# changelog

author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.2-0
changelog:
  - Fixed README typos
    - Cleaned up code
    - Added acceptance tests
    - Added support for `auth_membership`
    - Fixed code regression from d49cf32
      - Thanks for the notification from John Warburton
    - Validated noop message was correct
    - Fixed sort order when checking user lists against the system


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 1.0.4-0
changelog:
  - 1.0.3 was tagged, bumping to 1.0.4
  - Fix addresses https://github.com/onyxpoint/puppet-gpasswd/issues/7
  - Before this fix, users could not specify groups in the system
    GID range, SYS_GID_[MAX,MIN] in /etc/login.defs. Added system_groups
    feature to gpasswd.
  - Added beaker tests to ensure groups can be created within the system range.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.6-0
changelog:
  - Refactored the module to work with Puppet > 5.5.6
    - Puppet 5.5.7 broke the Type/Provider interface in the 'group' type so
      required an emergency refactor


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.0-0
changelog:
  - Add EL8 support
  - Fixed a bug where the system would incorrectly attempt to process users even
    if the user was not known to the underlying system


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.1-0
changelog:
  - Execute a single modify command instead of a list of 'add' and 'delete'
    commands
  - Capture stderr on command runs


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.1.2-0
changelog:
  - Fixed an issue with running `puppet resource group`
  - Added support for Puppet 7
  - Dropped support for Puppet 4


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.3-0
changelog:
  - Validate functionality under Puppet 5
  - Test against Oracle Enterprise Linux
  - Change default state of the acpid package to reference
    `simp_options::package_ensure`, defaulting to `installed`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.1-0
changelog:
  - With contributions from ischmidt1235 on GitHub
  - Add InSpec compliance tests
  - Fix bug in Compliance Engine data
  - Add SCAP compliance tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0-0
changelog:
  - Add EL8 support
  - Move the default rules to data in modules
  - Make simp-logrotate, simp-syslog, and simp-auditd optional dependencies


author: Alexander Fisher <alex@linfratech.co.uk> 6.4.0-0
changelog:
  - Automatically add `@@include` lines to aide.conf
    Previously, when declaring `aide::rule` resources, it was also
    necessary to add the rule name to the `$aide::rules` array.
    By switching to using `concat` this is no longer necessary. Instead the
    `rules` parameter is repurposed to accept a hash of `aide::rule`
    resources.


author: Trevor Vaughan <tvaughan@onyxpoint.com> 6.4.2-0
changelog:
  - Update the EL8 ciphers to be safe on FIPS systems by default
    - Do not use the built-in aliases
  - Remove overrides for aide::aliases on EL8 since it works properly in FIPS mode


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.0
changelog:
  - Changed
    - Default to `systemd` for scheduling
    - Use `--check` instead of `-C` by default to match what most scanners expect
    - Randomize the minute field so that I/O load is reduced on hosting platforms
  - Added
    - Puppet 7 support
    - Allow users to choose between the following options:
      - `systemd` => Default - Use systemd timers
      - `root`    => Legacy - Update root's crontab
      - `etc`     => Scanner Compat - Update /etc/crontab using Augeas
    - When one method is chosen, the others will be disabled
  - Removed
    - Puppet 5 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Ensure that entries in 'at.allow' are not commented out by default
  - Updated the Gemfile to pin to the latest working Beaker


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.6.5
changelog:
  - Fixed
    - Align EL8 STIG settings
  - Changed
    - Bump supported puppet version to include 7
    - Always add the 'head' rules (global auditd config) settings when applying
      rule sets. These do not interfere with user-defined rules and are required
      for proper functionality of the system.


author: Mike Riddle <mike@sicura.us> - 8.7.2
changelog:
  - Changed the auditd_sample_rulesets fact to look in both
    /usr/share/audit/sample-rules and /usr/share/doc/audit*/rules for
    sample rulesets.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Allowed for control of specific versions of the packages in this
    module with two new parameters:
    - samba_package_ensure
    - autofs_package_ensure
  - Support Puppet 5


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 6.1.2-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.3-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed a URL in the README.md


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 6.2.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Added support for EL8
  - Dropped support for EL6
  - Refactored the module.  Notable feature/API changes:
    - Updated autofs service configuration to use /etc/autofs.conf in
      addition to /etc/sysconfig/autofs.
    - Updated autofs.master to load content from /etc/auto.master.simp.d/
      and /etc/auto.master.d/ in lieu of specifying map entries directly.
      - auto.master entries are now written to files in /etc/auto.master.simp.d,
        a directory fully managed by this module.
      - /etc/auto.master.d is left unmanaged by Puppet.
    - Added a autofs::map defined type that allows the user to specify all
      the parameters for a 'file' map in once place.  This resource will
      generate the appropriate resources to create both the auto.master entry
      file and the map file.
    - Added autofs::masterfile defined type to replace deprecated
      autofs::master::map
      - autofs::masterfile creates a auto.master entry file in
        $autofs::master_conf_dir
      - Unlike autofs::map::master, autofs::masterfile does not have a $content
        parameter, because a user can simply use a file resource to specify
        a custom auto.master entry file.
    - Added autofs::mapfile defined type to replace deprecated
      autofs::master::entry
      - autofs::mapfile creates a mapfile for a direct mapping or one or
        more indirect mappings
      - Unlike autofs::master::entry, it does not have duplicate resource naming
        problems (wildcard or otherwise).
    - autofs class changes
      - Added the following new autofs service configuration parameters:
        - $master_wait
        - $mount_verbose
        - $mount_nfs_default_protocol
        - $force_standard_program_map_env
        - $use_hostname_for_mounts
        - $disable_not_found_message
        - $sss_master_map_wait
        - $use_mount_request_log_id
        - $auth_conf_file
        - $custom_autofs_conf_options
      - Added $master_conf_dir and $master_include_dirs parameters to allow
        users to specify directories containing auto.master entry files.
      - Added $maps_dir to specify the location of SIMP-managed maps and
        changed the directory name from /etc/autofs to /etc/autofs.maps.simp.d
        for clarity.
      - Added $maps to allow users to specifie 'file' type maps in Hieradata.
        - Each map specifies the contents of an autofs master entry file and
          its mapping file.
      - Renamed $options to $automount_options for clarity.
      - Renamed $use_misc_device to $automount_use_misc_device for clarity.
      - Removed $autofs::master_map_name
        - This parameter is not exposed in /etc/autofs.conf and does not look
          like it is intended to be changed.
      - Changed permissions of /etc/auto.master and /etc/sysconfig/autofs
        to match those of the delivered RPM.
    - autofs::ldap_auth class changes
      - autofs::ldap_auth is now a private class to ensure the name of the
        configuration file created by this class matches the 'auth_conf_file'
        setting in /etc/autofs.conf.
      - Added $encoded_secret optional parameter.  This parameter takes
        precedence when both $secret and $encoded_secret parameters are
        specified
    - autofs::map::master has been deprecated by autofs::map or
      autofs::masterfile.  Its behavior has changed from writing a section
      of /etc/auto.master to writing an autofs master entry file in
      $autofs::master_conf_dir.
    - autofs::map::entry has been deprecated by autofs::map or autofs::mapfile.
      Its behavior has changed from writing a file in /etc/autofs to writing
      a file in $autofs::maps_dir.


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.2.0-0
changelog:
  - Standardized cron datatypes to use the Simplib::Cron::### types.  This
    allows more flexibility in cron scheduling.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.1.0-0
changelog:
  - Add package_ensure parameter to use simp_options package_ensure value
    for managing the installation of packages.
    If simp_options is not being used it will default to install (
    previously set to latest)
    If not using simp_options the value  can be changed  by setting clamav::package_ensure
    to latest in hiera.
  - update Gemfile to use puppet ~> 5.0
  - update .rubyversion to 2.4.4


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 6.4.0-0
changelog:
  - Updated the README to clarify what simp_options::clamav actually does
    and to note that clamav was removed from the SIMP's default class list
    in SIMP 6.5.
  - Set the default for clamav::set_schedule::enable to lookup clamav::enable,
    so that class will remove the clamav schedule if clamav is disabled.


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 3.1.5-0
changelog:
  - Fix and document `compliance_markup::debug::dump` and
    `compliance_markup::debug::hiera_backend_compile_time` keys
  - Bump puppetlabs-stdlib dependency to allow version 7


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.1.5-0
changelog:
  - Ensure that using a string for 'compliance_markup::enforcement' will not cause
    the server to hang
  - Fix data recursion issues


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Removed deprecated audit metaparameter
  - Added basic acceptance test
  - Made sure the cron::user class doesn't use the pam module if pam is false
  - Update puppet dependency and remove OBE pe dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.1
changelog:
  - Fix a bad URL in the README.md
  - Expand the range of stdlib Puppet module versions required in metadata.json


author: Robert Vincent <pillarsdotnet@gmail.com> - 0.2.0
changelog:
  - Remove Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Add puppetlabs/concat 6 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0
changelog:
  - Minor code refactor
  - Manage cron packages by default
  - Update supported version of simp-simplib
  - Add EL8 support
  - Move PAM to an optional dependency


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.3-0
changelog:
  - Ensure that the crypto-policy version is at a non-fatal bug level
  - Add support for Puppet 7
  - Fixed error string in main class


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3
changelog:
  - Fix issue with duplicate resources when creating multiple `dconf::settings`
    resources under the same namespace.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Add EL8 support
  - Fixed the README
  - Added REFERENCE.md
  - Allow users to set custom settings via Hiera
  - Fix `ensure = absent` in `dconf::settings`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0
changelog:
  - Add deferred_resources::users
  - Add deferred_resources::groups
  - Add deferred_resources::files
  - Add 'override_existing_attributes' capability to the 'deferred_resources'
    native type
  - Drop Puppet 4 support
  - Add Puppet 6 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.3
changelog:
  - Remove 'ftp' and 'games' users and groups when enforcing STIG
    compliance.
  - Support simp/simplib 5.x.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $dhcp::dhcpd::package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Remove support for Puppet less than 4.10.4
  - Add Puppet Strings documentation
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Add EL8 support
  - Updated README.md
  - Added REFERENCE.md
  - Made use of rsync optional (enabled by default for backwards compatibility)
  - Add support for passing in a full dhcpd.conf entry
  - Ensure that the SELinux user and type are set for the configuration files
  - Switch to using iptables::listen::udp for firewalld compatibility
  - Add acceptance test


author: Trevor Vaughan <tvaughan@onyxoint.com> - 0.1.1
changelog:
  - Fixed
    - Ensure that dirsrv.target is enabled so that all 389ds instances start at boot
    - Set the journald LogLevelMax to warning for instances to reduce unnecessary
      log noise


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.1-0
changelog:
  - Ensure that EL8 updates trigger updating the global system crypto policy since
    some subsystems now ignore the local configuration by default.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.3-0
changelog:
  - Fix: Update the beaker nodesets to embed the SSH crypto configuration.
     - This prevents issues when the underlying user's SSH settings would not
       otherwise allow FIPS-compatible algorithms for older systems.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.4
changelog:
  - Fixed:
    - Ensure that dracut_rebuild is called when the fips kernel parameter is
      changed
    - Try to call fips-mode-setup (EL8+) before falling back to the raw dracut
      command
    - Fixed the acceptance test fact checks
  - Changed:
    - Added Puppet 7 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.5
changelog:
  - Fixed:
    - Now use the simplib__crypto_policy_state fact instead of
      crypto_policy__state due to module dependency issues.


author: Nick Markowski <nmarkowski@keywcorp.com> - 7.0.0-0
changelog:
  - Updated global catalysts
  - Refactored module
  - Application certs now managed in /etc/pki/simp_apps/freeradius/x509


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 8.0.0-0
changelog:
  - Refactored API
  - Strong typed all variables and updated functions for puppet 5 compatability.
  - Removed support for freeradius version 2 and CentOS 6.
  - Inner-tunnel site is not added by default any more.
  - Added check for FIPS mode and fail if server is in FIPS mode.
  - Created ldap site and module to be used to integrate freeradius
    with ldap server.  Instructions for use are in the README.
  - SQL sites are not added by default.
  - Update the upper bound of stdlib to < 6.0.0
  - Added acceptance and spec tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.0.1-0
changelog:
  - Updated documentation
    - Cleaned up for `puppet strings`
    - Added REFERENCE.md
    - Updated README.md
  - Switched all FIPS checks to use top level inherited checks
  - Add Puppet 6 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.1.0-0
changelog:
  - Remove `simp_options::puppet::server` from the default lookup logic
    for `freeradius::v3::modules::ldap::server`. In systems that use Bolt
    to compile and apply manifests, that setting will not be available.
  - Add types documentation


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.1.0-0
changelog:
  - Fix missing `group_filter` option in LDAP
    - Add support for overriding post-auth in LDAP
    - Add support for overriding accounting in LDAP
    - Add support for specifying the entire file content
    - Fix OEL tests
    - Add support for simplib < 5


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.3.0
changelog:
  - Added EL8 support
  - Added check for hidepid on /proc.  If it is on, update the systemd-logind service
    entry to include the hidepid group as a supplementary group and restart the
    systemd-logind service.
  - Added pam access entry for gdm user so greeter session can start.
  - Added error message if gdm version older than 3.0 is used.
  - Added the following parameters:
      gdm::pam  - indicates if pam is controlled by simp.  If this is set to
                  true then a pam access rule is added to allow the gdm user
                  local access to the system. Defaults to simp_options::pam.
      gdm::display_mgr_user  - the name of the user that the gdm service will run under.
                  Defaults to 'gdm'
  - simp/gnome and simp/auditd were removed from the dependencies
    in metadata.json.
  - simp/pam was added to optional dependencies and is needed if gdm:pam
    is set to true.
  - removed pulseaudio from list of packages because gdm has dependency  on it
    so it will automatically be installed.


