# changelog

author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.2-0
changelog:
  - Fixed README typos
    - Cleaned up code
    - Added acceptance tests
    - Added support for `auth_membership`
    - Fixed code regression from d49cf32
      - Thanks for the notification from John Warburton
    - Validated noop message was correct
    - Fixed sort order when checking user lists against the system


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 1.0.4-0
changelog:
  - 1.0.3 was tagged, bumping to 1.0.4
  - Fix addresses https://github.com/onyxpoint/puppet-gpasswd/issues/7
  - Before this fix, users could not specify groups in the system
    GID range, SYS_GID_[MAX,MIN] in /etc/login.defs. Added system_groups
    feature to gpasswd.
  - Added beaker tests to ensure groups can be created within the system range.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Fixed bug whereby aide reports/errors were not being sent to syslog.
    AIDE can now be configured to report to syslog, itself.
  - Use FIPS-appropriate hash algorithms when in FIPS mode
  - No longer hide AIDE initialization failures (which are primarily
    configuration errors) when a manifest with the aide class is applied.
  - Improved acceptance tests.
  - Commented out SUSE acceptance test node, as the node configuration
    is broken.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Retain output database upon AIDE database update for SCAP
    Security Guide OVAL check
    xccdf_org.ssgproject.content_rule_aide_build_database


author: Trey Dockendorf <tdockendorf@osc.edu> - 6.1.3-0
changelog:
  - Add `aide::cron_command` to allow user modification.
  - Ensure that the package is explicitly installed before any dependent
    resources.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Ensure that entries in 'at.allow' are not commented out by default
  - Updated the Gemfile to pin to the latest working Beaker


author: Ralph Wright <rwright@onyxpoint.com> - 7.0.0-0
changelog:
  * Mon Dec 26 2016 Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
  - Refactor to work in Puppet 4 Changes
  - Updated acceptance tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - In response to the DISA STIG Requirements
    - Added 'open_by_handle_at' to the 'access' key
    - Added watches on /varlog/faillock and /var/log/tallylock
    - Added watches on /usr/sbin/insmod and /bin/kmod
    - Added permissions modification notification for 'chmod'
  - Renamed auditd::add_rules to auditd::rule
  - Split the audit permissions rules into separate lines
  - Disabled chmod auditing by default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.1-0
changelog:
  - Changed auditd::failure_mode to '1' by default since the compliant audit
    rules were causing routine system restarts. The new value will default to
    sending printk messages when the buffer is full.
  - Changed all rules that were exit,always to be always,exit


author: Nicholas Hughes <nicholasmhughes@github.com> - 7.0.1-0
changelog:
  - Audit kernel module tools from /usr/bin as well as /bin and /sbin
  - Correct auditing /var/log/tallylock, it should have been /var/log/tallylog


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Fix bug whereby audit.rules file was not being regenerated prior
    to auditd service start in CentOS/RedHat 6.
  - Update puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Updated to use augeasproviders_grub 3
  - Added the ability to log calls to the 'rpm' and 'yum' commands


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 7.1.3-0
changelog:
  - Updated compliance suite to use new inspec profile,
    https://github.com/simp/inspec-profile-disa_stig-el7
  - Removed the el6 nodeset from the compliance suite; there are no
    simp-supported el6 inspec profiles at this time.
  - Ensured git installed as it's a dependency of our inspec profiles


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Ripped out all NFS materials
  - NFS can now work with the configuration of autofs but there should not have
    been a strong dependency the other way


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Allowed for control of specific versions of the packages in this
    module with two new parameters:
    - samba_package_ensure
    - autofs_package_ensure
  - Support Puppet 5


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.0-5
changelog:
  - Updated to use the new 'simp' environment.
  - Changed calls directly to /etc/init.d/rsyslog to '/sbin/service rsyslog' so
    that both RHEL6 and RHEL7 are properly supported.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.0-6
changelog:
  - Added enable_clamav parameter to toggle: package install,
    freshclam/clamscan cron jobs, clamav rsync, antivirus selboolean.
  - The clamav user, group now manageable and package name mutable.
  - Added validation to init.pp


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.1.0-0
changelog:
  - Documented the report format in the README
    - Added the defaut SIMP compliance profiles to the module data
    - Enhanced the lookup mapper function to take an optional default map
    - Passed the internal data as the default map
    - Added client metadata to the compliance report for easier analysis
    - Fixed several minor processing bugs
    - Added the documented, but missing, regular expression match capability
    - Confine puppet version in metadata.json


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 2.3.0-0
changelog:
  - Converted compliance profiles to JSON.  This allows non-string values
    and faster deserialization.
  - Provided scripts in 'utils/' to convert the compliance profiles from
    YAML to JSON and vice versa.


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 2.3.1-0
changelog:
  - Refactor report generator to use a shared file format parser/compiler.
  - Add vendored 'profiles-in-modules' support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.3.3-0
changelog:
  - Aligned the EL7 disa_stig profile with the latest SSG content
  - Fixed several parameters with incorrect data types


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 2.3.3-0
changelog:
  - Further aligned the EL7 disa_stig profile with scap-security-guide 0.1.33-5
    - Added oval-ids to map puppet parameters to openscap tests and SIMP
      remediations.  Note this mapping is NOT complete.
  - See simp/doc for a policy evaluation response report for CentOS 7
    - Includes remedies and justifications to address failures in
      the openscap scan


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.3.3-0
changelog:
  - Updated TMOUT setting in /etc/profile.d/simp.sh to match EL7 STIG
    setting (Reference: RHEL-07-040160)
  - Added missing audispd program to simp_rsyslog::default_logs
  - Added missing ' IPT:' message start to simp_ryslog::default_logs.
    This is required for iptables violation messages because some
    versions of rsyslog add a space separating the message
    timestamp/id and the message.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Removed deprecated audit metaparameter
  - Added basic acceptance test
  - Made sure the cron::user class doesn't use the pam module if pam is false
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Prevent log duplication and log where intended.
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.1.1-0
changelog:
  - The simp_options::fips catalyst did not disable fips; changed enable
    variable to default to simp_options::fips
  - Moved check for OS family from params to init
  - Added package remove for dracut-fips packages if fips is disabled


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Created a work-around for an undocumented issue where /boot is not
    on its own partition but is added to the kernel parameters with
    fips=1. This situation ends up creating a kernel panic on the
    system until the boot= entry is removed from the kernel boot line.
  - Added tests against GCE since that is the default image configuration
    on those systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Including the FIPS module was causing FIPS mode to be enabled by default.
    This had high potential for causing issues, as evidenced by our acceptance
    tests, so we now mirror the 'enabled' state of the module based on whether or
    not FIPS is already enabled on the target system.
  - Update puppet dependency in metadata.json


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.2.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.
  - Fixed a bug with the radius_rsync_user passgen.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.0-0
changelog:
  - Ensure Puppet 4 compatibility. This changes the (always incorrect, but
    allowed) '2' and '3' paths to 'v2' and 'v3'.
    - Be sure to check and update your Hiera data!
  - Fixed the case where the `radius_version` fact does not exist.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Refactored module
  - Application certs now managed in /etc/pki/simp_apps/freeradius/x509


