The KDCs were completely wrong, so this domain's configuration was redone.

This was requested in Remedy ticket INC000003427399.

We don't have anycast DNS in Livermore, so this adds a parameter to base::dns,
a parameter that can be set via Hiera, to put Livermore's DNS server at (or
near) the top of the list.

This is important for systems using Puppet and DHCP, because DHCP renewals
rewrite resolv.conf, which then gets re-re-written by Puppet.

On April 29, the Networking team notified all LNAs that the legacy "C" DNS
servers are being retired on November 1, and that they will start notifying
sysadmins this month if their systems are still querying the old DNS servers.

The ntp iptables rules date from the days when Unix Systems actually
ran ntp servers on Linux hosts.  Since the ntp service is now provided
by hardware appliances there is no need to allow inbound ntp
connections.  Remove the iptables rules allow inbound ntp connections
at Rob Riepel's suggestion.

Similarly remove restrict entries from ntp.conf that point at hosts
that are no longer ntp servers.  Be a bit more conservative and leave
the restrict to the current ntp servers.

Remove some iptables fragments that are no longer used to reduce
confusion.

VMWare does not package vmware-tools-esx-nox for EL7. They
instead recommend the use of open-vm-tools. Added a condition
and refactored the manifest appropriately.