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - module was rewritten
    - takes advantage of the data in modules paradigm
    - has a single point of entry
  - packages now default to 'installed' or the package_ensure catalyst
    from simp_options
  - gnome::dconf::add
    - deprecated in favor of gnome::config::dconf
    - this class is now a temporary shim to ensure backwards compatibility
  - gnome::config::dconf
    - allows setting more than one key/value pair (only one could be set
      in dconf::add)
    - class name is not a verb
    - dconf settings controlled by this class can be modified in data,
      including removing default settings


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Add libxkbcommon-x11 to required package list for CentOS/RedHat 7.4.
  - Remove unnecessary CentOS data-in-module files.  The OS family fact
    for CentOS is RedHat, so these files are not used.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.0.0-0
changelog:
  - Removed all GDM and Dconf settings - BREAKING
    - Dconf has been moved to its own module
  - Ensure that all settings are 100% GNOME specific
  - Fixed a typo in the `dconf_hash` where `automount-never` was specified
    instead of `autorun-never`
  - Add support for OEL and Puppet 5


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 9.0.0-0
changelog:
  - Add EL8 support
    - add dconf settings to dconf hash to ensure users can not disable
      lock screen or show passwords in plain text
    - update package lists.  Common package list is now packages common to
      gnome V3.
  - Remove support for EL6
    - removed support for gnome2
    - removed the gconf parameters and settings.
    - removed test logic
    - removed parameter gnome::gconf_hash
    - removed parameter gnome::enable_gnome


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.5.0-0
changelog:
  - Remove Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Maintenance: removed OBE build/rpm_metadata/requires


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.7.0
changelog:
  - Ensure that haveged does not start by default if rngd is running
  - Add `haveged__rngd_enabled` fact
  - Remove all remaining EL6 code
  - Migrate all capabilities to systemd
  - Update parameter documentation and generate REFERENCE.md
  - Add support for Puppet 7
  - Fix spec tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.7.1
changelog:
  - Fixed
    - Mask the service when disabling for rngd compatibility so that it is not
      restarted on reboot
  - Changed
    - Support puppetlabs/stdlib 7.X
    - Updated REFERENCE.md


author: Michael Morrone <michael.morrone@onyxpoint.com> - 0.1.1
changelog:
  - Removed the HIRS package dependency list that was in common.yaml,
    as the HIRS RPM now appropriately specifies its dependencies.
  - Removed the softlink in the install manifest, because it is no longer
    needed with the newer HIRS package.
  - Updated the upper bound of puppet and stdlib to < 7.0.0
  - Updated RPMs for installation and testing
  - Updated Travis and GitLab Test matrices


author: Jeanne Greulich<jeanne.greulich@onyxpoint.com> - 0.1.3
changelog:
  - Updated tests to use tpm2 simulator package from download.simp-project.
  - HIRS tpm provisioner software does not run on EL8 yet.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.5
changelog:
  - Disabled the TPM 1.2 tests due to upstream ACA issues
  - Worked around a bug in the ACA for the tests
  - Added java installation to the module since it is a required dependency
  - Bumped the puppet and puppetlabs/stdlib supported versions


author: Nick Miller <nick.miller@onyxpoint.com> - 0.3.0-0
changelog:
  - Stop managing the systemd unit file, because deviating from the RPM defaults
    violates the STIG
  - Set /etc/incron.d to 0755, the RPM default


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.0-0
changelog:
  - Add the ability to set the 'max_open_files' ulimit
  - Add Incron::Mask Data Type denoting valid incron masks
  - Add `incron::purge` parameter to optionally delete all unmanaged files in
    `/etc/incron.d`. This may be enabled by default in the future but is
    currently disabled to preserve the existing functionality.
  - Added support for the new options starting with 0.5.12
    - Automatically strip out options that are not supported by earlier versions
      for seamless backward compatibility


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.4.1-0
changelog:
  - Fixed a bug in the incrond_version fact in which an error message
    was displayed during fact resolution, on systems for which incron
    was not installed.
  - Expanded the upper limits of the concat and stdlib Puppet module versions


author: Mark Fitch <CodePhase@users.noreply.github.com> - 6.3.1
changelog:
  - Allow LOCAL-INPUT jump rule in FORWARD and INPUT chains to occur last as a
    default action through the addition of an
    iptables::rules::base::force_local_input parameter


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0
changelog:
  - Fixed some bugs in the 'munge' portions of the native types.
  - Improved the internal rule matching to handle most netmask and port updates.
  - Added a `exact_match` Boolean to the `iptables_optimize` and
    `ip6tables_optimize` native types to allow for more aggressive rule matching.
    - This change requires that inbound rules match whatever is returned by
      `iptables-save` and/or `ip6tables-save` to prevent iptables flapping.
  - **Experimental** firewalld support
    - Added support for voxpupuli/firewalld
    - Added an `iptables::firewalld_shim` class for configuring firewalld in
      accordance with the current iptables configuration.
    - Ensure that the iptables::listen::* will work in firewalld mode
    - No work has been done to convert the advanced capabilities such as
      scanblock.
    - Will automatically use firewalld in EL 8
    - Allows optional enabling of firewalld in EL 7 by either setting
      `iptables::use_firewalld` to `true`
    - IPv6 is not currently supported due to needing to move the auto-detection
      logic to a higher level. Preferrably, this will go into the upstream
      firewalld module.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.0
changelog:
  - Removed the experimental firewalld support
  - Hooked the module into the new simp/simp_firewalld module


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.1
changelog:
  - Ensure that all addresses are normalized when rules are processed
  - Remove nested looped rule normalization of addresses since it is no longer
    required
  - Fix normalize_addresses() so that it simply grabs the netmask if present and
    slaps on the appropriate one if not


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.5.4
changelog:
  - Fixed a bug in which the iptables services and rules were not
    managed when iptables::use_firewalld was set to true on an
    EL6 system.
  - Fixed an ordering issue with setting `xt_recent` parameters that
    could occur on OEL7 nodes. However, there are other issues
    with `xt_recent` on OEL that may prevent this module from
    working on OEL in some circumstances.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.5
changelog:
  - Fixed
    - Moved the service-relevant files out of `install` and into `service`
    - Ensure that EL8+ installs `iptables-service` instead of trying to install
      the EL7 packages
    - Call `iptables::install` in all enabled modes since `firewalld` may require
      the underlying packages


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.3-0
changelog:
  - Removed the static banners from the module and tied the module to the
    `simp/simp_banners` module
  - Add support for OEL and Puppet 5


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.0.3-0
changelog:
  - Update static assets
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges in README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.3-0
changelog:
  - Allow users to modify the owner, group, and mode of files that may be used by
    multiple subsystems


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.4-0
changelog:
  - Changed the packages from 'latest' to 'installed'
  - Ensure parameters will also now respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.5-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Use simplib::validate_re_array() in lieu of validate_re_array(),
    a deprecated simplib Puppet 3 function.
  - Removed unnecessary use of validate_port() on parameters of type
    Simplib::Port
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Robert Vincent <pillarsdotnet@gmail.com> - 7.1.0-0
changelog:
  - Remove Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Support puppetlabs/stdlib 6.x and puppet 6.x.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0-0
changelog:
  - Add EL8 support
    - Update SELinux hotfix
    - Migrate SELinux hotfix to vox_selinux::module
  - Update documentation
  - Add REFERENCE.md


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.2.0
changelog:
  - Removed
    - Removed support for Puppet 5
    - Removed unnecessary use of top scope in manifests
  - Ensured support for Puppet 7 in requirements and stdlib


author: Adam Yohrling <adam.yohrling@onyxpoint.com> - 3.4.0-0
changelog:
  - Add support for IKEv2 Mobility (RFC-4555) and mobile client connections
  - Add additional settings for DNS and Domains for libreswan v3.23+


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.4.1-0
changelog:
  - Updated/corrected documentation
  - Added REFERENCE.md
  - Removed the unused libreswan::use_certs parameter
  - Converted libreswan::params to module data
  - Hooked service notifications at the class levels


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.5.0
changelog:
  - Removed obsolete configuration options whose presence prevent the
    ipsec service from starting on EL8. The corresponding deprecated
    parameters are as follows:
    - `libreswan::ikeport`
    - `libreswan::nat_ikeport`
    - `libreswan::klipsdebug`
    - `libreswan::perpeerlog`
    - `libreswan::perpeerlogdir`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.2.1-0
changelog:
  - Update the upper bound of stdlib to < 6.0.0
  - Workaround a change in behavior of ensure_packages with stdlib 5.x.
    This change caused resource conflicts.
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 5.3.0-0
changelog:
  - Add support for EL8
  - Update README.md
  - Add REFERENCE.md
  - Fix issues with module data
  - Split out install and service into separate classes


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.0-0
changelog:
  - Move SIMP-specific logrotate rules to a SIMP-managed configuration
    directory, /etc/logrotate.simp.d, and ensure logrotate processes
    that directory first. This ensures SIMP rules take priority, when
    duplicate rules are specified.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.3.0-0
changelog:
  - Added OEL and Puppet 5 support
  - Add some previously impossible to configure options
    - the hourly rotate period
    - dateyesterday
    - shred and shredcycles
    - su and su_user and su_group (inapplicable on EL6)
  - Added Logrotate::Periods type alias which allows hourly rotation


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.5.0-0
changelog:
  - Allow all log size configuration parameters to be specified in bytes,
    kilobytes, megabytes, or gigabytes.
  - Fixed a bug in which the size parameter in the global logrotate configuration
    file was specified more than once.
  - Added ability to specify maxsize configuration for specific log rotate rules.


author: Nick Miller <nick.miller@onyxpoint.com> - 5.1.0-0
changelog:
  - Added $package_ensure parameters to mozilla::firefox and mozilla::thunderbird
    - Changed the package from 'latest' to 'installed'
    - Each package ensure parameter will also respect `simp_options::package_ensure`
    - Removed the architecture qualifier from the name of each package resource


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.3.0
changelog:
  - Add install_options param to mozilla::thunderbird for the package install.
    The install_options are undef except for OEL7 where they enable the repo,
    ol7_optional_latest, which contains the thunderbird rpm.
  - Also updated test nodesets to the latest configuration.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.1-0
changelog:
  - Allow users to force enabling/disabling of the chroot settings
  - Allow users to easily set the 'named_write_master_zones' SELinux boolean in
    case they need to support dynamic DNS or zone transfers.
  - Added REFERENCE.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.1.0-0
changelog:
  - Ensure that the acceptance tests pass and bring up the bridge device
  - Fix the fact that network::global could break networking
  - Expose failures during Exec's of network-related activity
  - Add NetworkManager support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Add EL8 support
  - Fix a bug where both the legacy network and NetworkManager were activated in
    all cases


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.1
changelog:
  - Fixed:
    - Ensure that the network::eth define honors the network::auto_restart
      parameter by default
    - Updated the network::eth define to use the modern facts to get IP addresses
      to prevent interface flapping


author: Jeanne Greulich <jeanne,greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - Update static assets for puppet 5
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.2.1-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Updated URLs in the README.md


author: Robert Vincent <pillarsdotnet@gmail.com> - 7.0.0-0
changelog:
  - Remove Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Add puppetlabs-concat 6 support