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Changed calls to auditd to the new layout (breaking change)
  - Added acceptance tests
  - Ensure GDM starts at boot time on EL7
  - Add notice that two runs are required


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.1-0
changelog:
  - Added the following services on EL7:
    - `display-manager`
    - `upower` - replaced hal, used by gnome
    - `rtkit-daemon` - used by pulseaudio and gdm


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Updated polkit setting to use the new defined type from the polkit module
  - Added polkit dependency
  - `dconf update` execs now catch failures


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - Moved the simp dconf profile below the user profile so users can change
    their own settings in the desktop
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - module was rewritten
    - takes advantage of the data in modules paradigm
    - has a single point of entry
  - packages now default to 'installed' or the package_ensure catalyst
    from simp_options
  - gnome::dconf::add
    - deprecated in favor of gnome::config::dconf
    - this class is now a temporary shim to ensure backwards compatibility
  - gnome::config::dconf
    - allows setting more than one key/value pair (only one could be set
      in dconf::add)
    - class name is not a verb
    - dconf settings controlled by this class can be modified in data,
      including removing default settings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Add libxkbcommon-x11 to required package list for CentOS/RedHat 7.4.
  - Remove unnecessary CentOS data-in-module files.  The OS family fact
    for CentOS is RedHat, so these files are not used.


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Massive Refactor
  - Refactored the module to use the latest best practices and eliminate issues
    with doing an 'include' of the individual sub-classes.
  - Worked around a bug with the yum provider and the 'purged' parameter
  - Fixed some class ordering
  - Added acceptance tests for EL6 and EL7
  - Updated the rspec tests to properly work around OEL issues with facts


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.3.1-0
changelog:
  - Updated module for auto lua spec generation
  - Added missing requires file and added dependency on simplib
  - Modified module to auto-generate lua spec


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.2.0-0
changelog:
  - Fixed permission on incrond service file to clear errors in system log.
  - Updated package to use package ensure to control updates.  This changed the
    default ensure of package to installed from latest.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.0-0
changelog:
  - Added a native type `incron_system_table` to allow for client side glob
    expansion on paths
  - Pushed all validation of parameters off to the native type from
    `incron::system_table`
  - Updated acceptance tests to verify that incron is actually working
  - Bumped the supported puppet version to '< 6'


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Stop managing the systemd unit file, because deviating from the RPM defaults
    violates the STIG
  - Set /etc/incron.d to 0755, the RPM default


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.1-0
changelog:
  - Added a workaround for Puppet 4.10 type issues
    - There was a bug in Puppet where all lookup() Hash keys were being converted
      into Strings even if they were another data type
    - This is fixed in Puppet > 4.10.2 but this patch will remain for backwards
      compatibility
  - Update puppet dependency in metadata.json
  - Remove OBE pe dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Added the ability to ignore interfaces using the 'ignore' regex array
  - Fixed issues with ignoring rules and added some optimization
  - No longer apply IPTables rules in the optimization phase and simply wait for
    the downstream service to trigger


author: Some Dude <7zbayf+sw1l67jjhlbk@sharklasers.com> - 6.1.0-0
changelog:
  - Fixed a bug in the order of the IPTables rules in scanblock module
    - Previously, IPTables would not block connections from banned IPs that
      were accessing open ports.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1
changelog:
  - This commit moves the logic that parses the `iptables::ports` Hash into a
    define, to make it possible to use the same hash format in other modules
    without copying code.
  - There was also a bug where compilation would fail if `proto` was specified in
    the defaults section of the Hash.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1
changelog:
  - Fixed bugs in the chain retention and optimization code that would cause
    iptables to fail to reload in some situations.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.3
changelog:
  - Fix issue where a `jump` target went to an empty ruleset and the chain was
    dropped
  - Retain all native IPTables jump points by default
  - Add `==` method for IPTables Rulesets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.5
changelog:
  - Perform deep rule comparison on rulesets that are otherwise identical
  - Remove chances for memory leaks due to the design of iptables_rule
  - Set init script permissions back to the RPM defaults of 0755


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Fix most of the puppet strings problems
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.3-0
changelog:
  - Allow users to modify the owner, group, and mode of files that may be used by
    multiple subsystems


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.0-0
changelog:
  - Added support for CentOS 6
  - Fix several bugs in the following categories:
    - Use of wrong variables (cut and paste errors or typos)
    - Improper parameter validations
    - Parameters not being used in erb files.
    - OBE names of ipsec settings.
    - Missing quotes/braces around settings that can contain whitespace
  - Expose more ipsec settings.
  - Allow IPv6 addresses


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.2-0
changelog:
  - Bug fixes:
    - Set up FIPS-compliant configuration, not just when
      simp_options::fips is true, but also when the server is already
      in FIPS mode.
    - Insert token password into the NSS database after configuring
      the NSS database for FIPS.
  - Updated the tests.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.1-0
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.1-0
changelog:
  - Strongly typed module
  - Moved docs to strings/yardoc format
  - Removed verb from vm_create class to vm


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Use kmod::load instead of ruby script for loading the kernel module
  - Modernize some code
    - Moved all parameters to init.pp while also
      maintaining previous functionality
  - Spec test cleanup
  - New acceptance test (no nested virtualization)
  - Corrected some documentation and examples


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.1.0-0
changelog:
  - Added a `libvirt_br_netfilter_loaded` fact to determine if the `br_netfilter`
    kernel module is loaded on the target system
  - Documentation update
  - Data in modules update
  - Use `ensure_packages` for package installation
  - Fully decouple `libvirt::ksm` from the main `libvirt` class


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Added lastaction logic to logrotate::rule.
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.1-0
changelog:
  - Updated the defaults  settings for compress, rotate and dateext in rule.pp
    to pull values from init.pp. (They were hard coded to them before)
  - changed templates to add nodateext if dateext is set to false.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Move SIMP-specific logrotate rules to a SIMP-managed configuration
    directory, /etc/logrotate.simp.d, and ensure logrotate processes
    that directory first. This ensures SIMP rules take priority, when
    duplicate rules are specified.


author: Maintenance
changelog:
  2.0.0-3
  - Moved mit-tests to /usr/share/simp...
  - Updated pp files to better meet Puppet's recommended style guide.


author: Maintenance
changelog:
  2.0.0-4
  - Created a Cucumber test to ensure that firefox installs correctly
    and is at the latest version when including mozzila in the puppet
    server manifest.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.3.1-0
changelog:
  - Changed the Exec['restart-systemd'] to Exec['systemctl-daemon-reload']
    to avoid a conflict with puppetlabs-postgresql


