplib


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Provided the ability to simply add shells to /etc/shells
  - Removed all entries from /etc/securetty by default to match the latest
    standard best practices. This removed ZSH.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.1
changelog:
  - Fixed useradd::libuser::defaults_crypt_style to only be a String of the
    allowed values
  - Ensure that the 'modules' field is not printed if the passed Array is empty
  - Ensure that defaults_hash_rounds_min is less than defaults_hash_rounds_max
    and that both are within an allowed range
  - Update useradd::login_defs::pass_min_len to 15 to match the rest of the module updates


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Fix bug in libuser.conf where userBranch was referencing groupbranch variable
  - Added/fixed author on all manifests
  - Created Acceptance test
  - Updated spec/spec_helper_acceptance.rb
  - Added Managed by Puppet comment to all file templates
  - updated default nodeset
  - Added notes to login_defs.pp regarding min and max passwd length
  - Cleaned up documentation and made style changes


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Allow users to specify colors as strings instead of ansi codes in sysconfig/init
  - Updated sysconfig_init.pp to reflect these changes as well as add notes
  - Updated template to convert color strings to ansi code


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.1
changelog:
  - Set the minimum and maximum UID and GID allowed onto the system to the
    default defined in /etc/login.defs or a sensible default if not otherwise
    specified


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed unecessary code and deps after major dep releases
  - Locked versions of all build and test deps


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.3-0
changelog:
  - Ensure that the default VNC sessions set the IPv4 flag
  - Ensure that the default VNC sessions set the banner to /dev/null


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Remove automatic setting of the XDMCP setting in GDM - BREAKING
    - It was determined that this should be something that the administrator
      should explicitly opt into by setting it in the GDM module settings via
      Hiera since it has security implications


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Convert docs to yard tags and add reference.md
  - Added $package_ensure parameters to vnc::server and vnc::client
    - Changed the packages from 'latest' to 'installed'
    - Each will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fixed bug whereby manifest would fail to compile if the force_dot_files
    parameter of ::vsftpd::config was set
  - Fixed bug whereby vsftpd.conf configuration values to be set to 'NO'
    were not written out to that file
  - Fixed bug whereby listen configuration parameter for vsftpd.conf was
    not set based on $listen_ipv4 parameter of ::vsftpd
  - Convert to explicit parameter types


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - New pki scheme
  - Real integers and simplib types implemented
  - Application certs now managed in /etc/pki/simp_apps/vsftpd/x509


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - By default, use TLS 1.2 instead of TLS 1.0.
  - Eliminate the use of deprecated validate_net_list() through
    better strongly-typed parameters for IP addresses and hosts.
  - Add CentOS 6 acceptance tests.


author: Nick Miller <Nick.miller@onyxpoint.com> - 7.2.0-0
changelog:
  - Add support for Puppet 5
  - Add reference.md
  - Move user/group management to it's own manifest, allowing for easier
    ordering
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Add some OEL content but not declaring support for it yet


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fix bug in xinetd.service.erb that caused an inadvertant newline between the
    IP address and port in a redirect configuration line in the generated file.
  - Fix bug in xinetd.service.erb in which the instances and mdns configuration
    lines were omitted from the generated file.
  - Fixed bug in xinetd.service.erb in which includedir and include were specified
    within a service declaration and formatted incorrectly.
  - Fixed bug in validation of syslog facility
  - Fixed bugs in validation of ::xinetd $passenv and $disable parameters
  - Fixed bugs in validation of ::xinetd::service $x_id and $rpc_version parameters
  - Minor cleanup


author: Nick Miller <nick.miller@onyxpoint.com> - 4.0.1-0
changelog:
  - Updated data types to use new Simplib types
  - Corrected simp_options lookups to not have a context prefix of '::'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.2-0
changelog:
  - Update to Puppet 4 custom functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.5
changelog:
  - Prior to bootstrap, we now ensure that the site.pp and site module
    code is valid so that we don't have confusing delays after waiting for
    multiple failing Puppet runs.
  - Clarified the message when bootstrap is locked
  - Ensured that backtraces are not displayed to the user on known
    bootstrap failure cases


