The stanford.edu MXes are almost all moved off-campus, and the one that's
left will be going away soon, as well!

That means we need to update the transport file, so that stanford.edu (and
sub-domains) begin being handled by smtp.stanford.edu again, since
smtp.stanford.edu still has an on-campus presence.

If the system's primary IP address is in one of the two well-known Livermore
netblocks, then automatically set the Livermore-based Kerberos server as the
primary KDC.

base::kerberos::dr is now deprecated.

The KDCs were completely wrong, so this domain's configuration was redone.

This was requested in Remedy ticket INC000003427399.

The ntp iptables rules date from the days when Unix Systems actually
ran ntp servers on Linux hosts.  Since the ntp service is now provided
by hardware appliances there is no need to allow inbound ntp
connections.  Remove the iptables rules allow inbound ntp connections
at Rob Riepel's suggestion.

Similarly remove restrict entries from ntp.conf that point at hosts
that are no longer ntp servers.  Be a bit more conservative and leave
the restrict to the current ntp servers.

Remove some iptables fragments that are no longer used to reduce
confusion.

It turns out the the only special case in the pam configuration was
for etch.  The files suffixed with .lenny actually was the default
configuration and not lenny specific.

[os][rpm] Support CentOS via its own class, stub an OEL
class, small fixes to redhat.pp to be generic enough for use
by these RHEL-ish operating systems, edits to allow EL7-
specific repository inclusions {and exclusions} (jlent)

For new formats are included:

  SourceHostFileFormat
  SourceHostForwardFormat
  SourceIPFileFormat
  SourceIPForwardFormat