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 4.3.3-0
changelog:
  - This patch corrects the following shortcomings to ensure compatability
    with Red Hat Enterprise Linux 7 and its clones:
      - Ensures all required directories exist in the chroot
      - Remove dependencies for the non-existent `named-chroot-setup.service`
      - Use new-style daemon invocation, executing in the foreground and
        logging to stderr.  See daemon(7).
      - Since new-style daemons don't require a PID file, nor does the binary
        generate one in foreground mode, remove it from the service file.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Updated global catalysts and strong typed the module
  - Made chrooting logic less complicated
  - ALL of the spec tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.3-0
changelog:
  - Provide override file for named-chroot.service instead of
    modifying the vendor-provided service file.
  - Use simplib::assert_metadata() for OS validation
  - Replace Puppet3 version of passgen() with  simplib::passgen()


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.1.0-6
changelog:
  - Replaced all 'lsb*' facts with their (package-independent)
    'operatingsystem*' counterparts.
  - Common module assets have been normalized, lint errors corrected,
    and rspect tests have been updated to the new 'expect' syntax.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.1.2-0
changelog:
  - Ensure that no calls to 'function_defined' are present in any templates for
    Puppet 4 compatibility


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Strong typing w/new IP types
    - All parameters that were 'yes' or 'no' are now optional booleans
  - Removed most validation from templates
  - Added more tests for all manifests
  - Cleaned up regex in the careful restart script


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Added management of bind-utils and bridge-utils
    - Packages in this module now use the package_ensure catalyst
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - gssproxy ensured running when secure_nfs is true, el > 7.1
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Changed all stunnel connections to use 'stunnel::instance' methods so that
    they are not interrupted by an issue with the global stunnel configuration
    and they can set the TCP_NODELAY option as suggested for small transaction,
    high bandwidth connections.
  - Added parameters to allow users to tweak the stunnel socket options for all
    NFS stunnel connections.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - On systemd systems, the stunnel service is now a dependency of the NFS
    servers and mounts managed by this module.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Added `nfs::client::mount::autodetect_remote` to override all autodetection
    of whether or not the remote host was the current NFS server so an NFS
    server can mount NFS directories from other servers.
  - Added `nfs::client::mount::stunnel` to allow users to dictate the stunnel
    connection state for specific mounts.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.1-0
changelog:
  - Update systemd fixtures and CI assets
  - Add logging for exportfs failures
  - Ensure that reexports happen after the NFS service has been started


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Manage ntpdate via `ntpd::ntpdate`
    - Manage `/etc/ntp/step-tickers`
    - Manage `/etc/sysconfig/ntpdate`
      - New params ntpdate_sync_hwclock, ntpdate_retrym and ntpdate_options should
        cover all options from RedHat
      - `SYNC_HWCLOCK=yes` is now set here instead of `/etc/sysconfig/ntp`
  - Add `$package_ensure` parameter to control the `ntp` package version
  - Move some multiline strings into variables (style recommendation)
  - The module now only requires one puppet run to apply completely
  - Added essential-level acceptance test


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Fixed bug in which ntpd::ntpd_options was not applied to ntpd::servers
    when ntpd::servers is an array.


author: Brandon Riden <brandon.riden@onyxpoint.com> - 6.0.3-0
changelog:
  - Changed Openscap::Profile type to use regex match on profiles rather than the Enum.
  - Added hieradata to module to specify scap_profile and ssg_data_stream based
    on OS (RedHat 6, RedHat 7, CentOS 6, and CentOS 7)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Added an `oscap` fact for gathering the following information:
    - OpenSCAP Version
    - OpenSCAP Supported Specifications
    - SCAP Profiles from /usr/share/xml/scap/*/content/*-ds.xml
  - Added logic to ensure that a valid profile is chosen based on the new fact
  - Added unit and acceptance tests
  - Updated data to reflect valid choices on a default EL6 load


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Set the minimum UID allowed onto the system to the default defined in
    /etc/login.defs or 1000 if not otherwise defined


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Replace authconfig and authconfig-tui links to a no-op script, instead
    of removing them.  This does not break tools that use authconfig.
  - Use simp_options::package_ensure, when available


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.2.0-0
changelog:
  - Update the pam::unlock_time parameter to accept 'never' as a value per the
    man page and in accordance with the DISA STIG


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.1-0
changelog:
  - Allow users to change the password hash algorithm
  - Allow users to enable/disable enforcing password policies for `root`
  - Update compliance tests to work with inspec profiles and compliance engine
    enforcement.


author: Jeanne Greulich <jgreulich.greulich@onyxpoint.com> - 6.0.0-0
changelog:
  - Global catalyst updates
  - Strong Type updates
  - Changed default for pki directory to /etc/pki/simp from /etc/pki


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed pki::pki_dir parameter to pki::base_dir
  - Updated acceptance tests
  - Fixed bugs in ordering


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - Set perms on simp_apps to 644/755; apps were being denied access to
    their own certs because they could not access /etc/pki/simp_apps.
  - We have made the decision to centralize application certificates
    when simp is managing pki (simp_options::pki => true or 'simp').
    This update re-tools pki::copy to better handle managing certs
    in /etc/pki/simp_apps.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed default location of keydist certs from the files directory of the pki
    module unless $pki is set to 'simp', when it will pull from pki_files in a
    different module path instead.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.0-0
changelog:
  - SIMP certs are now managed in /etc/pki/simp/x509, and application
    certs in /etc/pki/simp_apps/<app_name>/x509.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.2-0
changelog:
  - Ensure that /etc/pki/simp_apps is recursively purged so that old certificates
    are not left on the system
  - Adds a new param, `$certname`, that controls the name of the certs in keydist
    that will be copied over. This used to be set to `$facts['fqdn']` without an
    option to change it, now it will default to `$trusted['certname']`


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - pki::copy's source parameter now accepts any string to allow for use of NSS
    and remote file sources.
  - Cleanup unneeded fixtures
  - Update version range of auditd dependency in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - There was a bug in the 'identity' variable for polkit::local_authority where
    it would not properly accept arrays of users or groups.


author: Kendall Moore <kmoore@keywcorp.com> - 4.1.0-0
changelog:
  - Refactored manifests to pass all lint tests for puppet 3 and hiera compatibility.
  - Added spec tests.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Add EL7 and polkit 106+ support by allowing javascript rules
    - Added define to allow for easy placement of custom rules
    - Added templated define to ease generation of basic rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Allow default identity and identities prefixed with unix-netgroup.
  - Confine puppet version in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 5.0.2-0
changelog:
  - Removed `audit` metaparameter
  - Implemented `package_ensure` catalyst
  - Cleaned up some code formatting
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.1.0-0
changelog:
  - Added main_cf_hash parameter so a list of additional settings for main.cf
    file can be added without the need for entering a resource for each one.
  - Added the smtpd_client_restrict entry to main.cf per the STIG.
  - Updated simpcat to concat.
  - Rearranged code into sub-classes to make it easier to follow.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/postfix/* perms from 0640 to 0644
    - /usr/libexec/postfix management is no longer recursive
    - /var/spool/mail perms from 0755 to 0775
  - Cleanup unneeded fixtures and update CI assets