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0-0
changelog:
  - Added EL8 support
  - Dropped EL6 support
  - Refactored the module.  Notable feature/API changes:
    - Overall changes
      - Dropped stunnel support for NFSv3.  This tunneling did not work because:
        - The NFS client sends the NFS server Network Status Manager (NSM)
          notifications via UDP, exclusively.
        - At multi-NFS-server sites, a unique `rpcbind` port per server is
          required in order for a NFS client to be able tunnel its
          server-specific RPC requests to the appropriate server.
      - nfs class
        - Reworked parameters to reflect configuration of /etc/nfs.conf and,
          for limited EL7-only configuration, /etc/sysconfig/nfs.  See the class
          documentation for full details.
      - Remove $stunnel_systemd_deps and $sunnel_tcp_nodelay parameters throughout
        the module.
        - These parameters were not consistently used in the manifest
          code (i.e., declared but not used) and were confusing.
        - The corresponding $stunnel_socket_options and $stunnel_wantedby
          parameters in classes/defines now use defaults that were intended to be
          set by those parameters.
      - Now masks NFS services that are not needed, so they are not unnecessarily
        started when the nfs-server.service or nfs-client.target are restarted.
      - Moved simp-autofs, simp-krb5, simp-iptables, simp-stunnel, and
        simp-tcpwrappers to simp/optional_dependencies in the metadata.json.
    - nfs::client
      - Added support for pNFS:  Set $blkmap to true to enable the pNFS service,
        nfs-blkmap.service.
      - Added $nfs::stunnel_socket_options and $stunnel_wantedby parameters which
        provide the defaults for all nfs::client::mount instances.
    - nfs::client::mount define
      - $nfs_server must now be specified as an IP address.  This change was
        necessary for firewalld.
      - In $options, changed the default mount type to 'soft' instead of 'hard'
        Also removed deprecated 'intr' option, as it has no effect.
      - Reworked the remote autodetect logic to detect a local mount based
        on IP address instead of simply whether the node is also configured
        to be an NFS server.
      - Added support for direct autofs mounts and simplified specification of
        indirect mounts.  When $autofs_indirect_map_key is not specified, a
        direct mount is specified by $name.  When $autofs_indirect_map_key is
        specified, an indirect mount is specified with $name as the mount point
        and $autofs_indirect_map_key as the mount key.
      - Renamed $autofs_map_to_user to $autofs_add_key_subst to better reflect
        automount terminology. This parameter simply adds key substitution
        to the remote location, which although can be used for user home
        directories, is not restricted to that use case.
      - Renamed $port to $nfsd_port to be consistent with the name of that
        parameter throughout the entire module.
      - Renamed $v4_remote_port to $stunnel_nfsd_port for clarity and to be
        consistent with the name of that parameter throught the entire module.
      - Exposed client stunnel configuration that was scattered throughout the
        module to this API.  User can now specify $stunnel_socket_options and
        $stunnel_verify for each mount.  When unspecified, the defaults from
        the nfs class are used.
    - nfs::server
      - Exposed server stunnel configuration that was scattered throughout the
        module to this API.  User can now specify $stunnel_accept_address,
        $stunnel_nfsd_acccept_port, $stunnel_socket_options, $stunnel_verify,
        and $stunnel_wantedby in this class.  When unspecified, the defaults
        for all but $stunnel_accept_address and $stunnel_wantedby are pulled
        from the nfs class.
      - Added the following parameters: $nfsd_vers4, $nfsd_vers4_0,
        $nfsd_vers4_1, $nfsd_vers4_2, and $custom_rpcrquotad_opts.
      - Renamed $nfsv3 to $nfsd_vers3 to reflect its use in /etc/nfs.conf.
      - Moved nfs::rpcquotad_port to this class and renamed $rpcrquotadopts
        to $custom_rpcrquotad_opts for clarity.
      - Moved nfs::mountd_port to this class and removed $rpcmountdopts.
        Custom configuration for that daemon should now be made via
        $nfs::custom_nfs_conf_opts or $nfs::custom_daemon_args as appropriate.
      - Removed the obsolete $nfsd_module parameter.
    - nfs::server::export define
      - Added $replicas, $pnfs, and $security_label parameters to support
        additional export configuration parameters.
    - nf::idmapd
      - Refactored into 3 classes to support distinct NFS server and client
        configuration
      - Added $no_strip and $reformat_group to nfs::idmapd::config to support
        support additional /etc/idmapd.conf configuration parameters.
  - Fixed bugs:
    - rpc.rquotad service configuration was erroneously written to
      /etc/sysconfig/nfs for EL7. It is now written to the correct file,
      /etc/sysconfig/rpc-rquotad.
    - idmapd
      - idmapd was erroneously only enabled when NFSv3 was allowed. idmapd is
        a NFSv4 service.
      - The idmapd client was not configured to use nfsidmap.  An nfsidmap entry
        has now been added to /etc/request-key.conf.
    - Fixed bugs in which bidirectional communication for NFSv3 was not properly
      configured.
      - NFSv3 lockd ports on the NFS client were not explicitly configured and
        thus not allowed through the firewall.  This would have affected file
        locking using NLM.
      - rpcbind, statd, and lockd service names were not allowed by TCP wrappers
        for the NFS client. This would have affected server to client NFSv3 NSM
        and NLM protocol messages over TCP.
    - Fixed bugs in mount options
      - Previously used the deprecated 'nfs4' fstype.  This has been replaced with
        the 'nfs' fstype and use of the 'nfsvers' option to specify the version of
        NFS to use.
      - The 'proto' previously was not set to 'tcp' when stunnel is being used.
    - Fixed bug with a duplicate exec resource in nfs::client::mount when stunnel
      was enabled.
    - Fixed erronously server-only/client-only configuration that appeared to be
      able to be set independently for the NFS client and NFS server on the same
      node, but because of shared services, actually applied to the node as a
      whole.
      - Removed $nfs::client::firewall and $nfs::server::firewall. Use
        $nfs::firewall instead.
      - Removed $nfs::server::tcpwrappers. Use $nfs::tcpwrappers instead.
      - Removed $nfs::server::nfsv3, $nfs::server::lockd_arg,
        $nfs::server::statdarg, $nfs::server::statd_ha_callout,
        $nfs::server::rpcgssdargs, and $nfs::server::rpcsvcgssdargs. Use
        appropriate parameters in the nfs class instead.
  - Updated the upper bound of simp-simplib to < 5.0.0


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.4.0-0
changelog:
  - Drop Puppet 4 support
  - Add ability for users to enable a default server capability directly from
    Hiera
  - Fix minor typos in some templates
  - Add REFERENCE.md


author: Zach <turtles.be.the.best@gmail.com> - 0.1.0-0
changelog:
  - Added pam_oath.so configuration code
  - Added strict type matching of oath::oath_users hieradata
  - Created Rspec tests checking correct catalog creation
  - Skeleton acceptance test created (and working)
  - Updated documentation to reflect current state of the module


author: Nick Miller <nick.miller@onyxpoint.com> - 2.1.0-0
changelog:
  - Added $package_ensure and $oddbob::mkhomedir::package_ensure parameter
    - Changed the packages from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick-simp@gmail.com> - 2.1.0-0
changelog:
  - Update to onyxpoint OEL boxes in acceptance tests
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick-simp@gmail.com> - 2.1.1-0
changelog:
  - Remove unnecessary use of validate_umask(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Nick Miller <nick.miller@onyxpoint.com> - 6.2.0-0
changelog:
  - Add package_ensure parameters to packages managed by this modoule
    - $scap_ensure - openscap-utils
    - $ssg_ensure - scap-security-guide
  - Add missing $scap_tailoring_file parameter to openscap::schedule


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 6.8.3-0
changelog:
  - Fixed a bug in the system-auth configuration file in which it did not skip
    pam_tty_audit if the login did not have a tty.  This caused service logins to fail,
    specifically the gdm service.
  - Removed support for EL6.
  - Set the quiet parameter  when doing pam_listfile lookups in auth.pp  so that users
    don't end up with warnings in the logs that look like authentication failures


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.9.0
changelog:
  - Fixed
    - Added default Hiera deep merges for `pam::access::users` and
      `pam::limits::rules` based on user feedback


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.2-0
changelog:
  - Ensure that /etc/pki/simp_apps is recursively purged so that old certificates
    are not left on the system
  - Adds a new param, `$certname`, that controls the name of the certs in keydist
    that will be copied over. This used to be set to `$facts['fqdn']` without an
    option to change it, now it will default to `$trusted['certname']`


author: Nick Miller <nick.miller@onyxpoint.com> - 6.0.3-0
changelog:
  - pki::copy's source parameter now accepts any string to allow for use of NSS
    and remote file sources.
  - Cleanup unneeded fixtures
  - Update version range of auditd dependency in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - pki_cert_sync type now generates an aggregate CA certificates
    with X.509 certificate headers removed, cacerts_no_headers.pem,
    in addition to the existing aggregate CA certificates file,
    cacerts.pem. This new CA certificates file is useful for
    application that cannot handle certificate headers.
  - Add a pki_cert_sync option, ``generate_pem_hash_links``, which controls
    whether pki_cert_sync should generate and maintain the PEM file hash
    links in the target directory. Disabling automatic PEM hash link
    generation is useful if an application is managing those links
    in the target directory, itself.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Moved temporary aggregate CA certs reference files used by
    pki_cert_sync out of the target directory. These temporary
    files were being erroneously processed by the gitlab
    application.


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Add EL7 and polkit 106+ support by allowing javascript rules
    - Added define to allow for easy placement of custom rules
    - Added templated define to ease generation of basic rules


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0-0
changelog:
  - Update custom Puppet 3 functions to namespaced, Puppet 4 functions
  - Allow default identity and identities prefixed with unix-netgroup.
  - Confine puppet version in metadata.json


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Add EL8 support
  - Drop EL6 support (it was non-functional)
  - Fix issue with basic_policy template that resulted in malformed rules
  - Add acceptance tests


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0-0
changelog:
  - Added the following classes
    - polkit::install
    - polkit::service
    - polkit::user
  - Ensure that the polkit user is managed by default and placed into the
    supplementary group bound to the 'gid' option on '/proc' if one is set to work
    around issues with 'hidepid' > 0.
  - Made the entire main class inert on unsupported OSs and log a warning on the
    server that can be disabled


author: Nicholas Markowski <nicholas.markowski@onyxpoint.com> - 5.2.0-0
changelog:
  - Updated $app_pki_external_source to accept any string. This matches the
    functionality of pki::copy.
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 5.2.1-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Updated a URL in the README.md


author: Robert Vincent <pillarsdotnet@gmail.com> - 5.4.0-0
changelog:
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Add puppetlabs-concat 6 support


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 8.1.1-0
changelog:
  - Puppet 6.19 has changed the "master" section to "server" in Puppet.settings.
    This fix updates the modules to check puppet_settings[:server] first then
    puppet_settings[:master].


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.1.3
changelog:
  - Fixed
    - Fixed a bug where the pupmod::master::sysconfig class was not getting applied
  - Changed
    - Default pupmod::set_environment to `false` so that users don't accidentally
      end up with systems in the wrong environment


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.2.0
changelog:
  - Changed
    - Converted all `cron` items to `systemd` timers
    - Converted the cleanup jobs to `tmpfiles` jobs
    - Converted from the 'params' patter to module data
  - Added
    - Purge puppet logs > 30 days by default
    - Disable puppetserver analytics by default


author: Andy Adrian <andy.adrian@onyxpoint.com> - 8.2.0
changelog:
  - Updated pupmod::puppet_server to accept Array as well as single hosts
  - Updated pupmod::pass_two to configure server_list when multiple puppet_server
    are specified
  - Updated pupmod::server_distribution to check server_list for puppet_user


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 8.2.0
changelog:
  - Change all instances of pupmod::master adding items to the `master` section to
    use `server` instead
  - Update pupmod::conf to automatically switch `master` to `server`
  - Automatically remove items from the puppet config in the `master` section that
    are set in the `server` section
  - Added pupmod::master::sysconfig::use_code_cache_flushing to reduce excessive
    memory usage
  - Removed SHA1 ciphers from the server cipher list
  - Disable the internal Red Hat FIPS option in the puppet server


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.2-0
changelog:
  - Deprecate the 'resolv::host_conf::spoof' parameter since it does not have any
    actual effect on the system. See
    https://bugzilla.redhat.com/show_bug.cgi?id=1577265 for information.
  - Add official support for Puppet 6
  - Update URLs in the README.md
  - Update upperbound of stdlib


author: Kendall Moore <kendall.moore@onyxpoint.com> - 0.5.0-0
changelog:
  - Use connection name instead of device name for managing with nmcli
  - Update REFERENCE.md to include new class params
  - Improved error handling for Network Manager


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.6.0-0
changelog:
  - Use config files for managing the global NetworkManager configuration
  - Remove EL 6 support since the OS is no longer supported
  - Add the ability to precisely update the resolv.conf contents
  - Add the ability to specify the entire contents of the resolv.conf
  - Add the ability to remove the resolv.conf completely


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.7.0
changelog:
  - Fixed a bug in the Augeas template
  - Adjusted the tests to effect change on a switch to/from NetworkManager


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.0.1
changelog:
  - This is the initial code for a `pupmod-simp-rkhunter` module, which
    installs and configures rkhunter and unhide.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.4
changelog:
  - Added Puppet 7 support
  - Added default user_fileprop_files_dirs to cover the puppet apps
  - Added PostgreSQL to the allowed items in /dev/shm for puppetdb
  - Ensure that the initial propupd command runs after the puppet run is complete
  - Added a rkhunter::propupd class to ensure that the first cut of properties is
    updated after all other items (particularly packages) have completed in the
    puppet run.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.0
changelog:
  - Dropped puppet 5 support
  - Bumped supported version of puppetlabs/stdlib
  - Changed minute for scheduled tasks to a random number to reduce I/O load
  - Updated to use systemd timers instead of cron by default


