* CIS 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
* CIS 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled
* CIS 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled
* CIS 1.1.1.4 Ensure mounting of hfs filesystems is disabled
* CIS 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled
* CIS 1.1.1.6 Ensure mounting of squashfs filesystems is disabled
* CIS 1.1.1.7 Ensure mounting of udf filesystems is disabled
* CIS 1.1.1.8 Ensure mounting of FAT filesystems is disabled
* CIS 3.5.1 Ensure DCCP is disabled
* CIS 3.5.2 Ensure SCTP is disabled
* CIS 3.5.3 Ensure RDS is disabled
* CIS 3.5.4 Ensure TIPC is disabled

Related-Prod: PROD-20756
Related-Prod: PROD-20757
Related-Prod: PROD-20758
Related-Prod: PROD-20759

Change-Id: Ia8bf992498ef739a4a40fb108fcb449900caf6e3

* CIS 1.1.14 Ensure nodev option set on /dev/shm partition (Scored)
* CIS 1.1.15 Ensure nosuid option set on /dev/shm partition (Scored)
* CIS 1.1.16 Ensure noexec option set on /dev/shm partition (Scored)

Related-Prod: PROD-22652

Change-Id: I35f371ce36bae6104e0176f63bd43a8fc4e5bad3

Related-Prod: PROD-21969

Change-Id: I1c30189ee85605a5c68861d98f00bf5ac5e772c2

linux/system/user.sls ignores 'shell' option if a
user is system. This is quite strange behavior, and it
breaks CIS:
* 5.4.2 Ensure system accounts are non-login

Change-Id: I32dd44ac4fcc1425ea47eb4cf60acf41f6ce0887
Related-Prod: PROD-20764

CIS items copied from cisbench:
* CIS 6.1.2 Ensure permissions on /etc/passwd are configured (Scored)
* CIS 6.1.3 Ensure permissions on /etc/shadow are configured (Scored)
* CIS 6.1.4 Ensure permissions on /etc/group are configured (Scored)
* CIS 6.1.5 Ensure permissions on /etc/gshadow are configured (Scored)
* CIS 6.1.6 Ensure permissions on /etc/passwd- are configured (Scored)
* CIS 6.1.7 Ensure permissions on /etc/shadow- are configured (Scored)
* CIS 6.1.8 Ensure permissions on /etc/group- are configured (Scored)
* CIS 6.1.9 Ensure permissions on /etc/gshadow- are configured (Scored)

Change-Id: I195d08a98c2401a9b0fa8f146ee4b365f933fa1f

Related-Prod: PROD-22546
Related-Prod: PROD-22664

Change-Id: I66a35ef3d2436541ef70f02e2631fa8d4d86e5e9

Change-Id: I956da1f26e500eae693827ed5dce0f7e65e291bc
Closes-Bug: PROD-22520 (PROD:22520)

Change-Id: I91bfb8e2a06fc0499addd376db9e38483a6756d0

* CIS 1.5.1 Ensure core dumps are restricted
* CIS 1.5.3 Ensure address space layout randomization (ASLR) is enabled
* CIS 3.1.2 Ensure packet redirect sending is disabled
* CIS 3.2.1 Ensure source routed packets are not accepted
* CIS 3.2.2 Ensure ICMP redirects are not accepted
* CIS 3.2.3 Ensure secure ICMP redirects are not accepted
* CIS 3.2.4 Ensure suspicious packets are logged
* CIS 3.2.5 Ensure broadcast ICMP requests are ignored
* CIS 3.2.6 Ensure bogus ICMP responses are ignored
* CIS 3.2.7 Ensure Reverse Path Filtering is enabled
* CIS 3.2.8 Ensure TCP SYN Cookies is enabled

All sysctls are valid for Ubuntu 14.04, Ubuntu 16.04.

Change-Id: I48f34c55d97a78c253d4810db46b2a04ff5c0c1a

This reverts commit d87f461319.

Change-Id: If175b29f2e130ecf5041e7b0be20f15485089ffa

* CIS 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
* CIS 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled
* CIS 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled
* CIS 1.1.1.4 Ensure mounting of hfs filesystems is disabled
* CIS 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled
* CIS 1.1.1.6 Ensure mounting of squashfs filesystems is disabled
* CIS 1.1.1.7 Ensure mounting of udf filesystems is disabled
* CIS 1.1.1.8 Ensure mounting of FAT filesystems is disabled
* CIS 3.5.1 Ensure DCCP is disabled
* CIS 3.5.2 Ensure SCTP is disabled
* CIS 3.5.3 Ensure RDS is disabled
* CIS 3.5.4 Ensure TIPC is disabled

Related-Prod: PROD-20756
Related-Prod: PROD-20757
Related-Prod: PROD-20758
Related-Prod: PROD-20759

Change-Id: I719984829978caf0401e78daaabf1adfb0d1cfdf

Support full set of options defined in

  man modprobe.d

Change-Id: I3d30b6bc261ef308ae6afd963f13fda1e4b22c0d

* Update run_tests.sh to the latest revision
  * drop odd .kitchen.vagrant.yml

Related-Bug: PROD-20730 (PROD:20730)