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.5.0-0
changelog:
  - Updated to support Puppet 5
    - Fixed issues with the puppetserver configuration that could have broken
      Puppet 5 system configurations
    - Updated to support new server options
  - Fixed issues with autosign and fileserver.conf defined types generating
    incorrect files
  - Updated all puppet strings documentation
  - Converted all templates to EPP
  - Added process limits on the number of JRuby instances started designed to not
    overload the server in terms of either processor power or memory capabilities
  - Added OracleLinux support


author: Nick Miller <nick.miller@onyxpoint.com> - 7.5.0-0
changelog:
  - pupmod::master::simp_auth
    - Allow tweaking `allow` and `deny` rules for supported keydist auth rules
    - Removed Mcollective auth rules
    - Deprecated `$legacy_cacerts_all` and `$legacy_pki_keytabs_from_host`


author: Lucas Yamanishi <lucas.yamanishi@onyxpoint.com> - 7.5.0-0
changelog:
  - Fix service name and related resources on Puppet Enterprise (PE)
    - Fix `$tmpdir` setting on PE
    - Fix Puppetserver service management on PE


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.6.0-0
changelog:
  - Added line in puppet cron to shutdown/disable puppet client service.
  - Added check in agent/cron manifest to disable and stop puppet client service
    so it would not run multiple times on newly kickstarted systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.0-0
changelog:
  - Changed some 'validate_re' statements to 'assert_type' to remove deprecation
    warnings
  - Added 'pupmod::master::generate_types' (enabled by default) which:
    - Adds a script, /usr/local/sbin/simp_generate_types that will run 'puppet
      generate types' either on all environments (when first distributed by
      Puppet) or per environment
    - Adds incron hooks to run 'simp_generate_types' when Ruby files in any
      puppet type have been updated
    - Adds incron hooks to run 'simp_generate_types' on any new environment
    - Adds incron hooks to run 'simp_generate_types' on *all* environments if the
      puppetserver binary is updated
    - All errors are logged to syslog


author: Nick Miller <nick.miller@onyxpoint.com> - 7.6.1-0
changelog:
  - Cleanup unneeded fixtures and update CI assets
  - Remove unused simp/tcpwrappers and simp/logrotate dependencies


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.1-0
changelog:
  - Fixed the new `simp_generate_types` script to ensure that the permissions on
    the created directory are correctly set.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.6.1-0
changelog:
  - Fixed bug in which the JAVA tmpdir path for the puppetserver was
    incorrectly set.  This could cause puppetserver RPM upgrades to fail.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Most of this content was from simplib
    - The dns autoconfiguation content was moved to a profile in simp/simp
  - First cut


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.1.0-0
changelog:
  - Improve validation for resolv.conf parameters
  - Add type aliases, epp with typed parameters
  - Update data types in init.pp parameter list (backwards compatible)
    - NOTE: The data type for the parameters `$resolv::servers` and
      `$resolv::search` has changed from `Simplib::Netlist` to Arrays with more
      specific requirements.  This has not been considered a breaking API change,
      since the original data types were too permissive and non-valid data would
      have either been ignored or broken name resolution.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0-0
changelog:
  - Switched to using puppetlabs/concat
  - Fixed the startup script for EL6
  - Fixed minor ordering issues
  - Renamed the service to 'rsyncd' to match the service name in EL7
  - Cleaned up rsyslog calls to remove logic


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Fixed minor bug in rsync provider that caused  'Unknown failure
    using insync_values?' Puppet message to be generated.


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 6.0.6-0
changelog:
  - Add `order => 'numeric'` setting to concat for rsyncd.conf
  - Add support for Puppet 5
  - Add support for and OEL


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.3-0
changelog:
  - rsyslog::server::enable_selinux now optional, for robustness
  - Updated logrotate to use new lastaction API


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.3-0
changelog:
  - Fixed bug in which default iptables rsyslog rule did not work
    with rsyslog version 7.4.7.  Some versions of rsyslog include
    the ' ' separator in the message payload, which impacts the
    startswith rule.
  - Fixed bug whereby puppetserver log messages were not being
    collected in puppetserver-specific logs.
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - Add ability to specify full rule content for rsyslog::rule::local
    and rsyslog::rule::remote defined types.
  - Fixed bug in which ioBufferSize parameter was listed twice
    in the rsyslog rule generated by rsyslog::rule::local.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.2-0
changelog:
  - Add a systemd rsyslog.service override file that fixes a service
    ordering problem present with older versions of rsyslog.  The
    override ensures the network.target and network-online.target units
    are added to the 'Wants' and 'After' lists for the rsyslog.service.


author: ralph-wright <ralph.wright@onyxpoint.com> - 7.2.0-0
changelog:
  - Remove all ActionSendStreamDriver* directives from the global
    configuration, to allow individual actions to control their specific
    stream settings.  This change was required to allow a host which is
    itself a syslog server to receive TLS-encrypted data, but forward
    these messages to a different remote syslog server as unencrypted data.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Reinstated ActionSendStreamDriverMode directive into the global
    configuration when sending TLS-encrypted messages for Rsyslog
    7 version, only. The sending of TLS-encrypted messages for CentOS 6
    will not work otherwise.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.0-0
changelog:
  - Fixed a bug in which removal of a rsyslog::rule from the catalog
    did not cause the rsyslog service to restart, when other rules
    corresponding to files in the same rsyslog configuration
    subdirectory were present.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.0.3-0
changelog:
  - Ensure that policycoreutils-python is only installed if not installed
    elsewhere. This deconflicts with various hotfixes that were needed in other
    modules.


author: Nick Markowski <nmarkowski@keywcorp.com> - 2.1.0-0
changelog:
  - Fixed a bug wherein setenforce would run if selinux was disabled
  - Changes in selinux state incur a reboot notification


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Moved management of mcstrans and restorecond to the selinux module
  - Change default packages ensure to use the catalyst
  - Update puppet requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.1.0-0
changelog:
  - Rework manifests to ensure mcstrans and restorecond services are not
    running when selinux is disabled.
  - Allow this module to manage restorecond package installation.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> -2.2.0-0
changelog:
  - simp_options::selinux was supposed to indicate if the selinux module should
    be included. Class include lists set in the simp module would include selinux  reguardless
    of this setting.  This option was also being used to set the state of selinux.
    This caused confusion so  simp_options::selinux setting was removed.
    The selinux state, set by the ensure parameter, is defaulted to 'enforcing'.
    This will result in the same behavior as if simp_options::selinux was set to true.
    See the pupmod-simp-simp module to see which scenarios include selinux by default.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.4.1-0
changelog:
  - Ensure that a file exists on EL 6 if portreserve is enabled so that the
    portreserve service does not flap


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.5.0-0
changelog:
  - changed permission on ctrl-alt-del-capture.service to prevent "no effect"
    errors in system logs.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.5.0-0
changelog:
  - In the runpuppet init script used to bootstrap kickstarted clients,
    for EL7, persist the hostname retrieved by DHCP as a static hostname.
    This prevents problems that can arise on EL7 when the DHCP lease
    expires in the middle of the client bootstrap puppet runs.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.5.0-0
changelog:
  - Narrow the focus of the internal hieradata to ensure correct runs on
    unsupported OSs
  - Update unsupported OS tests
  - Add a test to ensure that an error is throw if an invalid scenario is
    specified