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.1.0
changelog:
  - 'simp config' bug fixes
    - Fixed bug in which '{' and '}' characters in console error messages
      resulted in obscure Ruby parsing failures.
    - Fixed bug in which existing non-local NTP servers configuration
      was not presented to the user as a recommended value for
      simp_options::ntpd::servers.
    - Fixed a bug in simp config in which the grub password could
      be **silently** generated and set when the -f option was used.
      The user would have no way to figuring out the value of the
      grub password in that scenario.
  - 'simp config' enhancements
    - Reworked password entry to act more like traditional Linux password
      changing programs
    - Improved input validation and error handling:
      - Improved password validation. This validation now uses pwscore,
        when available.  cracklib-check is used otherwise.
        **CAUTION**:  Existing passwords may not pass current validation.
      - When interactive operation is permitted, always query the user for
        replacement values for invalid answers provided by file or command
        command line KEY=VALUE input.  Previously, for items that
        'simp config' would normally automatically assign without user
        input, 'simp config' would automatically (and sometimes
        silently), replace the invalid values.  This both hid errors
        and yielded unexpected settings.
      - Verify <password, password hash> pairs provided by file or
        command line KEY=VALUE input are valid.  Previously, a user
        could pre-assign LDAP Bind/Sync passwords that did not match
        their respective password hashes.
      - Log problems with invalid answers provided by file or command
        line KEY=VALUE input when the answer is processed, not when
        it is first read in.  Previously, validation error messages
        were totally disassociated from the values causing the errors.
    - Added an option to disable queries (-D,--disable-queries) whether or
      not an input answers file is being used.  This feature is a
      functioning replacement for the previously removed -ff capability.
    - Deprecated the --non-interactive long name of -f in favor of
      a more accurately-named replacement, --force-defaults.
      --non-interactive will be removed in a future release.
  - 'simp passgen'
    - Fixed bug in which password filenames containing one or more '.'
      characters could not be listed, added, or removed.
    - Added password auto-generation capability to password setting
      operation.
    - Added backup of password salt files, when passwords are backed up.
    - Per security best practices, when a password is updated, now
      removes the salt file corresponding to an old password.
    - Improved password validation. This validation now uses pwscore,
      when available.  cracklib-check is used otherwise.
      **CAUTION**:  Existing passwords may not pass current validation.
  - General updates
    - No longer emit Ruby backtraces for errors for which a backtrace
      provides no additional information.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.1.0
changelog:
  - removed simp_options::selinux references in tests.
  - update setting of grub2 password to use augeausproviders_grub.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.2.0
changelog:
  - Stripped trailing whitespace
  - Adjusted bootstrap to detect PE and avoid operations that are detrimental to
    proper operation
  - Made a few adjustments for overall safety
  - Fixed dependency loading for 'highline/import' by clearing the gem cache


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.3.0
changelog:
  - Update 'simp config' to support environment-specific Hiera 5
    configuration provided by SIMP-6.3.0.
    - Assumes a legacy Hiera 3 configuration, when the 'simp'
      environment only contains a 'hieradata' directory.
    - Assumes a Hiera 5 configuration configuration, when the 'simp'
      environment contains both a 'hiera.yaml' file and a 'data/'
      directory.
    - Fails to run otherwise, as neither stock SIMP configuration
      has been found and 'simp config' cannot safely modify
      hieradata.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.3.0
changelog:
  - Fixed `simp bootstrap` errors in puppetserver 5+:
    - No longer overwrites `web-routes.conf` (fixes fatal configuration error)
    - No longer adds `-XX:MaxPermSize` for Java >= 8 (fixes warnings at restart)