Change-Id: I367800a60ad17020700a76670d1216dfdfcfe692

* Add\fix __virtual__ for modules
  * Remove unneded multiline for repo.sls

Change-Id: I1f8d321b68dfe6a44264b4ddcd6cd0c576938da1

* Add TODO-proper fix for state - native salt fun.
   But due bug[1] in saltstack - we can't enable
   proper solution now

[1] 74599bbdfc

Related-PROD: PROD-20730

Change-Id: I11b6d81ae0f9a7864518f638e8fc423e4e087285

Related-Prod: PROD-20755

Change-Id: I44cc3bdb4a0436ff17f790a828d03697b89d3520

Change-Id: I511996de9d8abc69d6775b45482f8196c7159a1a

Change-Id: I70a28cac5c07fb3093b6038a0c448d16847a42e3

Change-Id: I5468d69c362cbd2e71a064bd2bc89f843fbefe7e

* Fix processing disabled repo
   * Extend tests for such case

Change-Id: Ib3243f2b3e70aecef65273be215b30613b8df025
Closes-Bug: PROD-21954 (PROD:21954)

system:repo: Fix duplicate file.absent sls IDs

Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>

- Add possibility to remove prereq. packages installation BEFORE
     * Crucial logic violation - if we don't have any repo\
       have them configured in wrong way - stage will always fail.
     * install prereq. packages after all - sounds stupid, but correct.
     * By default - it will still try to install prereq. We don't want to
       broke OLD logic.See readme, how-to overide such behaviour.
   - don't update cache per-repo - it's simply useless and may fail due p1.
     Run update only once - after all repos configured\reconfigured
   - Add new option at system:refresh_repos_meta - for case, when update
     should not be run in any case. By default - true.
   - remove 99proxies-salt-{{ name }} along with disabled repo
   - fix duplicate 'clean_file' option

Closes-Bug: PROD-15992 (PROD:15992)

Change-Id: I4b312f82f65be80e7726f62482978f68c25746a3

Wait for dpdk bond interfaces to come up.

linux.network.dpdk state fails to update a port within for loop
when this port does not exist yet.
Dependency will require interfaces to be added before

Prod-Related: PROD-19696
Closes-Bug: PROD-19696

Change-Id: Ia83218a76dd6e86664e7f9498a76341717eb5b80

Since we added to nstat's telegraf plugin the possibility
to collect data from `/proc/net/softnet_stat` regarding
dropped packets and rx_net_action a.k.a time squeeze, we need to enable
it globally on all hosts.

Also grafana dashboard update to include new graphs + added four
new Prometheus alers.

Related-Bug: PROD-21090

Change-Id: I9dfe87bdc8b677a51e3f305dd3c75c7d4cc4e0d4

* Make system.repo more readable

Change-Id: I0f28e71f4b00422a70006559525e5be24c4cb065

related bug: PROD-21512

Change-Id: I874535dbc6882ad49f133999209ae6a4c3bde403

Fixes: PROD-21350

Change-Id: If5a4473296e4d2cb6a80cb7397ac38a66011f39d

nscd is recommended package for libpam-ldapd and libnss-ldapd, but
since we disabled Install-Recommends for apt in
https://gerrit.mcp.mirantis.net/14431 we need to specify this package in
linux formula.
nscd is a daemon which handles passwd, group and host lookups for
running programs and caches the results for the next query.

Change-Id: Ia17441da2b3072d943d0e9225721dc9921de2514

Change-Id: Id9ffc5cbbbb10fd6136d459ed461151a1800e857
related-bug: PROD-21205

PROD-20944

Change-Id: I9ef98b529d57171cf17c33597fd6af69d2f43a41

As we resign to develop full-stack solution to monitor cron jobs

This reverts commit 697ce4bf04.

Change-Id: Icab6008011141bb658c836897a05018dd6ce2984

Change-Id: I710b65decf6697d0bb5d21fc3fc2d332b78119c5
Closes-bug: PROD-21073

Change-Id: I6b21bed3dd2c632af8274769b562f366c4057b82
Closes-Prod: PROD-20090

Change-Id: I41f6e9c4feed93d03ac0479f9bd3626e48ad8063
Co-Authored-By: Michael Polenchuk <mpolenchuk@mirantis.com>
Closes-Bug: PROD-20729

We create custom hugepages mount point for KVM/DPDK with custom
parameters (ownership flags/hugepages size). Need to disable default
mount point, because it can be unexpectedly used by DPDK.

Change-Id: Ibee95422213260e544406391c7a0922f1a41c5c2
Closes-Bug: PROD-14325

- fixed pkgrepo.manage to use/prefer key_url for salt >= 2017.7
- updated syntax for key verificatoin
- fix, avoid curl for salt:// schema (as in #156)

Change-Id: I1b50c287a4030a9cefa1b819017d59cc5fb1c197

Commit totally broke all deployment CI job.

This reverts commit 24477c590b.

Change-Id: Idce0954f0bd363095069e91edc6941ca78b22c60

Change-Id: Id5b5a44f3dfbbdd60442fd2f273b72557fa9e191

Change-Id: I9e8464e3ee5ef28ca5eb7eb84e645e42fb6576cd
Closes-bug: PROD-20466

Change-Id: I2d374a589e18f38f91beac9514ff5bf3c034d637