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> 4.5.0-0
changelog:
  - simp_options::selinux was supposed to determine if the selinux module was
    included.  However, this value was getting overridden by the class lists
    which independently included the selinux module. This change removes the
    unused simp_options::selinux setting to eliminate the confusion.  See the
    scenario maps in the data section to see what scenarios include the selinux
    module.  See the selinux module to see how to use puppet to enable/disable
    selinux.  This may change the defaults for selinux in the `simp_lite`
    scenario.


author: Nick Miller <nick.miller@onyxpoint.com> - 4.5.0-0
changelog:
  - Add simp::netconsole class to manage the netconsole kernel feature
  - Fix a few puppet-lint warnings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.5.0-0
changelog:
  - Created standalone SIMP client bootstrap script, bootstrap_simp_client.
  - Created simp::server::kickstart::runpuppet replacement,
    simp::server::kickstart::simp_client_bootstrap, that manages service
    files for kickstarting a SIMP client, using bootstrap_simp_client
    and either a sysv (simp_client_bootstrap) or a systemd
    (simp_client_bootstrap.service) service script. This replacement
    provides the following improvements:
    - Exponential backoff of requests to the Puppet server, to minimize
      Puppet server overload.
    - Configurable bootstrap timeout.
    - An option to force a client reboot on client bootstrap failure.
    - More effective puppet agent processing.  The bootstrapping
      takes fewer puppet agent runs.
    - Finer grained control of the bootstrap algorithm.
    - Error handling
      - Bootstrap operation errors are now detected and logged.
      - Failed puppet agent runs are now retried, instead of blindly
        continuing on.
    - Timestamped log messages in the bootstrap log file.  This includes
      messages from bootstrap_simp_client, puppet agent, and fixfiles.
      service start
  - simp::server::kickstart::runpuppet is deprecated and will be removed
    in a future release


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 4.5.0-0
changelog:
  - Add Windows support
  - Change /root perms to RPM default of 0550
  - Change /etc/rc.d/rc.local perms to RPM default of 0755


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.5.0-0
changelog:
  - Use the sudo::user_specification default host list which is correct for
    almost all cases
  - Update version range of auditd dependency in metadata.json


author: Nicholas Hughes, Nick Markowski <nmarkowski@keywcorp.com> - 5.0.1-0
changelog:
  - Prevent log duplication and log where intended
  - Changed naming to XX_ or YY_ to come before the default Z_default.conf
    for local rules, but after the numbered configs used by the log_server
    class.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Renamed `add_site` to `site`
  - Strongly typed module
  - Updated module assets
  - Wrote a basic class acceptance test


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Fixed dependency logic with mod_ldap to not install it on CentOS 7
  - Rsyslog calls no longer include implied logic
  - Rsync now calls the correct share


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.1-0
changelog:
  - Create namespaced, Puppet 4 versions of externally-used Puppet 3
    functions and mark the Puppet 3 functions as deprecated. They will
    be removed in a later release.
  - apache_auth should be replaced with simp_apache::auth
  - apache_limits should be replaced with simp_apache::limits
  - munge_httpd_networks should be replaced with simp_apache::munge_httpd_networks
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.0.2-0
changelog:
  - set owned to simp_apache::user instead of simp_apache group on
    configuration files.
  - remove simpcat as dependency
  - cleaned up fixtures file


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.2-0
changelog:
  - Update systemd fixtures and CI assets
  - Update version range of auditd dependency in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Wrap puppetlabs/docker to:
    - Provide SIMP defaults
    - Add ease-of-use for using different distributions of Docker
  - Document how to set up simp/iptables to ignore docker-generated rules


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Ensure that the docker_group and socket_group options are the same by default
    for the 'redhat' release type


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0
changelog:
  - Update to puppetlabs/docker 1.0.5
    - Remove deprecated `manage_epel` parameter
  - Removed $iptables_docker_chain by default
    - The simp/iptables module has been updated so that this is not needed


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.1
changelog:
  - Update to puppetlabs/docker 1.1.0
    - $selinux_enabled changed from taking string to only taking booleans, 
      breaking the hiera interpolation trick that was used to set that parameter
      to the selinux status of the system.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: SIMP Team <simp-project.com> - 0.1.0
changelog:
  - This is the initial code for a `simp_gitlab` module, which installs
    GitLab Omnibus and incorporates it into SIMP.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.3.0
changelog:
  - Configure LDAP TLS to use the Omnibus' `trusted-certs/` instead of the LDAP
    `ca_file` setting
    (see https://gitlab.com/gitlab-org/gitlab-ce/issues/37254#note_3894021)
  - Add `ldap_verify_certificates` parameter
  - Add `ldap_ssl_protocols` parameter
  - Fixed LDAP provider name sanitation
  - Update deprecated LDAP encryption configurations for GitLab 9.4+
  - Add acceptance tests for LDAP authentication
  - Document acceptance test features
  - Removed unused `syslog` parameter


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.3.0
changelog:
  - Drop support for CentOS 6 in order to cleanly solve an intermittent
    problem in which the GitLab local user's authorized keys lock file
    could not be created.
  - Modify sshd authorized keys file configuration so that the GitLab
    installer can manage the GitLab local user's authorized keys file
    and the directory in which it resides, independent of Puppet.
    Prior to this, both the GitLab installer (via Chef) and Puppet
    were simultaneously, but independently, managing the ownership,
    permissions, and selinux contexts of that authorized keys file
    and its directory.  Since the desired settings for the directory
    were different, intermittent problems such as the GitLab user
    not being able to create its authorized keys lock file arose.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.1
changelog:
  - Updated README to note that authorized key files need to be copied
    when upgrading from version 0.2.0.


author: Ralph Wright <rwright@onyxpoint.com> - 0.1.1-0
changelog:
  - A few minor fixes for seemless install
  - Added option to install SIMP dashboards
  - Added option to allow SIMP dashboards to be installed


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Update to latest Grafana (4.2.0) and Elasticsearch (5.4.0)
  - simp_grafana::version now defaults to 'latest'
  - Confine puppet version in metadata.json


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.4-0
changelog:
  - Workaround 2-pass grafana rpm install issue in acceptance tests
  - Update README to reflect SIMP 6 global catalysts.


author: Liz Nemsick <liz.nemsick-simp@gmail.com> - 1.0.5-0
changelog:
  - Update upper range of puppet/grafana module dependency to < 5.0.0
  - Update README to include section on rubygem-puppetserver-toml


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.0.0-0
changelog:
  - First cut after being split off from the original simp-logstash module.
  - Provides a much cleaner abstraction between this and the upstream Logstash
    material from Elastic.


author: Jeanne Greulich <jgreulich@onyxpoint.com> - 3.0.0-0
changelog:
  - Update major version release for SIMP 6
  - Removed stunnel and replaced it with TCP TLS input
  - Added TLS enabled JSON input
  - Updated tests


