* apt tool sensetive for tralling spaces, and 2 files
    aka:
    cat -E mcp_saltstack
    $
    Package: libsodium18$
    Pin: release o=SaltStack$
    Pin-Priority: 50$
      $
    Package: *$
    Pin: release o=SaltStack$
    Pin-Priority: 1100$
      $
    # VS
    cat -E mcp_saltstack
    $
    Package: libsodium18$
    Pin: release o=SaltStack$
    Pin-Priority: 50$
    $
    Package: *$
    Pin: release o=SaltStack$
    Pin-Priority: 1100$
    $
    Make's different logic for apt

Change-Id: Ia5fdbe319a65b0fa017c8c065905db1837f9f982

Prod-Related: EME-405

Change-Id: Id9a8ebefb227c4b0a99d8cdd955c39401720bbee

* Ubuntu pinning params allow to be used
     multiply times. In same time, old `list`
     format now allowing to be predictable
     iterated inside jinja

Related-Bug: PROD-21604 (PROD:21604)

Change-Id: If1c0f0f834a296b9a19d0af5fc7673c9229a7ac5

Fixes: PROD-23149 (PROD:23149)

Change-Id: I14c68a0a519a63951571f966fae72fd01ec2e556

Change-Id: Ibbbb99511544ab3bb1532b71942fea15ae0f34a1

Related-Prod: PROD-22653

Change-Id: I5b389309f0cb2890cf9a9a777348efb5a9d7d735

* CIS 1.4.1 Ensure permissions on bootloader config are configured

Related-Prod: PROD-22655

Change-Id: Ia282baae0be5c038d42b672758662aaed9aae6f5

* CIS 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
* CIS 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled
* CIS 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled
* CIS 1.1.1.4 Ensure mounting of hfs filesystems is disabled
* CIS 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled
* CIS 1.1.1.6 Ensure mounting of squashfs filesystems is disabled
* CIS 1.1.1.7 Ensure mounting of udf filesystems is disabled
* CIS 1.1.1.8 Ensure mounting of FAT filesystems is disabled
* CIS 3.5.1 Ensure DCCP is disabled
* CIS 3.5.2 Ensure SCTP is disabled
* CIS 3.5.3 Ensure RDS is disabled
* CIS 3.5.4 Ensure TIPC is disabled

Related-Prod: PROD-20756
Related-Prod: PROD-20757
Related-Prod: PROD-20758
Related-Prod: PROD-20759

Change-Id: Ia8bf992498ef739a4a40fb108fcb449900caf6e3

Permissions 640 root:root doesn't allow regular user to read
/etc/{at,cron}.allow files, that changes behavior of at / crontab
commands:

* crontab command can't read /etc/cron.allow and allow any user to modify
  their crontab files.
* at command can't read /etc/at.allow and deny every user.

at / crontab files have SGID bits set, so setting correct group
on /etc/{at,cron}.allow fixes the issue.

Change-Id: I4a3fc8d8e823498d6715e26307424e3065cbd6ca

* CIS 5.4.4 Ensure default user umask is 027 or more restrictive (Scored)
* CIS 5.4.5 Ensure default user shell timeout is 900 seconds or less (Scored)

Related-Prod: PROD-20765

Change-Id: I5ff5e5bc76e1d87432caec70f2b35eec288e9213

* CIS 1.5.4 Ensure prelink is disabled
* CIS 2.3.1 Ensure NIS Client is not installed
* CIS 2.3.2 Ensure rsh client is not installed
* CIS 2.3.3 Ensure talk client is not installed
* CIS 2.3.4 Ensure telnet client is not installed

Change-Id: I0eb11d39deaa28f238a2e618bf95cc248189197c

* CIS 1.1.14 Ensure nodev option set on /dev/shm partition (Scored)
* CIS 1.1.15 Ensure nosuid option set on /dev/shm partition (Scored)
* CIS 1.1.16 Ensure noexec option set on /dev/shm partition (Scored)

Related-Prod: PROD-22652

Change-Id: I35f371ce36bae6104e0176f63bd43a8fc4e5bad3

Related-Prod: PROD-21969

Change-Id: I1c30189ee85605a5c68861d98f00bf5ac5e772c2

linux/system/user.sls ignores 'shell' option if a
user is system. This is quite strange behavior, and it
breaks CIS:
* 5.4.2 Ensure system accounts are non-login

Change-Id: I32dd44ac4fcc1425ea47eb4cf60acf41f6ce0887
Related-Prod: PROD-20764

CIS items copied from cisbench:
* CIS 6.1.2 Ensure permissions on /etc/passwd are configured (Scored)
* CIS 6.1.3 Ensure permissions on /etc/shadow are configured (Scored)
* CIS 6.1.4 Ensure permissions on /etc/group are configured (Scored)
* CIS 6.1.5 Ensure permissions on /etc/gshadow are configured (Scored)
* CIS 6.1.6 Ensure permissions on /etc/passwd- are configured (Scored)
* CIS 6.1.7 Ensure permissions on /etc/shadow- are configured (Scored)
* CIS 6.1.8 Ensure permissions on /etc/group- are configured (Scored)
* CIS 6.1.9 Ensure permissions on /etc/gshadow- are configured (Scored)

