On April 29, the Networking team notified all LNAs that the legacy "C" DNS
servers are being retired on November 1, and that they will start notifying
sysadmins this month if their systems are still querying the old DNS servers.

The ntp iptables rules date from the days when Unix Systems actually
ran ntp servers on Linux hosts.  Since the ntp service is now provided
by hardware appliances there is no need to allow inbound ntp
connections.  Remove the iptables rules allow inbound ntp connections
at Rob Riepel's suggestion.

Similarly remove restrict entries from ntp.conf that point at hosts
that are no longer ntp servers.  Be a bit more conservative and leave
the restrict to the current ntp servers.

Remove some iptables fragments that are no longer used to reduce
confusion.

VMWare does not package vmware-tools-esx-nox for EL7. They
instead recommend the use of open-vm-tools. Added a condition
and refactored the manifest appropriately.

wheezy systems.

It turns out the the only special case in the pam configuration was
for etch.  The files suffixed with .lenny actually was the default
configuration and not lenny specific.

[os][rpm] Support CentOS via its own class, stub an OEL
class, small fixes to redhat.pp to be generic enough for use
by these RHEL-ish operating systems, edits to allow EL7-
specific repository inclusions {and exclusions} (jlent)

It was possible to override the sshd_config file only with a complete
file.  This change allows the sshd_config file to be specified as a
template.