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.0.0-0
changelog:
  - Updated to LogStash 5.X and Elasticsearch 5.X
  - Fixed type bug in simp_logstash::output::elasticsearch::action.
  - Fixed enum typo in enum for simp_logstash::output::elasticsearch::script_type
  - Fixed puppet strings problems.
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.2
changelog:
  - Added the ability to override ciphers in the create_home_directories script
    for EL6 since the cipher order does not happen from strongest to weakest and
    breaks secure LDAP connections
  - Added a check for create_home_directories to ensure that directories are not
    archived if the server doesn't respond for TLS reasons.


author: Nick Markowski <nmarkowski@keywcorp.com> - 0.0.3
changelog:
  - Updated create_home_directories to handle multiple URIs
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.5
changelog:
  - Allow users to properly disable autofs
  - Added parameter, autodetect_remote, that allows users to disable the logic
    that determines if system is an NFS server and mounts directories locally.
    This allows the mounting of home directories to another NFS server.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Updated logrotate to use new lastaction API
  - Updated all ldap DNs to uppercase DC=
  - Update puppet requirement in metadata.json


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0-0
changelog:
  - Per CVE-2014-3566, SSLv3 and TLSv1 ciphers should be disallowed. Recent-ish
    updates to openldap-servers, shipped with SIMP-6.0.0-0, includes a parameter
    to specify a minimum bound of TLS protocol in slapd.conf, TLSProtocolMin.
    (see https://access.redhat.com/solutions/1234843)
  - This commit includes puppetry to remove TLSv1.0, SSLv3, and SSLv2 from the
    TLS cipher suites, and set a minimum TLS protocol of TLSv1.2, given
    openldap-servers is >= 2.4.40.
  - Updated syncdn and binddn defaults in server::conf


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.1-0
changelog:
  - Fixed an issue where pki::copy was not correctly hooked into the server logic
    and a system PKI update would not properly propagate into the OpenLDAP
    service restart.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1-0
changelog:
  - Update to support Puppet 5 and OEL
  - Update systemd fixtures and CI assets
  - Fix acceptance test by not testing text of failure code, only the exit code
  - Remove unneeded simp/auditd dependency


author: Mark Fitch <CodePhase@users.noreply.github.com> - 6.2.1-0
changelog:
  - Ensure that the `concat` statement for `access.conf` is sorted in `numeric`
    order for consistency.


author: Nick Miller <nick.miller@onyxpoint.com> - 1.0.1-0
changelog:
  - Added more strict Puppet and PE requirements, pinning to Puppet 4.7+ and
    PE 2016.4.0+
  - Updated openssl::cipher_suite to be set to the fips_ciphers fact if it's
    available to expand the 'FIPS' shortcut, which causes issues with some
    applications (openldap)


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.0-0
changelog:
  - Added simp_options::uid and simp_options::gid classes for ID limit
    consistency across the entire infrastructure


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.2.0-0
changelog:
  - Removed simp_options::selinux.  Conflicts between this setting
    and what was in the scenario class lists was causing unexpected results.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.0.2
changelog:
  - Fixed directory for log rotate of central log server
  - add warning if possible log looping detected


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Fix bug whereby audit logs were not being forwarded to remote syslog servers. 
  - Fix bugs whereby simp_rsyslog::log_collection and simp_rsyslog::log_openldap
    parameters were overriding simp_rsyslog::default_logs instead of being merged.
  - Work around rsyslog inconsistent message parsing behavior that prevented
    iptables logs from being written to iptables.log and/or being forwarded,
    for some versions of rsyslog.
  - Ensure local audispd log messages are not duplicated.
  - Adjust local rule ordering to ensure local sudosh and apache (httpd)
    log messages are written to their own log files.
  - Restore writing of local puppet and puppet-server messages to their
    own files, by adjusting local security rsyslog rule from simp_rsyslog::local.
  - Update puppet requirement in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.0.0-2
changelog:
  - Updated the concat_output and fragmentdir functions to properly
    handle String/Array conversions in Ruby 2.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.0-0
changelog:
  - Changed from using Puppet[:vardir] to Facter.value(:puppet_vardir), which
    accounts for the different vardirs on agent and server.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.0-0
changelog:
  - Updated the simplib::ldap::domain_to_dn function to allow users to choose
    whether they want to upcase or downcase the LDAP attributes to work around
    different system bugs
  - Updated min_uid fact for OEL and Scientific Linux
  - Updated tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.9.1-0
changelog:
  - Made the `init_ulimit` custom type safe for `puppet generate types`
  - Fixed a typo in the composite namevar for `init_ulimit`
  - The following changes allow users to disable reboot notify messages
    - Adds two parameters :log_level and :control_only to the 'reboot_notify'
      custom type.
      * :log_level    => Set the Puppet log level of the generated message
      * :control_only => Indicate that this entry should not be added to
                         the generated file
    - Added a `Simplib::PuppetLogLevel` Data Type
    - Added a 'reboot_control_metadata' section to the on-system record file
    - Added a `simplib::reboot_notify` class to allow for ease of global
    metadata manipulation.
  - Fixed file paths that were not Windows compatible
  - Improved error handling in `reboot_notify` and fixed a few small bugs
  - Improved some tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.0-0
changelog:
  - Add a 'simplib::install' defined type that allows users to provide a Hash of
    packages to install along with a Hash of defaults to apply to those packages
    and override each package configuration if necessary.
    - This was originally created by Nick Miller <nick.miller@onyxpoint.com>


author: dforste <dforste@users.noreply.github.com> - 3.10.0-0
changelog:
  - Fixed bug in cmdline face where duplicate parameters would be ignored
    - Duplicate parameters now turn the value of the parameter into an array


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.0-0
changelog:
  - Added a function `module_exist` that will return whether or not a module
    exists in the current environment.
  - Fixed an issue in the 'runlevel' provider where the actual runlevel would not
    be changed at execution time


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.10.1-0
changelog:
  - Added timeout for changing runlevels based on issues discovered in the field
  - Fixed bugs in the EL6 runlevel persistence where, in some cases, the runlevel
    line might not get written to /etc/inittab


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.11.0-0
changelog:
  - Added a function `assert_optional_dependency` that allows users to fail if
    expected functionality is not present in the current environment's module
    set. This provides the ability for users to support multiple vendor modules
    without forking.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.11.0-0
changelog:
  - Fixed a bug in the `puppet_settings` fact where settings from all sections
    were interpolated using settings (like `$vardir`) from the `[main]` section.


author: Maintenance
changelog:
  2.0.0-1
  - Updated the spec file to add in the 'lib' directory and set the directory
    permissions more cleanly.


author: Nicholas Hughes - 6.1.0-0
changelog:
  - Set permissions back to what the RPM sets and security scans expect
    - /etc/ssh/moduli
    - /var/empty/sshd
    - /var/empty/sshd/etc
    - /var/empty/sshd/etc/localtime


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Convert internally-used Puppet 3 functions to Puppet 4
    - ssh_config_bool_translate is now ssh::config_bool_translate
    - ssh_format_host_entry_for_sorting now ssh::format_host_entry_for_sorting
  - Create Puppet 4 versions of externally-used Puppet 3 functions and
    mark the Puppet 3 functions as deprecated. They will be removed in
    a later release.
    - ssh_autokey should be replaced with ssh::autokey
    - ssh_global_known_hosts should be replaced with ssh::global_known_hosts


