We don't have anycast DNS in Livermore, so this adds a parameter to base::dns,
a parameter that can be set via Hiera, to put Livermore's DNS server at (or
near) the top of the list.

This is important for systems using Puppet and DHCP, because DHCP renewals
rewrite resolv.conf, which then gets re-re-written by Puppet.

The ntp iptables rules date from the days when Unix Systems actually
ran ntp servers on Linux hosts.  Since the ntp service is now provided
by hardware appliances there is no need to allow inbound ntp
connections.  Remove the iptables rules allow inbound ntp connections
at Rob Riepel's suggestion.

Similarly remove restrict entries from ntp.conf that point at hosts
that are no longer ntp servers.  Be a bit more conservative and leave
the restrict to the current ntp servers.

Remove some iptables fragments that are no longer used to reduce
confusion.

VMWare does not package vmware-tools-esx-nox for EL7. They
instead recommend the use of open-vm-tools. Added a condition
and refactored the manifest appropriately.

wheezy systems.

It turns out the the only special case in the pam configuration was
for etch.  The files suffixed with .lenny actually was the default
configuration and not lenny specific.

[os][rpm] Support CentOS via its own class, stub an OEL
class, small fixes to redhat.pp to be generic enough for use
by these RHEL-ish operating systems, edits to allow EL7-
specific repository inclusions {and exclusions} (jlent)

It was possible to override the sshd_config file only with a complete
file.  This change allows the sshd_config file to be specified as a
template.