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 6.2.0-0
changelog:
  - Add v2 compliance_markup data
  - Remove puppet 4 support
  - Add puppet 6 support
  - Add puppetlabs-stdlib 6 support


author: Mike Renfro <renfro@tntech.edu> - 6.3.0-0
changelog:
  - Add 'preserve_perms' attribute to allow users to disable the preservation of
    server-side permissions.
  - If this flag is set to `false`, sets `chmod` to `u=rwX,g=rwX,o-rwx`


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.0-0
changelog:
  - Add a default rule to log packets dropped by firewalld to
    /var/log/firewall.log
  - Add /var/log/firewall.log to SIMP's 'syslog' logrotate rule
  - Move iptables, logrotate, pki, and tcpwrappers to optional dependencies
  - Cleaned up puppet strings support
  - Removed params pattern and migrated to data in modules


author: Kendall Moore <kendall.moore@onyxpoint.com> - 7.6.1-0
changelog:
  - Change local rule defined type to use the same package defaults for
    action queues that are in the remote rule defined type


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.6.4-0
changelog:
  - Fixed the default security collection string for firewalld rules
  - Removed the `filter_` rules that were present for an old (and broken) version
    of the simp_firewalld module.
  - Fixed the README and replaced 'iptables' references with 'firewall' where
    appropriate


author: Liz Nemsick <lnemsick.simp@gmail.com> - 8.0.0
changelog:
  - Removed support for Rsyslog < 8.24.0.
    - Rsyslog >= 8.24.0 is used for EL7.4 and later.
    - simp/rsyslog 7.6.4 should be used to manage earlier Rsyslog versions.
  - Removed support for CentOS 6.
  - Added ability to set the default template used for forwarding
    - `rsyslog::config::default_forward_template`
  - Added parameters to allow additional configuration of the rsyslog modules
    and main queue already managed by this Puppet module:
    - `rsyslog::config::extra_global_params`
    - `rsyslog::config::extra_legacy_globals`
    - `rsyslog::config::extra_imjournal_mod_params`
    - `rsyslog::config::extra_imklog_mod_params`
    - `rsyslog::config::extra_imptcp_mod_params`
    - `rsyslog::config::extra_imtcp_mod_params`
    - `rsyslog::config::extra_imudp_mod_params`
    - `rsyslog::config::extra_imuxsock_mod_params`
    - `rsyslog::config::extra_main_queue_params`
  - Added 'Direct' and 'Disk' to allowed main message queue types.
  - Removed a deprecated/unused parameters
    - `rsyslog::config::action_send_stream_driver_permitted_peers`
    - `rsyslog::config::interval`
    - `rsyslog::config::main_msg_queue_worker_timeout_thread_shutdown`
  - Removed parameters only relevant to Rsyslog < 8.6.0
    - `rsyslog::config::host_list`
    - `rsyslog::config::domain_list`
  - Deprecated parameters that corresponded to obsolete legacy globals
    and provided more appropriately-named replacements.
    - Use of old parameters will result in a compilation warning messages.
    - The replacement parameter is listed in each warning message.
    - Affected parameters:
      - `rsyslog::config::action_send_stream_driver_mode` => `rsyslog::config::imtcp_stream_driver_mode`
      - `rsyslog::config::action_send_stream_driver_auth_mode` => `rsyslog::config::imtcp_stream_driver_auth_mode`
      - `rsyslog::config::disable_remote_dns` => `rsyslog::config::net_enable_dns`
      - `rsyslog::config::suppress_noauth_warn` => `rsyslog::config::net_permit_acl_warning`
  - Deprecated `rsyslog::config::default_template` and provided a more
    appropriately named replacement, `rsyslog::config::default_file_template`
    - Use of old parameter will result in a compilation warning message.
  - Fixed a bug in which the rsyslog service would start without any errors but
    fail to log when `rsyslog::config::default_template` was set to 'traditional'.
    That value did not map to a valid Rsyslog built-in template.
  - Fixed a bug where the `net.permitACLWarning` global was set incorrectly.
  - Removed non-functioning, unused Rsyslog::Template['defaultTemplate'] resource.
  - Internally, updated some of the legacy Rsyslog configuration to Rainer script
    format.
    - Load the imjournal module and set its state file using `load()`.
    - Set the `omfile`'s default template in its `load()` statement.
    - Use the `global()` configuration object for the following:
      - localHostname
      - defaultNetstreamDriverCertFile
      - defaultNetstreamDriver
      - defaultNetstreamDriverCAFile
      - defaultNetstreamDriverKeyFile


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 2.5.1-0
changelog:
  - Defined values for EL8 in data in modules.
  - Updated Gemfile versions to ones that support EL8.
  - Updated metadata.json to include support for CentOS 8 and RedHat 8
  - Added acceptance test  nodes for CentOS 8 and RedHat 8
  - Removed $:: from top level variables.
  - Removed tests for Puppet 4 from travis.yml.
  - Bumped upper bound for simp-simplib to < 5.0.0


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.6.0-0
changelog:
  - No longer enable or install mcstransd by default
    - It is a user convenience feature and not required for core functionality
  - Ensure that mcstransd is added to the GID assigned to `/proc` if one is
    assigned on the system


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 2.6.1-0
changelog:
  - Allow users to include `selinux::install` without needing full SELinux system
    management. This is particularly important when the native types are to be
    used in different modules but you don't want to include full management just
    to get the required packages.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.6.2-0
changelog:
  - Fixed a bug in which the module would attempt to create `selinux_login`
    resources when `selinux::login_resources` was set but selinux was disabled.
    This resulted in an error message 'Could not find a suitable provider
    for selinux_login' during catalog compilation.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.15.0
changelog:
  - Removed
    - Drop support for EL 6 due to EOL
  - Fixed
    - Ensure that netconsole-service is installed on EL8+
  - Added
    - Add support for Puppet 7
    - Added a JSON formatted profiling formatter for rspec
    - Allow users to modify the defined type options in `simp::sssd::client`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.15.0
changelog:
  - Removed
    - Drop support for Puppet 5
  - Changed
    - Use puppet/chrony in lieu of aboe/chrony, as VoxPupuli has now assumed
      ownership of this module.
    - Allow puppetlabs/concat < 8.0.0
    - Allow saz/timezone < 7.0.0


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 4.16.0
changelog:
  - Update the sssd client configuration to set the ldap_schema
    for ldap providers based on the setting simp::sssd::client::ldap_server_type,
    which uses "plain" for openldap servers and "389ds" for 389-DS servers.
    SIMP configuration and documentation for each of those servers is:
    - In openldap group members are added using the attribute
      "memberUid" and the cn of the user entry as defined in the
      rfc2307 schema.
    * In 389-DS group members are added using the "member" attribute and dn
      of the user as defined in the rfc2307bis schema.
  - Add relative_gpgkey_path parameter to simp::yum::repo::simp_local
    and default it to SIMP/GPGKEYS, the location that the simp-gpgkeys
    rpm installs the gpgkeys.
    The above fix is needed because SIMP local repos were split up to be
    OS version specific  but the GPGkeys are placed in one location by
    simp-gpgkeys.  This works
    because simp::yum::repo::simp_local takes care to add only the OS
    specific gpgkeys to the repo definition.
  - Changed:
    - sssd::client no longer creates a local provider.
      - The version of pupmod-simp-sssd required by this module was updated to 7.0
        because the version of sssd installed does not require a provider.
        If you require a local provider use the  sssd module to create one.
      - NOTES FOR UPGRADE: The local domain was configured by default in earlier
        versions of SIMP because sssd would not start without a domain. A "LOCAL"
        entry was added to the list of sssd domains to create in hiera. You will
        need to remove this domain from the list of domains in hiera unless you
        are configuring a "LOCAL" domain somewhere else in your puppet code. The
        hiera variable is sssd::domains. If you do not remove this domain from the
        list of domains in hiera and are not configuring it yourself sssd will
        fail to start because it will not find a provider for the "LOCAL" domain.
    - Added warning if LOCAL domain was found in sssd::domains. Also added ability
      to disable the warning.
  - Added the latest GPG key for Puppet RPMs (RPM-GPG-KEY-20250406) to the list
    of GPG keys for the local `simp` repo.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.16.0
changelog:
  - Added
    - simp::puppetdb::disable_update_checking to disable default analytics in
      accordance with NIST guidance
    - PuppetDB now sets UseCodeCacheFlushing by default
  - Changed
    - Migrated from camptocamp/kmod to puppet/kmod
  - Fixed
    - Corrected the HeapDumpOnOutOfMemoryError setting for PuppetDB
    - Ensure that nsswitch SSSD options for sudoers do not stop on files
    - Do not include the auditors sudo user specification if the aliases have not
      been included
    - Add the following to sudoers defaults
      - !visiblepw
      - always_set_home
      - match_group_by_gid
      - always_query_group_plugin


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.16.1
changelog:
  - Fixed
    - Updated simp::yum::repo::local_simp to adjust for the EL8 ISO build
    - Updated simp::yum::repo::local_os_updates to adjust for  the EL8 repo
      set up.  It has 2 OS repos, BaseOS and AppStream.
      - When using the param 'baseurl' for EL8 it will create 2 repos by appending
        AppStream and BaseOS to the url.
      - The use of 'baseurl' for EL7 and earlier has not changed.  It will use the
        url as presented.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 4.16.2
changelog:
  - Updated simp::yum::repo::local_os_updates to use the GPGKEYS installed by
    simp-gpgkeys and the iso install  into <yum directory>/SIMP/GPGKEYS.
    This change was made because
    EL8 distribution ISO no longer contains the GPG keys at the top level like
    previous releases.  SIMP will put the keys into SIMP/GPGKEYS no matter what
    the release is so this was the best fix.


author: Steven Pritchard <steven.pritchard@onypoint.com> - 6.2.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop support for Puppet 4
  - Add support for Puppet 6
  - Add support for puppetlabs-stdlib 6


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.2.0-0
changelog:
  - Split out service management into a `simp_apache::service` class
  - Provide users with a Hiera-driveable option to not manage the service
  - Add REFERENCE.md


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.0-0
changelog:
  - Update Puppet module to support EL8
  - Remove deprecated Puppet 3 API functions:
    - apache_auth: replaced by simp_apache::auth
    - apache_limits: replaced by simp_apache::limits
    - munge_httpd_networks: replaced by simp_apache::munge_httpd_networks
  - Update the upper bound of simp-simplib to < 5.0.0


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.2
changelog:
  - Use systemd to reload/restart the httpd service.
  - Expanded simp/rsyslog dependendency range to < 9.0.0.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.0
changelog:
  - Fixed
      - Ensure that all file resources that manage more than permissions have an
        'ensure' attribute - See PUP-7599
    - Changed
      - Moved the 'magic' file into an EPP template to work better with Bolt


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.1.1
changelog:
  - Fixed the bootstrap template
    - Set the SUDOers OU properly
    - Removed the ignore_local_sudoers option from the sudo defaults for safety
    - Added the usual batch of sudoers defaults