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.3.0
changelog:
  - `simp config` removes the deprecated Puppet setting `trusted_server_facts`
  - Add `:version` to `Simp::Cli::Utils.puppet_info`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.4.0
changelog:
  - Added a `simp bootstrap` option to set the wait time for the
    puppetserver to start during the bootstrap process.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.20-0
changelog:
  - Fix array formatting bugs present when 'simp config' is used with
    Ruby 1.8.7.
  - Fix bug with processing of yes/no item defaults, when the
    non-interactive configuration mode of 'simp config' is enabled.
  - Print out a summary of actions taken by 'simp config'.
  - Adjust 'simp config' processing to ensure any hiera changes are
    made to the site yaml file, not just the template yaml file
    delivered with SIMP.
  - Refine 'simp config' configuration descriptions and other output.
  - Improved error handling.
  - Expand tests.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.21-0
changelog:
  - Updated the Rakefile to use the simp-rake-helpers file
  - Updated the SIMP command line to install to /usr/share/simp/ruby and to use
    the AIO ruby if present and the system ruby otherwise.
  - Ensure that the 'simp' executable is installed to the actual system bindir


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.0.0
changelog:
  - Bootstrap now curls the puppetserver on the masterport (not the ca_port)
    to check if the puppetserver is running.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.2-0
changelog:
  - Removed core module binford2k-node_encrypt.  There are issues with
    the module and we don't currently use it anywhere in core.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - update puppetserver to 2.8.0-1
  - updated packages.yaml to pull puppet 4.10.6 rpms.
  - change diskdetect.sh kickstart file to use ext4 instead of xfs
  - add simp_snmp, simp_nfs and update augeasproviders_grub


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Removed pupmod-herculesteam-augeasproviders_base as a SIMP dependency
  - Removed the 'dist' from the /etc/simp/simp.version file


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Obsolete pupmod-electrical-file_concat in simp-extras package
  - Obsolete pupmod-simp-activemq and pupmod-simp-mcollective in
    simp package
  - Update versions of numerous dependencies of both simp and simp-extras
    packages.*
  - Move pupmod-puppet-yum from simp-extras package to simp packages, as
    required by pupmod-simp-tpm


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Update final dependencies for 6.2.0
  - Fix paths to configuration files
  - Remove the pupmod-puppetlabs-java_ks dependency from the simp package
  - Add of the following dependencies to the simp package:
    - pupmod-simp-systemd dependency
    - pupmod-puppetlabs-mount_providers
  - Remove the following dependencies from the simp-extras package:
    - pupmod-simp-jenkins
    - pupmod-simp-mcafee
  - Add the following dependencies to the simp-extras package:
    - pupmod-puppetlabs-docker
    - pupmod-puppetlabs-translate
    - pupmod-simp-dconf
    - pupmod-simp-dirtycow
    - pupmod-simp-simp_docker
    - pupmod-simp-simp_ipa
  - Update the pupmod-simp-simplib version due to a bug that potentially
    permanently breaks the puppetserver configuration


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0-0
changelog:
  - Add the following dependencies to the simp package
    - pupmod-simp-deferred_resources
    - pupmod-simp-ima
    - pupmod-simp-simp_banners
    - pupmod-simp-tlog
    - pupmod-simp-tpm2
    - pupmod-simp-vox_selinux
  - Add the following dependencies to the simp-extras package
    - pupmod-simp-mate
    - pupmod-simp-simp_pki_service
    - pupmod-simp-x2go
  - Removed the following dependencies from the simp-extras
    package, as they have not yet been updated to Puppet 5
    - pupmod-elastic-elasticsearch
    - pupmod-elastic-logstash
    - pupmod-simp-simp_elasticsearch
    - pupmod-simp-simp_logstash


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0-0
changelog:
  - Updated package versions for the latest release
  - Moved the following to simp-extras
    - pupmod-richardc-datacat
    - pupmod-simp-autofs
    - pupmod-simp-krb5
    - pupmod-simp-ima
    - pupmod-simp-network
    - pupmod-simp-nfs
    - pupmod-simp-tpm
    - pupmod-simp-tpm2


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.2-0
changelog:
  - Updated the following packages to address bug fixes. See the Changelog for
    relevant information.
    - pupmod-simp-incron
    - pupmod-simp-pupmod
    - pupmod-simp-simplib
    - pupmod-simp-sssd
    - pupmod-simp-stunnel


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.3-0
changelog:
  - Updated the following packages to address bug fixes. See the Changelog in
    the SIMP documentation (simp-doc package) for relevant information.
    - pupmod-simp-sssd


