Default to the backports version of facter on wheezy systems to pick
up the fix for detecting Xen VMs.

Remove base::kerberos filter-syslog rules.  These only had rules for
ksu, which we no longer use, so they're now pointless.

This change is to allow the v7 rsyslog template to be corrected
without changing the default rsyslog behavior.

Add an apt preferences file to use the rsyslog version from
backports.  Remove preferences installation from the syslog
module.

When using v7 add an apt preferences fragment that pulls rsyslog
from backports.

This also leaves a place for redhat folks to add special processing.

Globally disable monlist in all the ntp.conf variations to protect
against use of monlist to launch UDP-based DoS attacks.  This was
probably already prevented by firewall rules, but may as well make
sure.

Change the filter-syslog rule for Debian to a broader pattern to
match more of the buggy power limit notifications generated by
newer Dell hardware.

default format that pulls all template and output configuration from
the rsyslog.d fragments directory.  Current default behavior is not
changed for now.

Add v5 and v7 fragments for default templates and output.  New
fragments to support a more complete time format.

Lowercase the hostname when forming a Kerberos principal in the
out-of-date cron job.  Some Networking systems use .Stanford.EDU
in the official hostname.  (rra)

Ignore buggy CPU core power limit notifications from new Dell
hardware in default Debian filter-syslog rules.

This change does not affect the current usage of the module.  It does
allow manifests to choose to retire /etc/syslog.conf in favor or
fragments in /etc/rsyslog.d to control the syslog activity.  One
default fragment, 90-local.conf, that writes syslog messages
locally.

This change also include a fragment define that is used for the
management of rsyslog fragments.

Ignore some more harmless messages that appear to be caused by
someone connecting to the server and then disconnecting without
trying to authenticate (such as when they realize their Kerberos
ticket is expired or doesn't exist).

Don't single out the specific accounts that Nessus checks, but instead
skip all the errors about disconnecting due to too many authentication
failures.

Add additional ignore patterns for failed ssh logins from IT Services
staff.

The acceptable runtime for tmpreaper (used by base::tmpclean on Debian
and Ubuntu) has been extended to 20 minutes globally, and the
base::tmpclean::longer class, which existed only to do that, has been
removed as unnecessary.  The longer runtime limit should not pose a
problem on any system.

Clean up formatting and comments for installed files and Puppet
manifests.

The static crontab files installed by base::cron have been replaced
with a template to handle differences between Red Hat and Debian.  The
periodic cron jobs no longer even attempt to use anacron, avoiding any
problems with unpredictable cron run times if anacron is installed on
the system.