author: Trevor Vaughan <trevor@sicura.us> - 0.3.1
changelog:
  - Support Amazon Linux 2
  - Work around upstream bug:
      - `puppet-firewalld` needs to have an autorequire on
        `firewalld_custom_service` if one is declared.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.4.0-0
changelog:
  - Added missing simp-pki dependency to metadata.json
  - Use ``generate_pem_hash_links`` option of pki_cert_sync to allow
    the gitlab application to manage the certificate hash links.
    ``gitlab reconfigure`` generates those hash links.
  - Added manage_package and package_ensure parameters to simp_gitlab
  - Switched from vshn/gitlab 1.13.3 to its replacement puppet/gitlab
    3.0.2 and reworked the manifests, as appropriate, to work with the
    newer module.
  - Updated the upper bound of stdlib to < 6.0.0
  - Updated a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.6.0-0
changelog:
  - Updates for GitLab application (12.3.0-13.x) and puppet/gitlab module 6.0.1
    - Removed:
      - Support for GitLab < 12.3.0.
      - TLSv1.1 from the default for `simp_gitlab::ssl_protocols`.
    - Changed:
      - Set the GitLab root password in a fashion that minimizes coupling of
        `simp_gitlab` with the internals of the `gitlab` module.
        - Set a throw-away password during initial GitLab package installation
          using GitLab configuration in /etc/gitlab/gitlab.rb. Setting the
          password during initial install is the **only** way to ensure the
          password is not set by an external user. Otherwise, the first GitLab
          page that comes up is the page to reset the root password.
        - After GitLab initial configuration, set the real root password using
          a script that implements Gitlab-provided procedures for setting the
          password.
        - IMPORTANT: As a side effect of these changes, upon module upgrade,
          the password will be automatically set to the value of
          `simp_gitlab::gitlab_root_password`, unless the (empty) marker file
          `/etc/gitlab/.root_password_set` exists or the parameter
          `simp_gitlab::set_gitlab_root_password` is set to `false`.
          If you forget to disable this automation or just want to reset the
          GitLab root password, simply run
          `/usr/local/sbin/change_gitlab_root_password <new_password>` manually.
          You do not need to know the previous password to set the new password.
      - Use `chronyd` instead of `ntpd`, as GitLab itself uses `chronyd` and
        `chronyd` is required for EL8.
      - Use `gitlab` for managing packages again.
        - Change was only possible once the new mechanism for setting the GitLab
          root password was implemented.
      - Renamed the 'gitlab_monitor' key to 'gitlab_exporter' in the configuration
        hash.
        - Name change required for GitLab >= 12.3.0.
      - No longer set `gitlab::external_port`
        - The custom port is already appropriately configured via the
          `gitlab::external_url`.
        - 'external_port' is no longer a supported GitLab configuration key and
           causes `gitlab-ctl reconfigure` to fail.
      - `simp_gitlab` now fails to compile when the node is in FIPS mode,
        unless `simp_gitlab::allow_fips` (a new parameter) is set to `true`.
    - Added:
      - Support for EL8.
      - `simp_gitlab` parameters to enable setting the GitLab root password
        - `set_gitlab_root_password`
        - `gitlab_root_password`
        - `rails_console_load_timeout`
      - Script to change the GitLab root password,
        `/usr/local/sbin/change_gitlab_root_password`.
      - Disabling of Let's Encrypt usage in GitLab , by default.
        - The integration of SIMP PKI management with with Let's Encrypt has not
          yet been done.
        - To use Let's Encrypt, disable SIMP management of PKI by setting
          `simp_gitlab::pki` to `false` and then manage the certificates manually.
      - `svckill::ignore` rule for the GitLab service. Since the service
        is no longer managed by default by `gitlab::service`, this prevents
        the service from being inadvertently killed when it is unmanaged.
      - REFERENCE.md documentation.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.6.1
changelog:
  - Fixed a bug in which the change_gitlab_root_password script did
    not work for GitLab versions that included Ruby 2.7.x (GitLab 13.6.0
    and later).
  - Fixed a bug in which the change_gitlab_root_password script emitted
    a 'WARNING: GitLab is not completely running' error message when
    GitLab was fully running.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.7.0
changelog:
  - Removed
    - Dropped support for Puppet 5
  - Changed
    - `simp_gitlab::allow_fips` now defaults to true, as the last version of
       GitLab this module was tested with, 14.0.0, supports FIPS mode.
       - This will allow new GitLab installations on servers for which FIPS-mode
         is enabled, but not affect existing GitLab servers configured by earlier
         versions of this module.
    - Minor README updates
      - Clarify versions of GitLab this modules is known to work with and
        the steps a user can do to verify it works with a different version.
      - Remove OBE FIPS-mode failure
      - Update GitLab ticket URLs.
    - Allow herculesteam/augeasproviders_ssh < 5.0.0
    - Allow puppet/gitlab < 8.0.0
    - Allow puppetlabs/stdlib < 8.0.0
    - Use puppet/chrony in lieu of aboe/chrony, as VoxPupuli has now assumed
      ownership of this module.


author: Trevor Vaughan <trevor@sicura.us> - 0.7.1
changelog:
  - Allow `puppet/chrony` < `3.0.0`
  - Allow `puppet/gitlab` < `9.0.0`
  - Allow `puppetlabs/stdlib` < `9.0.0`
  - Bump latest tested GitLab CE version to 15.0.1


author: Nick Miller <nick.miller@onyxpoint.com> - 0.0.2
changelog:
  - Added Puppet Tasks for joining and leaving a domain
  - Fix bug where ntp-server wasn't passed in client install


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 0.1.1
changelog:
  - Removed EL6 from supported OSes
  - Deprecated `simp_ipa::client::install::admin_tools_ensure`.
    It was only used for EL6.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.1
changelog:
  - Drop advertised support for EL8, as `simp_ipa::client::install` has
    not been updated to integrate with the SIMP-managed PAM stack on EL8.


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 0.1.1
changelog:
  - Remove Elasticsearch and Grafana GPG Keys
  - Updated tests in support of puppet6, and removed puppet4 support


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 1.0.0
changelog:
  - Added support for EL8
  - Removed support for EL6
  - Updated to use pupmod-simp-nfs release 7.0.0
  - Only accepts IP Adrresses for nfs server because firewalld
    needs IP Address.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.1
changelog:
  - Fixed:
    - Removed hostname as a possible entry for the NFS server in the
      sample code in the README. Specifying the NFS server as a
      hostname is no longer supported due to limitations of firewalld.
    - Replaced deprecated 'classes' with 'simp:classes' in manifest
      documentation.
  - Updated:
    - In the README, removed EL6 from the autofs known issue discussion
      and added more details on how to work around the problem.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 1.1.0
changelog:
  - Deprecated `simp_nfs::create_home_dirs::strip_128_bit_ciphers`.
    This option no longer affects any supported OSes.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.1.0
changelog:
  - Fixed:
    - Bug where EL8 LDAP clients were unable to communicate with an EL7 LDAP
      server in `/etc/cron.hourly/create_home_directories.rb`, when the servers
      were in FIPS mode.
      - EL8 in FIPS mode could not talk to LDAP server on EL7 because the
        ciphers did not match.  The script was using the default policies,
        which only have TLS1_3 in them. EL7 uses an older version of openssl
        which does not have TLS1_3. Therefore, had to set the ciphers and CA
        path in the script.
  - Added:
    - PKI parameters to `simp_nfs::create_home_directories`.
    - Management of PKI certificates in `simp_nfs::create_home_directories`.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.1.0
changelog:
  - Add nfs server certificate information to create_home_directories
    script.  389ds has client authentication set to require so the
    certificate information must be sent in the Net::LDAP call.
  - Changes the cron to a systemd timer and remove the script from
    /etc/cron.hourly.  The script is now located in /usr/local/bin.
  - Add tests with 389ds server


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.3.2-0
changelog:
  - Use simplib::validate_re_array in lieu of deprecated Puppet 3 validate_re_array
  - Use Puppet Integer() in lieu of simplib's deprecated Puppet 3 to_integer


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.5.0
changelog:
  - Fix comparison of Float with String on `simp_openldap::server::conf::tls_protocol_min`
  - Removed support for EL 6 due to EOL
  - Deprecated parameters only applicable to EL 6:
    - simp_openldap::client::strip_128_bit_ciphers
    - simp_openldap::client::nss_pam_ldapd_ensure
  - Added support for Puppet 7


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.5.0
changelog:
  - Fixed bug where the pki:copy resource could no longer be created for
    OpenLDAP clients.
    - The 'ldap' group is no longer created by any of the installed OpenLDAP
      client packages.
  - Expanded simp/rsyslog dependendency range to < 9.0.0.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.2.3-0
changelog:
  - Use simplib::validate_net_list in lieu of deprecated Puppet 3
    validate_net_list
  - Use simplib::validate_uri_list in lieu of deprecated Puppet 3
    validate_uri_list


author: Steven Pritchard <steven.pritchard@onypoint.com> - 1.3.0-0
changelog:
  - Add v2 compliance_markup data
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add support for puppetlabs-stdlib 6


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.4.0-0
changelog:
  - Reformatted some documentation
  - The following are now optional:
    - simp_options::puppet::server
    - simp_options::puppet::ca
  - These are no longer required at all times due to support for Bolt. Code that
    used these parameters will correctly fail and require users to add them to
    their configuration.
  - Updated simp_options::ldap to require the 'master' and 'uri' parameters if
    simp_options::puppet::server is not defined.
  - Fixed PE detection in simp_options::puppet::server_distribution
  - Add support for simplib < 5


author: Jeanne Greulich <jeannegreulich@onyxpoint.com> - 1.4.0-0
changelog:
  - This change marks the clamav catalyst as deprecated.
    * As of SIMP 6.5, SIMP's ``clamav`` class is no longer included in the class
      list of the SIMP scenarios. So, this catalyst is not needed to disable it.
    * To have SIMP manage ``ClamAV`` on your system, add the ``clamav`` class to
      your system's class list.
    * See the SIMP ``clamav`` module README for information on managing ``ClamAV``.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.5.0
changelog:
  - Added simp_options::ntp for more generalized configuration of ntpd and chronyd
  - Deprecated simp_options::ntpd


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.5.0-0
changelog:
  - Add EL8 Support
  - Add support for firewalld log message collection
  - Move logrotate to optional dependencies


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.5.1-0
changelog:
  - Ensure that the docs are correct
  - Fix the acceptance tests to use `iptables::precise_match`
  - Remove the `filter_IN_99_simp_DROP` rules since these are based on the
    experimental version of `simp/simp_firewalld`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.2-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Expanded the upper limit of the stdlib Puppet module version
  - Updated a URL in the README.md
  - Update miniminum version of snmp module to 4.1.0.  This project
    is now maintained by Vox Pupuli and has changed from razorsedge-snmp
    to puppet-snmp.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 1.0.0-0
changelog:
  - This module was updated to use puppet-snmp v5.1.2 and work on EL8 with
    simp 6.5.
  - The user configuration directories for snmpd are not included by default. To
    include and create these directories set simp_snmpd::include_userdir to true.
  - Parameters to allow the user to change the owner, group and permissions
    of the snmp configuration directories and files have been added.
  - The default security level for VACM access directives was changed to
    simp_snmpd::defvacmlevel from simp_snmpd::defsecuritylevel.
    simp_snmpd::defsecuritylevel was used to set
    both the client and VACM levels but this did not work correctly because
    the client uses different values.  Use simp_snmpd::defvacmlevel to change the
    default security level of the VACM access statements. (The default has not changed,
    it is still 'priv'.)
  - Added in the permission options for the configuration files and directory
    so users could  change them.
  - simp_snmpd::services was changed from a String to and Integer to be compatible
    with the new module.
  - The permissions on the mib and dlmod dirs are  set using basic group settings
    instead of acls.
  - The default options for the snmpd daemon for el6 were updated to include setting
    the pid file.  Without this restarting the daemon in el6 failed.


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 0.4.3
changelog:
  - (SIMP-3623) libkv::lookup_key backend should turn softfail on by default
  - Add fix for 0.9.x consul installations


author: Dylan Cochran <dylan.cochran@onyxpoint.com> - 0.5.0
changelog:
  - (SIMP-3445) Add acceptance test for consul configuration and bootstrap
  - (SIMP-3629) libkv::atomic_put returns false for a successful put on consul >0.9.0


author: Nick Markowski <nicholas.markowski@onyxpoint.com> - 0.6.0
changelog:
  - (SIMP-3923) Moved libkv::consul to pupmod-simp-simp_consul
  - Updated README
  - Updated travis with CI credentials


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.7.0
changelog:
  - Merged in changes released with 0.6.1 and on the 'develop' branch
  - Documented libkv requirements
    (See 'Requirements' section of docs/Design_Protoype2.md).
  - Created and documented design for second prototype
    (See 'Changes from Version 0.6.X' section of docs/Design_Protoype2.md).
  - Implemented second prototype and file plugin + store
    to demonstrate the design


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.8.0
changelog:
  - BREAKING CHANGES:
    - Added 'globals' and 'environments' root directories for global and
      Puppet-environment keys, respectively, in the normalized key paths
      in the backend.
      - This change makes the top-level organization of keys in the backend
        explicit, and thus more understandable.
      - The prefix used for global keys was changed from `<keystore root dir>` to
        `<keystore root dir>/globals`.
      - The prefix used for environment keys was changed from
        `<keystore root dir>/<specific Puppet environment>` to
        `<keystore root dir>/environments/<specific Puppet environment>`.
      - Change required for the LDAP plugin.
    - Replaced the confusing 'environment' backend option in each simpkv Puppet
      function with a 'global' Boolean option.
      - Global keys are now specified by setting 'global' to true in lieu of
        setting 'environment' to ''.
    - Changed the key and folder name specification to restrict letter
      characters to lowercase.
      - Change required for the LDAP plugin.
    - Changed the plugin configuration API
      - Configuration has been split out into its own method, instead of being
        done in the plugin constructor.
      - This minimal change simplifies unit testing of configuration of complex
        plugins.
    - Fixed the mechanism a plugin uses to advertise its type.
      - Plugin type is now determined from its filename.
      - Previous mechanism did not work when when multiple plugins were used.
  - Added
    - LDAP plugin
      - Acceptance test that demonstrates its use and integration with
        a 389-DS instance configured with the SIMP data schema
    - More detailed plugin exception reporting in order to pinpoint plugin
      logic problems.
      - Now prints out the useful portion of the backtrace when an exception
        is raised.
      - Especially useful during plugin development.
    - More background information for users
    - More background information for plugin developers, which has now
      been split out into its own document.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.8.0
changelog:
  - Add a `simplib::params2hash()` function to return all of the calling scope's
    parameters as a Hash


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.9.0
changelog:
  - Added a `simplib::cron::to_systemd` function to provide 'best-effort'
    conversions of cron resource parameters to a systemd timespec
  - Fixed the simplib__networkmanager fact
  - Fixed a bug where the ipa fact did not detect when an EL8 client was
    joined to an IPA domain


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.10.0
changelog:
  - Fixed
    - simplib::cron::hour_entry now supports comma separated lists
    - simplib::cron::minute_entry now supports comma separated lists
    - simplib::cron::to_systemd() properly supports/converts ranges and commas
  - Added
    - simplib::cron::expand_range() to expand ranges into comma separated
      strings
    - Better tests for simplib::cron::to_systemd()
    - Acceptance tests for simplib::cron::to_systemd()


author: Trevor Vaughan <tvaughan@sicura.us> - 4.10.3
changelog:
  - Fixed
    - Allow `assert_optional_dependency` to handle extended version strings
      (Alpha, Beta, RC, 1.2.3.4, etc...)


