* since it's too easy to use a hyphen--which is invalid

These files are supposed to have different permissions (0660 for
btmp and 0664 for wtmp), which isn't possible using a single united
base::newsyslog::config stanza.  Separate them into two stanzas
with the correct permissions.

We keep running into other packages that depend on it, which makes
removing it unnecessarily difficult.

Map Ubuntu raring to wheezy instead of squeeze for the Stanford-local
Debian repositories.

Avoid too many levels of redirection through variables and
variables with studly-caps in favor of a single variable.
Default to the jessie and sid package, since that's what we'll
use going forward.  Avoid using regexes; this isn't really a
regex match, and we'll soon be able to delete the lenny case
anyway.

Two versions of puppet dev config one for puppetca-dev and
one for lsdb-dev (this is for testing the PuppetCA migration to frankoz1).

Replaced frankoz-dev with two servers: frankoz1-dev and
frankoz2-dev. Updated the Puppet conf file to reflect this change.

Try to stick with the same method of a conditional blank line.

Comment the protocol restriction and the explicit enabling of
UsePrivilegeSeparation on Red Hat.

This should be next to the port configuration, since it's related,
and is important enough that it needs to be at the top of the file
so that it can be easily found.  It also doesn't make sense after
per-user settings.

If no ListenAddress directives are specified, then sshd will list for
incoming connections at all addresses. You can alter this by specifying
the listen_addresses parameter. For example:
listen_addresses => '192.168.1.1,192.168.2.1'

Ignore some more harmless messages that appear to be caused by
someone connecting to the server and then disconnecting without
trying to authenticate (such as when they realize their Kerberos
ticket is expired or doesn't exist).

Don't single out the specific accounts that Nessus checks, but instead
skip all the errors about disconnecting due to too many authentication
failures.

Add additional ignore patterns for failed ssh logins from IT Services
staff.

frankoz-dev is now frankoz1-dev and frankoz2-dev, so had to modify the
puppetclient db credentials class to account for this.

base::remctl no longer installs remctl-client.  This is going to be
handled by the stanford-server-packages metapackage, and is
independent of what's set up by this module.

Make this dependency explicit.

The acceptable runtime for tmpreaper (used by base::tmpclean on Debian
and Ubuntu) has been extended to 20 minutes globally, and the
base::tmpclean::longer class, which existed only to do that, has been
removed as unnecessary.  The longer runtime limit should not pose a
problem on any system.

Clean up formatting and comments for installed files and Puppet
manifests.