Change-Id: I195d08a98c2401a9b0fa8f146ee4b365f933fa1f

Related-Prod: PROD-22546
Related-Prod: PROD-22664

Change-Id: I66a35ef3d2436541ef70f02e2631fa8d4d86e5e9

Change-Id: I956da1f26e500eae693827ed5dce0f7e65e291bc
Closes-Bug: PROD-22520 (PROD:22520)

Change-Id: I91bfb8e2a06fc0499addd376db9e38483a6756d0

* CIS 1.5.1 Ensure core dumps are restricted
* CIS 1.5.3 Ensure address space layout randomization (ASLR) is enabled
* CIS 3.1.2 Ensure packet redirect sending is disabled
* CIS 3.2.1 Ensure source routed packets are not accepted
* CIS 3.2.2 Ensure ICMP redirects are not accepted
* CIS 3.2.3 Ensure secure ICMP redirects are not accepted
* CIS 3.2.4 Ensure suspicious packets are logged
* CIS 3.2.5 Ensure broadcast ICMP requests are ignored
* CIS 3.2.6 Ensure bogus ICMP responses are ignored
* CIS 3.2.7 Ensure Reverse Path Filtering is enabled
* CIS 3.2.8 Ensure TCP SYN Cookies is enabled

All sysctls are valid for Ubuntu 14.04, Ubuntu 16.04.

Change-Id: I48f34c55d97a78c253d4810db46b2a04ff5c0c1a

This reverts commit d87f461319.

Change-Id: If175b29f2e130ecf5041e7b0be20f15485089ffa

* CIS 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
* CIS 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled
* CIS 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled
* CIS 1.1.1.4 Ensure mounting of hfs filesystems is disabled
* CIS 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled
* CIS 1.1.1.6 Ensure mounting of squashfs filesystems is disabled
* CIS 1.1.1.7 Ensure mounting of udf filesystems is disabled
* CIS 1.1.1.8 Ensure mounting of FAT filesystems is disabled
* CIS 3.5.1 Ensure DCCP is disabled
* CIS 3.5.2 Ensure SCTP is disabled
* CIS 3.5.3 Ensure RDS is disabled
* CIS 3.5.4 Ensure TIPC is disabled

Related-Prod: PROD-20756
Related-Prod: PROD-20757
Related-Prod: PROD-20758
Related-Prod: PROD-20759

Change-Id: I719984829978caf0401e78daaabf1adfb0d1cfdf

Support full set of options defined in

  man modprobe.d

Change-Id: I3d30b6bc261ef308ae6afd963f13fda1e4b22c0d

* Update run_tests.sh to the latest revision
  * drop odd .kitchen.vagrant.yml

Related-Bug: PROD-20730 (PROD:20730)

Change-Id: I367800a60ad17020700a76670d1216dfdfcfe692

* Add\fix __virtual__ for modules
  * Remove unneded multiline for repo.sls

Change-Id: I1f8d321b68dfe6a44264b4ddcd6cd0c576938da1

* Add TODO-proper fix for state - native salt fun.
   But due bug[1] in saltstack - we can't enable
   proper solution now

[1] 74599bbdfc

Related-PROD: PROD-20730

Change-Id: I11b6d81ae0f9a7864518f638e8fc423e4e087285

Related-Prod: PROD-20755

Change-Id: I44cc3bdb4a0436ff17f790a828d03697b89d3520

Change-Id: I511996de9d8abc69d6775b45482f8196c7159a1a

Change-Id: I70a28cac5c07fb3093b6038a0c448d16847a42e3

Change-Id: I5468d69c362cbd2e71a064bd2bc89f843fbefe7e

* Fix processing disabled repo
   * Extend tests for such case

Change-Id: Ib3243f2b3e70aecef65273be215b30613b8df025
Closes-Bug: PROD-21954 (PROD:21954)

system:repo: Fix duplicate file.absent sls IDs

Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>

- Add possibility to remove prereq. packages installation BEFORE
     * Crucial logic violation - if we don't have any repo\
       have them configured in wrong way - stage will always fail.
     * install prereq. packages after all - sounds stupid, but correct.
     * By default - it will still try to install prereq. We don't want to
       broke OLD logic.See readme, how-to overide such behaviour.
   - don't update cache per-repo - it's simply useless and may fail due p1.
     Run update only once - after all repos configured\reconfigured
   - Add new option at system:refresh_repos_meta - for case, when update
     should not be run in any case. By default - true.
   - remove 99proxies-salt-{{ name }} along with disabled repo
   - fix duplicate 'clean_file' option

Closes-Bug: PROD-15992 (PROD:15992)

Change-Id: I4b312f82f65be80e7726f62482978f68c25746a3

Wait for dpdk bond interfaces to come up.

linux.network.dpdk state fails to update a port within for loop
when this port does not exist yet.
Dependency will require interfaces to be added before

Prod-Related: PROD-19696
Closes-Bug: PROD-19696

Change-Id: Ia83218a76dd6e86664e7f9498a76341717eb5b80

Since we added to nstat's telegraf plugin the possibility
to collect data from `/proc/net/softnet_stat` regarding
dropped packets and rx_net_action a.k.a time squeeze, we need to enable
it globally on all hosts.

Also grafana dashboard update to include new graphs + added four
new Prometheus alers.

Related-Bug: PROD-21090

Change-Id: I9dfe87bdc8b677a51e3f305dd3c75c7d4cc4e0d4

* Make system.repo more readable

Change-Id: I0f28e71f4b00422a70006559525e5be24c4cb065