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 4.10.4
changelog:
  - Fixed
    - If the user/group Puppet's settings doesn't exist on the OS,
      passgen's file ownership falls back to the owner of the compiler's process


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.11.1-0
changelog:
  - Migrate to the updated version of simp/selinux that allows for isolated
    package installation in support of the SELinux native types.
  - Allow users to use the 'puppet/selinux' module instead of SIMP components.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.11.2
changelog:
  - Openssh dropped support for SSH protocol 1 in version 8.0.
    EL8 installs openssh v8 by default.
    This fix checks the version of openssh when creating ssh_config host
    entries and removes those values that are no longer used.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.11.2
changelog:
  - Updated server::conf to include the voxpupuli selinux module when
    calling selinux_port.  This will ensure the packages that selinux_port
    needs are installed.
  - Added memory to the testing nodesets for EL8 because running selinux_port
    was giving an out of memory error.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.11.2
changelog:
  - Fixed a bug where some changes to sshd configuration did not cause the
    sshd service to restart.
    - `sshd_config` resources created by `ssh::add_sshd_config()` did not
      notify `Service[sshd]`.
  - Fixed a bug that caused a compilation error when
    `ssh::conf::ensure_sshd_packages` was set to `true`.
  - Removed sshd configuration logic pertaining to OpenSSH versions used
    in EL6.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0
changelog:
  - Fixed:
    - `sssd::provider::ldap::ldap_pwd_policy` is based on the value in
      `ldap_account_expire_policy` to properly account for non-shadow systems
    - `sssd::provider::ldap::ldap_access_order` is set to the modern set
    - A typo in the `sssd::LdapAccountExpirePol` data type was fixed
    - Ported the krb5 ERB template to EPP and fixed a typo
  - Removed:
    - `sssd::manage_service` - obsolete
    - `sssd::ldap_access_order_defaults()` - obsolelte
    - Removed EL6-only artifacts
    - Removed the `LOCAL` domain
    - Support for Puppet 5 was dropped
  - Changed:
    - Fail if a version of `sssd` is being managed < 1.16.0
    - Now use the `/etc/sssd/conf.d` directory instead of `concat`
    - The `sssd::service` class is now private
    - Moved the `/etc/sssd` directory configuration into `sssd::config`
  - Added:
    - `sssd::config::entry` defined type which allows consistent management of
      permissions and dependencies on config files
    - Users can set `sssd::custom_config` to a `String` that will be placed into
      `/etc/sssd/conf.d/zz_puppet_custom.conf`
    - Allow users to optionally purge the `/etc/sssd/conf.d` directory (disabled
      by default)
    - Trigger the `sssd-sudo.socket` service instead of including the service in
      the main configuration per the `sssd` documentation and error messages in
      the logs
    - Support for puppetlabs/stdlib 7 was added


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.2
changelog:
  - Added tests for ds389 ldap server
  - SSSD will not start and the module fail if no domains are
    defined.  The enable_files_domain setting is set to true to ensure
    that sssd will start.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.1
changelog:
  - Add an override for sssd-sudo.service to start it as root:root. This aligns
    with how sssd itself would start the service and the daemon cannot access
    /var/lib/sss/db/config.ldb otherwise.


author: Henry Pauli <henry+spam@mixict.nl> - 7.2.0
changelog:
  - Add an option in sssd::install to not install sssd client.
    This aids in better compatibility with non RedHat based systems
    where the ssssd-client package may not exists.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 7.3.0
changelog:
  - Changed:
    - Made provider parameters Optional to support certain AD/realmd configurations:
       - sssd::provider::krb5::krb5_server
       - sssd::provider::ldap::ldap_search_base
       - sssd::provider::ldap::ldap_default_bind_dn
  - Fixed:
    - nil? bug in template for ad provider


author: Mark Fitch <mark.fitch1@hotmail.com> - 7.4.1
changelog:
  - Fixed:
      - Added missing parameters `ldap_user_extra_attrs` and
        `ldap_user_ssh_public_key` to allow SSH keys to be fetched from AD


author: Michael Morrone <michael.morrone@onyxpoint.com> - 6.4.1
changelog:
  - If statement evaluating boolean parameter prevented RNDoverwrite being
    set to 'no'. Fixed logic, updated tests, and changed default value
    to maintain default behavior.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.2
changelog:
  - Use simplib::nets2ddq in lieu of simplib's deprecated Puppet 3 nets2ddq
  - Use Puppet Integer instead of simplib's deprecated Puppet 3 to_integer
  - Use Puppet String instead of simplib's deprecated Puppet 3 to_string
  - Use simplib::validate_array_member in lieu of simplib's deprecated
    Puppet 3 validate_array_member


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.6.0
changelog:
  - Add support for EL8
  - Added REFERENCE.md
  - Updated README.md
  - Set default for stunnel::connection::ssl_version to TLSv1.2 for EL8
    compatibility
  - Set default for stunnel::instance::ssl_version to TLSv1.2 for EL8
    compatibility
  - Add an stunnel::instance_purge class to remedy the 'floating services' issue
  - Set the stunnel::connection::app_pki_crl parameter to ``undef`` by default due
    to issues with pointing the setting to an absent directory in EL8
  - Set the stunnel::instance::app_pki_crl parameter to ``undef`` by default due
    to issues with pointing the setting to an absent directory in EL8
  - Update valid ssl_version entries
  - Update acceptance tests to pass data between all combinations of nodes


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.7.1
changelog:
  - Fixed
    - Set all tcpwrappers connections to allow 'ALL' to work around a bug in the
      version of stunnel that ships with EL7.9 where a tcpwrappers deny will
      cause 100% CPU usage and hung process


author: Steven Pritchard <steven.pritchard@onyxpoint.com> - 5.2.0-0
changelog:
  - Allow additional options in sudo::user_specification
  - Add Puppet 6 support
  - Remove Puppet 4 support
  - Allow puppetlabs/stdlib < 7


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 5.2.1-0
changelog:
  - Update for EL8.
  - CVE-2019-14287 mitigation. See
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287
    for more information
  - Do not allow the use of userid or group id of -1 when ALL or %ALL are
    used in the runas section of a sudo user specification and the version of
    sudo is earlier than 1.8.28.


author: Nick Markowski <nmarkowski@keywcorp.com> - 6.0.1-0
changelog:
  - Updated logrotate to use new lastaction API
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Nick Miller <nick.miller@onyxpoint.com> - 6.1.0-0
changelog:
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Update badges and contribution guide URL in README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.3.1-0
changelog:
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed bad URLs in the README.md


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.6.0-0
changelog:
  - Add EL8 support
  - Update the upper bound of simp-simplib to < 5.0.0
  - Updated service lists:
    - Moved services that were deprecated in el7 from common list
      to RedHat-6 list.
    - Moved family_versions under osfamily just to make it neater.
    - Put more comments in the ignore lists for services.
    - Added new el8 services to RedHat-8.yaml
    - Added RedHat subscription manager services to RedHat OS list.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.6.1-0
changelog:
  - Puppet changed the service provider to return service units whose
    state is static.  Because of this svckill was trying to kill system
    processes.  This change updates the svckill provider to only add
    services the list of running services that are known to be in the
    enabled or disabled state.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 3.7.0
changelog:
  - Fixed
    - Added 'rngd' to the default services to never be killed
    - Removed obsolete documentation


author: Nick Miller <nick.miller@onyxpoint.com> - 0.1.2-0
changelog:
  - Updates the metadata to support Puppet 5 and Oracle Linux
  - Migrates acceptance tests to suites
  - Adds OEL nodeset
  - Update module assets
  - Update badges and contribution guide URL in README.md


author: Jim Anderson <thesemicolons@protonmail.com> - 0.1.4-0
changelog:
  - Changed location of ruby in dynamic_swappiness.erb to point to the
    SIMP provided version instead of an OS provided version.
  - Updated expected templates in Travis CI checks.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0-0
changelog:
  - Disable dynamic_swappiness by default
  - Set static system swappiness to 60 by default
  - Add EL8 support
  - Add REFERENCE.md


author: Nick Miller <nick.miller@onypoint.com> - 6.1.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.1-0
changelog:
  - Use simplib::ipaddresses() in lieu of ipaddresses(), a deprecated
    simplib Puppet 3 function.
  - Expanded the upper limit of the concat and stdlib Puppet module versions
  - Fixed URLs in the README.md


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 6.1.2-0
changelog:
  - Use simplib::bracketize in lieu of deprecated Puppet 3 bracketize
  - Fix template bug that prevented some IPv6 addresses from being
    properly formatted in /etc/hosts.allow.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - RedHat 8 does not support TCP Wrappers
  - Add call to simplib:assert_metadata to check the OS
    is supported.
  - Update upperbound of simplib.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.2.0-0
changelog:
  - Change metadata OS version check to use new simplib check that returns
    false or true if the OS is supported according to metadata.json.
    If it is not supported, do nothing (instead of failing).


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.3.0-0
changelog:
  - Update README.md
  - Add REFERENCE.md
  - Add EL8 support
  - Update GitLab configuration
  - Add a basic acceptance test
  - Update dependency versions in metadata.json
  - Fix manifest ordering


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.0
changelog:
  - Added EL8 support
  - Updated acceptance tests to use net/ssh to prevent issues with large SSH
    keyrings
  - Added REFERENCE.md and linked into the README.md
  - Added optional dependencies for simp/logrotate and simp/rsyslog
  - Added workaround to scripts in /etc/profile to work around a bug in tlog that
    would prevent logins if the system hostname could not be found


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.1
changelog:
  - Fixed
    - Corrected the logic in `tlog.sh.epp` in the case where a user does not have
      a login shell


author: Michael Morrone <michael.morrone@onypoint.com> - 3.1.0-0
changelog:
  - Removed direct module support for IMA, as that functionality has been
    ported to the ima module.  Instead, for backward compatibility, this
    module now uses the ima module, when tpm::ima is set to true.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.1.0-0
changelog:
  - Added support for tboot V1.9.6 and removed support for tboot.1.9.4.
    Use pupmod-simp-tpm 1.1.0 if tboot v1.9.4 is required.
  - Made creating the VLP and LCP optional because  they don't work in
    tboot v1.9.6.
  - Tboot V1.9.7 was released on Sept 06, 2018 but not packaged for Redhat.
    Tested with a locally compiled version and the creation of the policy
    was fixed in that version.
  - Added check for 20 character owner passwords because they are required.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.1.1-0
changelog:
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Expanded the upper limits of the stdlib and yum Puppet module versions


author: Robert Vincent <pillarsdotnet@gmail.com> - 3.2.0-0
changelog:
  - Drop Puppet 4 support
  - Add Puppet 6 support
  - Add puppetlabs-stdlib 6 support
  - Add puppet-yum 4 support


author: Liz Nemsick <lnemsick-simp@gmail.com> - 0.1.1
changelog:
  - Confine tpm2 fact on the presence of TPM 2 tools required
    for that fact evaluation
  - Use simplib::passgen() in lieu of passgen(), a deprecated simplib
    Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.0
changelog:
  - Removed Puppet 4 support
  - Added Puppet 6 support
  - Added puppetlabs-stdlib 6 support
  - Maintenance: removed OBE build/rpm_metadata/requires


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.0
changelog:
  - Added EL8 support
  - Added  ability to set options for abrmd service
  - Removed option for managing tools.  Tools can be managed
    or not by removing them from the package list.  Note that the
    tools package is needed to determine the status of the TPM.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.3.1
changelog:
  - Fixed a bug where the `tpm2_*` commands could return nothing which would
    trigger an error in further logic.
  - Fixed minor documentation issues


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 0.3.2
changelog:
  - This change updates the tpm2 fact and tpm2::ownership to handle changes in
    tpm2_tools version 4.  The code was updated to provide for the following
    changes in tpm2_tools:
    - tpm2_pcrlist was changed to tpm2_pcrread.
    - tpm2_takeownership was changed to tpm2_changeauth and its parameters
      and functions were changed significantly.
    - tpm2_getcap options were changed and format of the information
      returned was changed.
  - The use of tpm2_pcrlist was replaced with tpm2_getcap since it was only used
    to determine if tpm2_tools package was installed.
  - The version of the tools installed is derived from tpm2_getcap -v and included as
    part of the tpm2 fact.
  - Removed requirement for fact tpm to not exist.  The tpm2 fact will be populated
    if the tpm2 tools are installed and they can talk to the tpm.  If there is a tpm
    fact out there from another module it will not affect this fact.
  - Added a provider for the tpm2_changeauth functionality that is equivalant to
    what tpm2_takeownership did.
  - Updated tpm2::ownership to check the version of tools installed and call the correct
    type and provider.  The tpm2::*auth parameters will accept a value of 'ignore' if
    tpm2_tools version 4 or later is installed.  Otherwise the parameters for
    tpm2::ownership have not changed.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.2.1
changelog:
  - Set the minimum and maximum UID and GID allowed onto the system to the
    default defined in /etc/login.defs or a sensible default if not otherwise
    specified