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - If the host has joined an IPA domain, set
    GSSAPIAuthentication to 'yes' in the ssh server and client
    configuration files.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.4.0-0
changelog:
  - Re-implemented `ssh::client::host_config_entry` using `ssh_config`:
    - Users can now customize additional SSH client options
    - Customizing ssh_config is consistent with sshd_config
    - Tweaked Augeas lens `ssh.aug` to handle `HostKeyAlgorithms` correctly
    - No change to the module's API
    - Removed concat + .erb templates from old implementation
  - Fixed idempotency bug with `/var/empty/sshd/etc/localtime`
    - Removed vestigial SIMP-1143 workaround from acceptance tests
  - Fixed errors in README.md
    - Ciphers and Usage sections rewritten and verified, with tests
    - Added new environment variable `SIMP_SSH_report_dir` to acceptance tests
      to validate ciphers in README
    - Documented solution to SIMP-4440 and added acceptance test
  - Removed cruft:
    - Removed grub from metadata.json and .fixtures.yml because nothing uses it
    - Removed NSCD-related cruft (/etc/pam_ldap.conf) from ancient ldap code


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.4.2-0
changelog:
  - Added some variables for sshd_config to meet STIG requirements.
    Most are just confirmation of defaults with the exception of
    ClientAliveInterval and ClientAliveMaxCount which have
    been set to activate Client Alive checks.
  - Added compliance tests to install setting from compliance
    markup module and then run inspec tests to check for compliance.
  - Update version range of auditd dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.3-0
changelog:
  - By default, do not specify the obsolete RhostsRSAAuthentication
    configuration parameter in sshd_config on systems running openssh 7.4
    or later.  Beginning with openshh 7.4, sshd emits an error message when
    this parameter is present in sshd_config.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.3-0
changelog:
  - Sssd::DebugLevel now handles all variants specfied in sssd.conf man page
  - All instances of debug_level are now typed as Sssd::DebugLevel


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Enforce limits set in /etc/login.defs for uid_min and uid_max by default and
    fall back to something sensible for SSSD


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added sssd class option to automatically configure SSSD for an IPA
    domain, when the host is joined to an IPA domain.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Some template and concat changes to make debugging the module easier
    - Add headers to more easily diagnose where to stick params
    - Order the concat sections
  - Add some missing params from sssd::provider::ad
    - default_shell
    - dyndns_update
    - fallback_homedir
    - krb5_realm
    - krb5_store_password_if_offline
    - ldap_schema


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.2-0
changelog:
  - Avoid changing the permissions from the vendored RPM
    - /etc/sssd/ owner is no longer managed
    - /etc/sssd/ perms went from 0640 to 0711
    - /etc/init.d/sssd went from 0754 to 0755 on EL6
  - Update version range of auditd dependency in metadata.json
  - Cleanup requires in metadata.json
  - Cleanup unneeded fixtures and update CI assets


author: Ryan Russell-Yates, Liz Nemsick - 6.0.1-0
changelog:
  - Flesh out README
  - Remove OBE 'pe' requirement from metadata.json
  - Update puppet version in .travis.yaml


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.1.0
changelog:
  - Added a define, stunnel::instance
    - Creates standalone connections with their own configurations
      and services
    - Adds systemd support
    - Possible to chroot when selinux is permissive/enforcing
    - Backwards compatible with existing stunnel configurations
  - stunnel::connection is unofficially deprecated until the SIMP-7
    release, at which point stunnel::instance will replace
    stunnel::connection
  - Update puppet requirement in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0
changelog:
  - Added acceptance test to switch between SELinux enabled and disabled
    - Renamed them to make more sense
  - Updated SysV scripts for safety concerns
  - PKI now is now owned by the proper $setuid
  - Renamed templates to make more sense
  - Manage PID dir in Puppet when possible
    - Fixed bug where PID dir was being created with SELinux contexts
      even when SELinux was disabled
  - Added systemd unit to `connection` for use on EL7 systems
  - Switched tenplates to use a safe name
  - Added support for Puppet 5


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.1
changelog:
  - Add feature to systemd init script to kill stunnels started from
    the previous version of the module
  - Fixed bug where `stunnel::config::pid` was being ignored


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Isolated the 'instance' logic away from the 'connection' logic
  - Added a private 'monolithic' class that arranges everything properly for the
    legacy stunnel connections
  - Ensure that 'instances' and 'connections' do not conflict by using a
    'reserve_port' class
  - Add a native type that will clean up all instances that would be randomly
    created by the 'stunnel::instance' defines and will come before both legacy
    and new stunnel connections so that we do not have random left over services
    that may conflict with new services


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.0
changelog:
  - Fixed bug in which the stunnel systemd pre-exec script failed to
    execute completely, because one command did not have a fully
    qualified path.
  - Reworked stunnel systemd pre-exec scripts to only emit error
    messages when errors have occurred.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0
changelog:
  - Ensure init.d script is absent if systemd system because puppet
    was finding it and running it and setting permissions on root to
    stunnel:stunnel.
  - Ensure pid file name is not left undefined to prevent unplanned results.
  - Added check to make sure chroot has not evaluated to '/'.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.1
changelog:
  - Added two new parameters to the stunnel::instance define:
    - systemd_wantedby: sent to the WantedBy systemd unit install directive
    - systemd_requiredby: sent to the RequiredBy systemd unit install directive
    - These should allow ordering during boot. For example, if you have NFS set up
      over stunnel, you want stunnel to start before NFS.
  - Fixed the systemd startup scripts to properly pre-create the PID directory if
    required


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.3.2
changelog:
  - Updated selinux settings in acceptance tests to reflect removal of
    simp_options::selinux setting and use selinux::ensure setting.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.2
changelog:
  - Fix the service name used by stunnel so that tcpwrappers would not
    incorrectly drop connections.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.0.1-0
changelog:
  - Fixed the validation command on the concat resource to actually validate the
    temp file prior to putting it in place


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.0.6-0
changelog:
  - Added minimum size for sudo::user_specification::hostlist, because an
    empty list is not permitted.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Trevor Vaughan - 3.2.0-0
changelog:
  - Enabled the new, kinder, svckill by setting the default mode to 'warning'
  - Added a `svckill::enable` parameter to be able to disable svckill from Hiera
    easily


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - In the service kill provider, not all services queried by 'Name'
    with systemctl would return a name.  That caused a break in symlink
    logic, rendering a majority of aliases to remain undetected.  Error
    detection has been added and the symlink logic has been re-worked.


author: Nick Markowski <nmarkowski@keywcorp.com> - 3.2.1-0
changelog:
  - Implemented simplib::knockout on the ignore list so users can
    remove items in the default list via hiera.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.1-0
changelog:
  - Fix bug whereby svckill provider's insync_values? emits
    'Unknown failure' message during normal operation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.4-0
changelog:
  - Fix bug in which svckill provider can fail on a server for which
    there are are no aliased, SystemD services.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.2.6-0
changelog:
  - Add simp_client_bootstrap service to the ignore list.  If this
    is omitted from the ignore list, svckill will kill the bootstrap
    process of SIMP clients, while they are boostrapping the system.