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Fix 'puppet resource service' bugs in %post
  - Add /var/run/puppetlabs to the list of directories to traverse,
    when fixing puppet uid/gid.
  - Fix simp_rpm_helper bugs that prevented SIMP module RPM uninstalls
    in certain scenarios


author: Trevor Vaughan <tvaughan@onyxpont.com> - 0.0.3-0
changelog:
  - Handle PE and Puppet Open source in the post section
  - Add dist to the release field to account for RPM generation on EL6 vs EL7
  - Updates to work better with PE and with the new method for detecting
    kickstart installs as added by Chris Tessmer <ctessmer@onyxpoint.com>


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.6-0
changelog:
  - Updated the minimum version of the puppet-agent dependency to at least
    1.10.4 (packages puppet 4.10.4), due to 'puppet generate types' bugs
    in puppet-agent releases prior to that. These bugs cause the composite
    namevar fixes to not function properly.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Removed delivery of global, Hiera 3 hiera.yaml file.
  - Added logic to ensure any existing hiera.yaml.simp file is not removed
    on upgrade from simp-adapter <= 0.0.6.
  - Added uninstall logic to remove an existing hiera.yaml.simp file that had
    been preserved from simp-adapter <= 0.0.6, but which is no longer in the
    simp-adapter RPM file list.
  - Removed enabling OBE puppet trusted_node_data setting in %post
  - Removed disabling OBE puppet stringify_facts setting in %post


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.1-0
changelog:
  - Affect a copy with simp_rpm_helper when called in either the %posttrans
    or %post of a SIMP RPM.
  - Fix bug in simp-adapter.spec in which a comment line was missing the '#'


author: Nick Miller <nick.miller@onyxpoint.com>
changelog:
  - Added justification for V-71849 results, when SIMP changes vendored
    permissions on RPM provided files


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com>
changelog:
  - Updated PXE boot instructions for UEFI.
  - Added section for 6.1.0 -> 6.2.0 upgrade for files that need to be updated.
  - Changed For Impatient to Quick Start


author: Michael Morrone <michael.morrone@onyxpoint.com>
changelog:
  - Updated System minimum requirements
  - Changed prompts for root commands in User Guide to #
  - Added implementation details to Managing Local/Service Users
  - Removed Indices and tables from index pages


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com>
changelog:
  - Remove obsolete 'HOWTO Configure a Puppet Master behind a NAT'
    and 'HOWTO Configure iptables NAT Rules'


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added information regarding the removal of ELG packages from the ISO
  - Moved changelogs from `simp-core` into the project
  - Removed code to fetch changelogs from other repositories


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Added a warning about copy/pasting from the docs and quotes
  - Added a note to the 6.2->6.3 upgrade guide to restart the puppetdb process


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.4-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 6.2.1 tag for which the RPM version was erroneously 6.2.3.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.5-0
changelog:
  - selinux policy in module simp-environment was changing settings on rsync files not in the
    simp environment and removing their selinux context.  This caused DNS, DHCP to fail
    if they were running in an enviroment by a name other then simp.
  - moved selinux policy to simp-environment module and had simp rsync require this module
    so the selinux policy for /var/simp directory would be in one spot.
    file contexts are not overwritten by it.
  - updated the policy so it would explicitly set the context for files in simp environment and
    not overwrite settings that were not explicitly set.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.6-0
changelog:
  - Ensure that FakeCA works properly with Puppet Enterprise
  - Ensure that the RPM installation permissions work properly with Puppet
    Enterprise


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.7-0
changelog:
  - Enable the UDP localhost rsyslog server on the puppetserver to capture
    messages from the puppet services for processing and forwarding