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.2.3
changelog:
  - Use Simplib::Umask data type in lieu of validate_umask(),
    a deprecated simplib Puppet 3 function.
  - Update the upper bound of stdlib to < 6.0.0
  - Update a URL in the README.md


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.3-0
changelog:
  - Ensure that the default VNC sessions set the IPv4 flag
  - Ensure that the default VNC sessions set the banner to /dev/null


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0-0
changelog:
  - Remove automatic setting of the XDMCP setting in GDM - BREAKING
    - It was determined that this should be something that the administrator
      should explicitly opt into by setting it in the GDM module settings via
      Hiera since it has security implications


author: Nick Miller <nick.miller@onyxpoint.com> - 7.0.0-0
changelog:
  - Add support for Puppet 5 and OEL
  - Convert docs to yard tags and add reference.md
  - Added $package_ensure parameters to vnc::server and vnc::client
    - Changed the packages from 'latest' to 'installed'
    - Each will also respect `simp_options::package_ensure`


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Use Simplib::Port data type in lieu of deprecated, simplib
    Puppet 3 validate_port()
  - Use new Vnc::Geometry data type in lieu of deprecated,
    stdlib validate_re()
  - Updated a URL in the README.md


author: Nick Miller <Nick.miller@onyxpoint.com> - 7.2.0-0
changelog:
  - Added support for Puppet 5
  - Added reference.md
  - Moved user/group management to it's own manifest, allowing for easier
    ordering
  - Added $package_ensure parameter
    - Changed the package from 'latest' to 'installed'
    - It will also respect `simp_options::package_ensure`
  - Added some OEL content but not declaring support for it yet


author: Joseph Sharkey <shark.bruhaha@gmail.com> - 7.2.1-0
changelog:
  - Fixed ordering issue between the kernel module loading for
    iptables and the service being started
  - Updated tests in support of puppet6, and removed puppet4 support


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.4.0-0
changelog:
  - Add EL8 support
  - The following dependencies are now optional
    - simp/haveged
    - simp/iptables
    - simp/pki
    - simp/tcpwrappers
  - Updated acceptance tests to use lftp in TLS mode and fixed SELinux issues
  - Updated the README


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.4.0
changelog:
  - Fixed
    - Removed simp-dconf, simp-gnome, and simp-mate as dependencies since
      they are not actually used by the module
  - Added REFERENCE.md


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.0.2-0
changelog:
  - Update to Puppet 4 custom functions
  - Update puppet requirement and remove OBE pe requirement in metadata.json


author: Liz Nemsick <lnemsick.simp@gmail.com> - 4.1.1-0
changelog:
  - Fixed bug in which the xinetd::disabled parameter would only
    be included in xinetd.conf if the xinetd::no_access parameter
    was not empty.
  - Use Simplib::Umask data type in lieu of validate_umask(),
    a deprecated simplib Puppet 3 function.
  - Use simplib::validate_net_list() in lieu of validate_net_list(),
    a deprecated simplib Puppet 3 function.
  - Use simplib::nets2cidr() in lieu of nets2cidr(),
    a deprecated simplib Puppet 3 function.
  - Expanded the upper limits of the stdlib Puppet module version


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 4.2.1-0
changelog:
  - Add support for EL8
  - Update README.md
  - Add REFERENCE.md
  - Added acceptance tests
  - Removed `TRAFFIC` from the default `log_on_success` list since it may cause
    information leakage and is not supported by all service types.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.0.0
changelog:
  - Allow users to set the SIMP_ENVIRONMENT environment variable to change the
    initial environment from 'production' to a custom value
  - Fixed an issue where --dry-run would prompt the user to apply instead of
    simply skipping to the (skipped) action items and then writing the
    ~/.simp/simp_conf.yaml file
  - Ensure that `simp config` uses the `simp::classes` parameter instead
    of `classes` by default
  - Accept both `simp::classes` and `classes` as valid existing configurations


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.2
changelog:
  - Fixed a typo in an error message emitted when 'simp config' cannot
    proceed because the environment to configure already exists.
  - Fixed a bug in `simp environment new` in which the actual failure
    messages from a failed `setfacl --restore` execution are not logged.
  - Updated HighLine from version 1.7.8 to 2.0.3.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.0.3
changelog:
  - Fixed a bug where 'simp config' recommended the wrong SSSD domain,
    when the SIMP server was not the LDAP server.  It recommended the
    'Local' domain, when the appropriate SIMP-created domain with the
    'local' (EL6) or 'files' (EL7) provider is 'LOCAL'.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.1.0
changelog:
  - Updated SIMP internet repositories configured by 'simp config'
    - Now uses simp-project.com repositories via new
      ``simp::yum::repo::internet_simp`` class
    - The packagecloud repositories are no longer being updated.
  - Added instructions to the local user lockout warning message in the
    bootstrap lock file:
    - Explain how to create a metadata.json file with the correct module
      dependencies for the sample Puppet code.
    - Tell the user to check that they can ssh into the server with the new
      user after bootstrap but before rebooting. This step is imperative to
      ensure that the user can also get through Puppet-managed
      authentication!
  - Fixed the following:
    - Bug in which `simp config` did not allow DNS domains that did
      not include at least one '.'.  Domains are now validated
      per RFC 3696.
    - Typo in a simp cli message about applying FACLs.
    - Incorrect path for the location of the SIMP server hieradata file
      in the local user lockout warning message in the bootstrap lock file.
    - Missing instructions in the local user lockout warning message about
      adding `passwd => false` to `simp::user_specification` for users who
      log in without a password.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.0
changelog:
  - simp config changes:
    - The LOCAL sssd domain is no longer needed for sssd to start. The
      sssd::domains value is now only set if the SIMP server is the LDAP server.
    - Configure simp_options::ntp::servers instead of deprecated
      simp_options::ntpd::servers.
    - Set the NTP server defaults for ntpd and chronyd.
      simp_options::ntp::servers is intended to be the default NTP server
      settings for a SIMP system, regardless of whether it uses ntpd or
      chronyd. However, the chrony module does not use simp_options,
      because it is not a SIMP-maintained module. To work around this,
      `simp config` was updated to set chrony::servers to an alias of
      simp_options::ntp::servers in hieradata.
    - Check for both ntpd and chronyd settings when determining the OS defaults
      for simp_options::ntp::server, not just ntpd settings.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.0
changelog:
  - Removed support for EL6
  - simp kv breaking changes:
    - Updated the `simp kv` command suite to work with simp-simpkv
      Puppet module version >= 0.8.0.
      - simp-simpkv 0.8.0 changed how global keys are accessed.
      - Only impacts sites that explicitly enabled the experimental
        simpkv capability.
  - simp CLI changes:
    - Dropped support for Puppet 5.
  - simp config changes:
    - Updated LDAP configuration to use 389ds, when the SIMP server is the LDAP
      is on EL>7.
      - Configures the LDAP server to be the SIMP 389ds accounts instance
      - Configures the LDAP client to communicate with the 389ds server.
    - Updated the logic that extracts existing DNS configuration to
      handle scenarios in which /etc/resolv.conf is not available.
    - Added option to configure a local user with ssh and sudo privileges
      to prevent server lockout, when SIMP is not installed from ISO.
      - Especially important for cloud instances when the user does not have
        console access.
      - Specified local user will be created if not already present.
      - If the specified local user exists and has authorized ssh keys, the keys
        will be copied to /etc/ssh/local_keys/, the default location of local user
        ssh authorized key files in SIMP.
        IMPORTANT: Any future updates to a users's ssh authorized key list must
        be made to the user's file in /etc/ssh/local_keys/.
    - Moved the mechanism to set the SIMP server's grub password to Puppet.
      - The password is now set via simp_grub::password instead of
        grub::password.
    - Fixed a bug in which running `simp config` multiple times could result in
      multiple /etc/hosts entries for the puppetserver.
    - Removed the OBE action that created an updates repo in /var/www/yum and
      disabled CentOS repos, when SIMP was installed via ISO.
    - Updated the list of packages to verify when SIMP is not installed
      via ISO.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.0.0
changelog:
  - Changed set/get from `master` to `server` in updates to the puppet
    configuration
  - Changed the check for puppetserver running from a fragile CRL query to the
    actual `status` endpoint and moved from `curl` to native `net/http`
  - Removed management of puppetdb components since it is no longer enabled by
    default.


author: Jim Anderson <thesemicolons@protonmail.com> - 6.4.0-0
changelog:
  - Added message if 'simp_opt == prompt' where the user is directed to the
    documentation for partition requirements and prompted to remember to create a
    /boot partition.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.4.0-0
changelog:
  - Added the following to the simp-extras package
    - pupmod-simp-oath
    - pupmod-simp-simp_grub
    - pupmod-simp-simp_bolt
  - Updated package versions
  - Moved pupmod-puppetlabs-java from simp to simp-extras, as it is not
    required by any other packages in the simp package
  - Replaced pupmod-cristifalcas-journald with pupmod-simp-journald.
    The SIMP org has assumed ownership of this project.
  - Replaced pupmod-razorsedge-snmp with pupmod-puppet-snmp.
    The Vox Pupuli org has assumed ownership of this project.
  - Replaced pupmod-simp-timezone with pupmod-saz-timezone.
  - Replaced pupmod-vshn-gitlab with pupmod-puppet-gitlab.
    The Vox Pupuli org has assumed ownership of this project.
  - Added the following to simp
    - pupmod-simp-rkhunter
  - Added the following to simp-extras
    - pupmod-puppetlabs-ruby_task_helper
    - pupmod-simp-freeradius
    - pupmod-simp-hirs_provisioner
  - Removed the following from simp-extras because the
    versions supported are EOL
    - pupmod-elastic-elasticsearch
    - pupmod-elastic-logstash
    - pupmod-simp-simp_elasticsearch
    - pupmod-simp-simp_logstash
    - pupmod-richardc-datacat
    - pupmod-puppet-grafana
    - pupmod-simp-simp_grafana
  - Removed OBE pupmod-simp-dirtycow from simp-extras


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.5.0-ALPHA
changelog:
  - Add obsolete messages for pupmod rpms in simp-extras that were not
    updated for 6.5.0 and will cause depencancy issues when upgrading.
  - updated the dependency versions
  - removed the following package dependencies from extras:
    - pupmod-puppetlabs-docker
    - pupmod-simp-docker
    - pupmod-puppet-gitlab
    - pupmod-simp-simp_gitlab
    - pupmod-simp-simp_snmpd
  - add firewalld and chrony to the Puppetfile and simp.spec file
  - update the version of simplib required.
  - This is just the start, more updates will be needed before creation of
    an iso and full tests will work.
  - removed unused augeasproviders package dependencies from simp:
    - pupmod-herculesteam-augeasproviders_apache
    - pupmod-herculesteam-augeasproviders_mounttab
    - pupmod-herculesteam-augeasproviders_nagios
    - pupmod-herculesteam-augeasproviders_pam
    - pupmod-herculesteam-augeasproviders_postgresql
    - pupmod-herculesteam-augeasproviders_puppet
    - pupmod-herculesteam-augeasproviders_shellvar
  - added the following package dependencies to simp:
    - pupmod-simp-crypto_policy
    - pupmod-simp-simpkv
  - moved pupmod-simp-tuned package dependency from simp to extras


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.5.0-ALPHA
changelog:
  - Disable all internet-based CentOS repos in EL8 kickstart template
  - Re-enable `fips=1` in the EL8 kickstart template bootloader
  - Minor fixes & formatting updates to EL8 kickstart template


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.5.0-1
changelog:
  - Add the following modules back in to 6.5.0 as they have been updated:
    - pupmod-simp-simp_gitlab
    - pupmod-simp-simp_snmpd


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 6.6.0-1
changelog:
  - Updated the kickstart files for EL7 ISO to copy the SIMP repo into
    OS specific directories.  It will be installed into
    /var/www/yum/SIMP/<osfamily>/<os version>/<arch> and a link will be created
    from the full version to the major version.
  - Updated repo_detect.sh to set up the simp repository to match the above changes.
  - Removed the CentOS 6 build files.
  - Update the EL8 kickstart file with comment about changes needed for UEFI boot.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.6.0-1
changelog:
  - Updated the list of provided components
    - Additions:
      - simp/ds389
      - simp/simp_ds389
    - Removals:
      - simp/simp_bolt
      - simp/simp_pki_service
    - Replacements:
      - aboe/chrony has been replaced by puppet/chrony
      - camptocamp/kmod has been replaced by puppet/kmod
  - Updated versions of provided components
  - Removed the dependency on facter
  - Removed the dependency on createrepo
  - Removed the obsolete code in 'post' that worked on the Updates yum repo
  - Removed simp/upstart since EL6 is no longer supported