author: Nick Markowski <nmarkowski@keywcorp.com> - 4.1.1-0
changelog:
  - Inclusion of FIPS in the initrd kickstart option list is now optional.
    By default, we no longer set fips=1 in initrd.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Added support for UEFI PXEboot.
    - Added tftpboot::linux_model_efi.
      Added tftpboot::assign_host_efi.
    - Tested primarily on CentOS 7 (grub2). Testing of CentOS 6 UEFI
      boot with legacy grub is **pending**.
  - **Moved** the tftproot root directory from /tftpboot to /var/lib/tftpboot
    to satisfy the STIG RHEL-07-040520 check.
  - Added tftpboot::tftpboot_root_dir to allow users to override
    the new default root directory (e.g., to set it back to /tftpboot).
  - Added tftpboot::linux_install_dir and tftpboot::package_ensure
    to allow more fine-grained control of this module.
  - Explicitly set selinux context on tfptboot files/directories to
    tftpdir_t in order to restrict their access to read-only tftpd
    operation.
  - Internally, refactored configuration to use small, private classes.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.0-0
changelog:
  - Added a feature to manage the PKCS#11 slot provided by the TPM
  - Also added a class that takes advantage of it


author: Nick Miller <nick.miller@onyxpoint.com> - 0.2.1-0
changelog:
  - Added a check to the ima_log_size fact to make sure that the file
    needed exists before executing


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.0-0
changelog:
  - Improvments to the facts:
    - Add tests for following facts:
      - tpm
      - ima_log_size
      - has_tpm
    - Confine tpm fact on the existance of the `tpm-tools` package
    - Migrate to the built in facter timeout
  - Improvements to the `tpm_ownership` provider
    - Added instances feature
      - run `puppet resource tpm_ownership` and see the resource
    - New properties to the type to reflect system state
    - Changed default owner_pass to 'well-known'
    - Removed 'ensure' parameter in favor of the 'owned' param
    - Improved documentation
  - Improvements to the `tpm::ownership` class
    - Added 'owned' parameter to pass to the tpm_ownership type
  - New `tpm::tboot` class to enable Trusted Boot
    - See `tpm::tboot` for details
    - Automatically lock the kernel package and other kernel related packages to
      avoid automatically invalidating launch policy
  - Depend on augeasproviders_grub instead of generic and deprecated
    augeasproviders


author: Nick Miller <nick.miller@onyxpoint.com> - 1.1.1-0
changelog:
  - Updated to support Puppet 5
  - IMA policy service
    - Moved the import_ima_rules systemd unit file from /usr/systemd to /etc/systemd
      on systemd based systems
    - Service is now stopped, but enabled, so will only take affect at reboot,
      not during puppet run


author: Nick Miller <nick.miller@onyxpoint.com> - 1.2.0-0
changelog:
  - tpm::ima::policy was not previously callable from tpm::ima
  - tpm::ima::policy will now disable many default IMA checks by default


author: Chris Tessmer <chris.tessmer@onypoint.com> - 4.1.0-4
changelog:
  - migration to simplib and simpcat (lib/ only)
  - Fixed a set of bugs that were introduced to the 'job.erb' template.
  - Code cleanup


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Use strongly typed parameters
  - Fix bug whereby optional, respawn limit was not properly specified
    in upstart jobs.
  - Refined upstart::job::sys_limit validation to reject non-integer numbers.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.1
changelog:
  - Initial release of module
  - This module is a collection of conf files regarding users and user creation.
    - Most of the content used to be in simplib


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Provided the ability to simply add shells to /etc/shells
  - Removed all entries from /etc/securetty by default to match the latest
    standard best practices. This removed ZSH.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.1
changelog:
  - Fixed useradd::libuser::defaults_crypt_style to only be a String of the
    allowed values
  - Ensure that the 'modules' field is not printed if the passed Array is empty
  - Ensure that defaults_hash_rounds_min is less than defaults_hash_rounds_max
    and that both are within an allowed range
  - Update useradd::login_defs::pass_min_len to 15 to match the rest of the module updates


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Fix bug in libuser.conf where userBranch was referencing groupbranch variable
  - Added/fixed author on all manifests
  - Created Acceptance test
  - Updated spec/spec_helper_acceptance.rb
  - Added Managed by Puppet comment to all file templates
  - updated default nodeset
  - Added notes to login_defs.pp regarding min and max passwd length
  - Cleaned up documentation and made style changes


author: Brandon Riden <brandon.riden@onyxpoint.com> - 0.2.0
changelog:
  - Allow users to specify colors as strings instead of ansi codes in sysconfig/init
  - Updated sysconfig_init.pp to reflect these changes as well as add notes
  - Updated template to convert color strings to ansi code


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.1
changelog:
  - Set the minimum and maximum UID and GID allowed onto the system to the
    default defined in /etc/login.defs or a sensible default if not otherwise
    specified


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.0.1-0
changelog:
  - Removed unecessary code and deps after major dep releases
  - Locked versions of all build and test deps


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.3-0
changelog:
  - Ensure that the default VNC sessions set the IPv4 flag
  - Ensure that the default VNC sessions set the banner to /dev/null


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fixed bug whereby manifest would fail to compile if the force_dot_files
    parameter of ::vsftpd::config was set
  - Fixed bug whereby vsftpd.conf configuration values to be set to 'NO'
    were not written out to that file
  - Fixed bug whereby listen configuration parameter for vsftpd.conf was
    not set based on $listen_ipv4 parameter of ::vsftpd
  - Convert to explicit parameter types


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - New pki scheme
  - Real integers and simplib types implemented
  - Application certs now managed in /etc/pki/simp_apps/vsftpd/x509


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-0
changelog:
  - By default, use TLS 1.2 instead of TLS 1.0.
  - Eliminate the use of deprecated validate_net_list() through
    better strongly-typed parameters for IP addresses and hosts.
  - Add CentOS 6 acceptance tests.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.0-0
changelog:
  - Use simp_options module for global catalysts
  - Fix bug in xinetd.service.erb that caused an inadvertant newline between the
    IP address and port in a redirect configuration line in the generated file.
  - Fix bug in xinetd.service.erb in which the instances and mdns configuration
    lines were omitted from the generated file.
  - Fixed bug in xinetd.service.erb in which includedir and include were specified
    within a service declaration and formatted incorrectly.
  - Fixed bug in validation of syslog facility
  - Fixed bugs in validation of ::xinetd $passenv and $disable parameters
  - Fixed bugs in validation of ::xinetd::service $x_id and $rpc_version parameters
  - Minor cleanup


author: Nick Miller <nick.miller@onyxpoint.com> - 4.0.1-0
changelog:
  - Updated data types to use new Simplib types
  - Corrected simp_options lookups to not have a context prefix of '::'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.2-0
changelog:
  - Update to Puppet 4 custom functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