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.8-0
changelog:
  - Pre-populate the /var/simp/environments/simp/site_files/pki_files/
    directory tree and set its ownership and permissions appropriately.
    This is part of the fix to the failure of SIMP to bootstrap on
    a system on which root's umask has already been restricted to 077.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.10-0
changelog:
  - Added force option to the selinux fixfiles command in the post install
    section.  If this is not set, only the type context is restored, even
    though the user context is also set in the selinux policy.
  - Removed logic to link production environment to simp environment.  This
    is done in 'simp config', if it is needed.
  - Updated rsync version required to 6.2.  Selinux code was moved from
    simp-rsync to simp-environment at that time and using older versions can
    cause unexpected results in the selinux policy.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added a default Hiera 5 hiera.yaml.
  - Renamed environments/simp/hieradata/ to environments/simp/data/ to support
    staged rollout of environment-specific hiera.yaml use.
  - Removed the OBE environments/simp/hieradata/compliance_profiles directory
    and references to it.
  - Removed unnecessary package dependencies to make installation more portable.
  - Only use simp_rpm_helper to copy files installed in /usr/share/simp/environments
    into /etc/puppetlabs/code/environments/simp, as appropriate, if this is an
    initial install.
  - Only use simp_rpm_helper to remove file copies that reside in
    /etc/puppetlabs/code/environments/simp, as appropriate, if this is an erase.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-2
changelog:
  - Now install the GPG keys to /usr/share/simp/GPGKEYS and /etc/pki/rpm-gpg
  - Copy the keys into the SIMP default web dirs if they exist and be sure to
    clean up after ourselves in the future.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.0-0
changelog:
  - Added new puppet gpg key from http://yum.puppetlabs.com/RPM-GPG-KEY-puppet
  - Ensure facter is in $PATH during post install


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.0.0-1
changelog:
  - Only copy in the SIMP and Puppet GPG keys into the system trust chain.
    Copying more than that is too presumptive.
  - Removed the 'dist' qualifier from the version since it was determined that
    the public GPG keys are OK to be common across all releases.


author: Nick Miller <nick.miller@onyxpoint.com> - 3.0.2-0
changelog:
  - simp-gpgkeys is now its own module
  - Added a yaml file with a download source and a fingerprint to check cert integrity
    - And a travis file to check them


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.3-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 3.0.2 tag for which the RPM version was actually 3.0.3.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Removed everything that *may* fall under a conflicting license. We will need
    to evaluate how to handle package building going forward.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-1
changelog:
  - Added a ClamAV specific RPM to handle the different license in ClamAV.
  - These should eventually be split.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.1-0
changelog:
  - Updated the README that is delivered with the SIMP rsync environments to talk
    a bit about the shares structure and to encourage users to read the HOWTO


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - The selinux policy in simp-environment was changing settings on rsync
    files not in the simp environment.  If DNS and DHCP were running in an
    environment other then simp, relabeling the filesystem would change the
    selinux context to default context for /var/simp. This, in turn, caused
    these services to fail if selinux was in enforcing mode.
  - The selinux policy and the logic to set it up were moved to simp-environment module
    so the selinux policy for /var/simp directory would be in one spot.
  - Simp-rsync now requires the simp-environment


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.1-0
changelog:
  - Added logic in dhcpd.conf to select the appropriate PXEboot file
    based on the boot type (BIOS or UEFI).


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - puppetlast:
    - Now uses the new PuppetDB nodes endpoint over http
    - Gathers new information about the nodes, which can be now be sorted and
      isolated by status and environment
    - Expired nodes will no longer show up in the query
    - Errors and exit scenarios will now be handled more gracefully
    - Removed man page in favor of `puppetlast -h`


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - added example ldifs to be copied to /usr/share/simp
  - changed rake and gemfiles so pkg:rpm would work


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.4-0
changelog:
  - Fixed an incorrect dependency on /bin/ruby as opposed to /usr/bin/ruby
  - Changed all instances of #!/usr/bin/env ruby to #!/usr/bin/ruby per the
    Fedora packaging guidelines


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added script to upgrade SIMP 6.0.0 to SIMP 6.1.0
  - Removed obsolete scripts
    - hiera_config
    - hiera_upgrade
    - migrate_to_simplib


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.2-0
changelog:
  - Fixed bug in which updaterepos would fail when executed with Ruby 1.8.x
    (e.g on CentOS 6 servers)
  - Fixed bug in which gen-ldap-update generated malformed ldif
    output when executed with Ruby 2.x (e.g on CentOS 7 servers)