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 0.0.6-0
changelog:
  - Updated the minimum version of the puppet-agent dependency to at least
    1.10.4 (packages puppet 4.10.4), due to 'puppet generate types' bugs
    in puppet-agent releases prior to that. These bugs cause the composite
    namevar fixes to not function properly.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.0-0
changelog:
  - Removed delivery of global, Hiera 3 hiera.yaml file.
  - Added logic to ensure any existing hiera.yaml.simp file is not removed
    on upgrade from simp-adapter <= 0.0.6.
  - Added uninstall logic to remove an existing hiera.yaml.simp file that had
    been preserved from simp-adapter <= 0.0.6, but which is no longer in the
    simp-adapter RPM file list.
  - Removed enabling OBE puppet trusted_node_data setting in %post
  - Removed disabling OBE puppet stringify_facts setting in %post


author: Liz Nemsick <lnemsick.simp@gmail.com> - 0.1.1-0
changelog:
  - Affect a copy with simp_rpm_helper when called in either the %posttrans
    or %post of a SIMP RPM.
  - Fix bug in simp-adapter.spec in which a comment line was missing the '#'


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.0
changelog:
  - Reworked simp_rpm_helper to install a module's content into a
    SIMP-managed, bare Git repository, instead of a 'simp' environment
    (/var/puppetlabs/code/environments/simp), during a module RPM
    install/upgrade.  See the comment block header in
    /usr/local/sbin/simp_rpm_helper for more detailed information about
    the new behavior and configuration.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 1.0.1
changelog:
  - Adjust simp_rpm_helper behavior to allows the simp-environment
    package to be upgraded to the simp-environment-skeleton package
    without simp_rpm_helper errors:
    - Accept a deprecated '--preserve' option in simp_rpm_helper.  This
      option no longer does anything.
    - Disable verification that '--target_dir' is a fully-qualified path.
  - Remove OBE %post logic plus the RPM requires and distribution
    release qualifier related to it.
  - Combine simp-adapter-foss and simp-adapter-pe into 1 package


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.0.0
changelog:
  - Removed logic to ensure any existing, global hiera.yaml.simp file is not
    removed on upgrade from simp-adapter <= 0.0.6.
    - If users have followed SIMP upgrade procedures and have already upgraded to
      simp-adapter 1.0.x, this removed logic will not be an issue.
    - Otherwise, the user can manually save off /etc/puppetlabs/puppet/hiera.yaml.simp
      prior to upgrade, and then restore that file after the upgrade is complete.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 2.1.0
changelog:
  - Added support for EL8
    - Use 'Recommends' in lieu of 'Requires' on EL8 so that the git
      package is not uninstalled if the simp-adapter package
      is uninstalled.
    - simp_rpm_helper now checks for the 'git' or 'rsync' executables
      and fails if either cannot be found. This is necessary because
      'Recommends' does not ensure 'git' and 'rsync' are available.
  - Updated minimum version of puppet-agent required to 6.22.1


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Updated firewall-related docs in the changelog
  - Added a HOWTO for fully disabling a system's firewall


author: Chris Tessmer <chris.tessmer@onyxpoint.com>
changelog:
  - Announced immediate deprecation of EL6 in 6.5.0 CHANGELOG
  - Removed references to EL6 ISO & tarball in various sections


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Correct SSL recovery documentation
  - Convert all instances of 'puppet master' to 'puppet server'
  - Correct a few links


author: Trevor Vaughan <tvaughan@onyxpoint.com>
changelog:
  - Add HOWTO for managing PuppetDB
  - Add HOWTO for enabling client reports
  - Removed obsolete references to Travis CI


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.2-0
changelog:
  - FakeCA Updates
    - Allow users to specify an alternate output directory via a KEYDIST
      environment variable
    - Consolidate the certificate request and revocation code
    - Certificate revocation now runs in linear time


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.3-0
changelog:
  - Replace `classes` with `simp::classes` and `simp::server::classes` as
    appropriate in example Hiera YAML files.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.1.4-0
changelog:
  - Ensure that the server hieradata defaults have 'simp::server' in the
    'simp::classes' array. Otherwise, it will never get picked up.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.2.0-1
changelog:
  - Ensure that firewalld is used by default in the applicable SIMP scenarios.
  - Bump the Release to '1' in the RPM spec file since this is stable.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.2.1-1
changelog:
  - Removed the obsolete `simp_options::clamav` setting from all hieradata
    files.
  - Updated the FakeCA README.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 7.3.0-1
changelog:
  - No longer configure puppetdb on the puppet server by default
    - Added documentation in the associated hieradata file
    - Added the necessary configuration to enable puppetdb storage of node reports
      by default


author: Liz Nemsick <lnemsick.simp@gmail.com> - 3.0.3-0
changelog:
  - Fix changelog/version mismatch which resulted in the release of
    a 3.0.2 tag for which the RPM version was actually 3.0.3.


author: Jeanne Greulich <jeanne.greulich@gmail.com> - 3.1.2-1
changelog:
  - Fixed a bug where the GPG keys were copied into /var/www/yum/SIMP/GPGKEYS/
    during the post install, even if /var/www/yum/SIMP/ did not exist.
  - Fixed a bug where the copy of the GPG keys into /var/www/yum/SIMP/GPGKEYS/
    during the post install failed, when /var/www/yum/SIMP/ existed but
    /var/www/yum/SIMP/GPGKEYS/ did not exist.


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 7.0.0-0
changelog:
  - Renamed to simp-rsync-skeleton. The last release of simp-rsync provides a
    stub for not removing files that are currently in place upon system upgrade.
  - Updated Rsync to install under the skeleton directory instead
    of in the active environment directories.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.1-0
changelog:
  - Removed OBE *.rpmnew deletion logic in %post
  - Removed OBE OS symlink login in %post and %preun
  - Removed OBE %pre logic


author: Robert Clark <rbclark@mitre.org> - 7.0.2-0
changelog:
  - Removed rndc.key from repository to prevent users from accidentally using
    a published secret key.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.3-0
changelog:
  - Fixed a bug in which the name of the rndc key in the sample named.conf
    files did not match the name of the automatically-generated key in
    /etc/rndc.key. This mismatch would prevent the named service from starting.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.0.4-0
changelog:
  - Modernized the README for tftpboot files. It now explains
    which boot files for the tftpboot server are required when
    `tftpboot:use_os_files` is set to `false`.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 7.1.0-1
changelog:
  - Added support for EL8
  - Removed support for EL6
  - Removed dynamic files from the list of files to rsync
    - RedHat/7/bind_dns/default/named/var/run/named/named.pid
    - RedHat/7/bind_dns/default/named/var/named/data/named_mem_stats.txt


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 1.0.0-0
changelog:
  - Creation of a new simp-selinux-policy package.  Policies were
    originally packaged in the simp-environment package.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.3.0-0
changelog:
  - Added (optional) `--unpack-pxe [DIR]` option to the `unpack_dvd` script
    - Added (optional) `--environment ENV` to set the PXE rsync environment
    - Added a new `--[no-]unpack-yum` (enabled by default), to permit users to
      disable the RPM unpack
    - To enable unpacking PXE tftpboot files, run with `--unpack-pxe`
    - To disable unpacking RPMs/yum repos, run with `--no-unpack-yum`
    - See `unpack_dvd --help` for details
  - Overhauled `unpack_dvd --help`; output now fits on 80-character PTY consoles


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 6.4.0-0
changelog:
  - Added check for dangerously unspecific OS versions in `unpack_dvd`
    (e.g., '7' instead of '7.0.2003').  This is common when autodetecting the OS
    version from the ISO's .treeinfo on some OSes (particularly CentOS).
    - When detected, script will exit with an informative message + instructions.
    - In this case, users should provide a more specific version with `-v`.
    - Users can explicitly specify an unspecific version with `-v`.


author: Jeanne Greulich <jeanne.greulichr@onyxpoint.com> - 6.5.0-0
changelog:
  - Added sample kickstart files to /usr/share/simp to allow users to have access
    all versions of the kickstart files.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.6.0-1
changelog:
  - Changed shebang in convert_to_inetorg.rb to use Puppet's Ruby instead
    of system Ruby.
  - Removed upgrade_simp_6.0.0_to_6.1.0 script
  - Added a comment to the sample EL8 kickstart file to describe changes
    needed if booting in UEFI mode.
  - Increased the minimum puppet-agent version required to 6.22.1.


author: Jeanne Greulich <jeanne.greulichr@onyxpoint.com> - 6.6.0-1
changelog:
  - Update unpack DVD to extract the SIMP repo into
    <destination dir>/SIMP/<os family>/<os version>/ and create the link
    to the major version if it is requested.


author: Trevor Vaughan <tvaughan@onyxpoint.com> - 6.7.0-1
changelog:
  - Fixed dependencies for EL8 systems
  - Updated unpack_dvd to handle the new SIMP ISO layout and not break the
    exported repos
  - Fixed a bug where a symlink would be created in a versioned ISO directory if
    it was present as a directory instead of a symlink to be replaced
  - Updated the kickstart files in the share directory


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.7.1-1
changelog:
  - Fixed a bug in unpack_dvd error handling that prevented the correct
    error message from being emitted, when unpack_dvd detected the old
    SIMP yum layout.
  - Adjusted the puppet-agent requirement to >= 6.
  - Updated kickstart files in the share directory.


author: Liz Nemsick <lnemsick.simp@gmail.com> - 6.7.2-1
changelog:
  -  EL8 client kickstart config fixes:
     - Removed krb5-workstation and subversion from the list of required packages
     - Added the following lines to enable modular repos required by the kickstart
       module --name=python36 --stream-3.6
       module --name=perl --stream=5.26
       module --name=perl-IO-Socket-SSL --stream=2.066
       module --name=perl-libwww-perl --stream=6.34


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.7.0-0
changelog:
  - Changed:
    - Updated source versions to use r10k 3.7.0 and its corresponding
      gem dependencies
    - The `colored` gem has been deprecated in favor of `colored2`
  - Fixed:
    - Fixed `rake gem_update` to (mostly) correctly update `build/sources.yaml`
    - Re-enabled the simp community repo in acceptance tests
  - Added:
    - Project README.md
    - Enhancements to `rake gem_update`:
      - Resolves r10k gem dependencies from the r10k gem on rubygems.org
      - Updates version, url, repo, and license
      - When it can't safely update a url, it will print a warning (helpful because log4r is a
      - Adds new gem deps, removes old ones
    - Enhancements to `rake pkg:gem`:
      - Hack for git clone of untagged `log4r` release
    - Removed:
      - Old hacks for `colored` gem


author: Jeanne Greulich <jeanne.greulich@onyxpoint.com> - 3.11.0-1
changelog:
  - Updated source versions to use r10k 3.11.0 and its corresponding gems
  - Update Rakefile task pkg:rpm to add macro brp_mangle_shebangs so the shebangs
    in bash files would be /usr/bin/env ruby instead of pointing to the system ruby.
  - Gem jwt, has a non standard gemspec file name.  Added a check for this so
    it would build the gem.


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.11.0-1
changelog:
  - Fixed `rake pkg:gem` and `rake pkg:rpm` to ignore local gem environment
  - Add generated .spec file to git, so `pkg:single` can build it


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.12.1-1
changelog:
  - Changed:
    - Updated r10k gem to 3.12.1
    - gems are installed into the RPMs buildroot/geminstdir with `--env-shebang`
  - Added:
    - New `excludes:` key to gems in `build/sources.yaml`
    - RPMs include `dist` tags
  - Removed:
    - gettext RPM does not include gem's `samples/` directory


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.12.1-3
changelog:
  - Changed:
    - RPM for `colored2` gem now obsoletes RPMs for older `colored` gem
  - Added:
    - New `sources.yaml` keys for arbitrary `obsoletes`, `requires`,
      `conflicts`, and `provides`


author: Chris Tessmer <chris.tessmer@onyxpoint.com> - 3.14.2-1
changelog:
  - Changed:
    - Updated `r10k` gem to 3.14.2
    - Updated dependency `faraday` gem to 0.17.5
    - See https://github.com/puppetlabs/r10k/compare/3.12.1...3.14.2
      for full diff of r10k changes
  - Added:
    - New r10k gem features:
      - New config: `oauth token` for rugged provider
      - Config: `exclude_spec` in `r10k.yaml`, `Puppetfile`, and CLI
      - Add support for `plain` environment type, to allow sources that support
        environment modules to operate without a control repo being required.
      - Add support for `tarball` module type, allowing module content to be
        packaged and sourced from generic fileservers
      - Add experimental support for tarball environment type, allowing whole
        environments to be packaged and sourced from generic fileservers
      - Add support for specifying additional logging ouputs
  - Fixed:
    - Fixes to the r10k gem:
      - Record unprocessed environment name, so that `strip_component` does not
        cause truncated environment names to be used as git branches, resulting
        in errors or incorrect deploys.
      - Ensure `--incremental` does not skip undeployed modules
      - Fix `force` always resolving to true for `puppetfile install`
      - Resync repos with unresolvable refs
      - Do not recurse into symlinked dirs when finding files to purge.
      - Restore Ruby 3 compatibility
      - Ensure the remote url in rugged cache directories is current


