Linux bridges are automatically set UP when
any parent interface is UP.

But for OVS bridges it doesn't work.

For dpdk and non-dpdk bridges, always create a
config file in /etc/network/interfaces.u/ and
bring the bridge interface up after it is configured,
even if it doesn't have IP address.

Change-Id: I92888ce0d373e412dfb7ed2e2398c0d4d008e301
Closes-Bug: https://mirantis.jira.com/browse/PROD-24343

change logic when I define user.gid

Current thresholds don't matche real warning/minor values for
the time_squeeze numbers. As a result we have false positive.

Change-Id: I6990c101fe671c05d75d0640fd6799667b5f3fa1
Related-PROD: PROD-24406 (PROD:24406)

- in inspec >= 3.0.0 there are changes in schema
	  which require to have tests/integration dir
	  to contain tests, otherwise fails
	- this is temporary workaround until we decide
	  proper fix

Change-Id: Ie251c093e3d66532d027a47a56272936cf3cbcb3

Change-Id: I3338950ed3726a750149d849d33813b0eeed50c0

* Add ability to disable some swap entities and enable others

Change-Id: Ic2f947f7b9fc6f29411a9171d68eb0836fce29ed
Related-task: #PROD-23150 (PROD:23150)

Useful during environment setup.

Change-Id: Ic8d4d82cc6f6afb0ac2a6e4285c3b681bb895b6d

This typo mistake affects behavior of user.present module function
as it uses 'useradd' linux utility under the hood.
Missing USERGROUPS_ENAB parameter == do not create user groups by default.
This change in behavior of useradd util breaks all states, which are relaying
on creation of user group during new user creation procedure, e.g. set up
cassandra backups.

Change-Id: Ie17aae58fc6673b9c5d53bb68f681446f30d0a1a
Related-bug: PROD-23741

https://gerrit.mcp.mirantis.com/25351/ was merged but linux.system.shell
state wasn't included into init.yml and was never used.

This commit fixes this.

Related-Prod: PROD-23581

Change-Id: I89e09247dd2566b8a5b0c0e67e8ca9c789ed57f6

CIS 5.4.1.4 should be configured in /etc/default/useradd

cis-5-4-1-4.yml attempts to configure this item in
pillar that relates to /etc/login.defs and should be removed.

Related-Prod: PROD-23600

Change-Id: Iea93a54a44df919c07001fc02e3551276ef9583c

To simplify filtering in Kibana change
systemd.source prefix to record field "source".

Change-Id: I7729ae6721a1050a938370a588d35313f91f971a
Related-bug: PROD-21827 (PROD:21827)

Previous implementation was not able to add port 'dpdk0' to bridge
'br-dpdk0' since both matches 'grep' condition. To fix this we need to
look for port in a particular bridge

Change-Id: Ie83cebc3ab73c45a48f68fae2d6f474743215908

Change-Id: Ia8690d3968aa6c8491ec62b73f78afd6b2361c60

* 5.4.4 Ensure default user umask is 027 or more restrictive (Scored)

Change-Id: Idc219e7f6e8ab4b7e3d24a36f95f8aab4eff3160
Related-Prod: PROD-18386

Change-Id: If1bbd97b5719c53193f6287c4a025e6ef0dafbb0
Related-Prod: PROD-18386

* CIS 5.4.1.1 Ensure password expiration is 90 days or less (Scored)
* CIS 5.4.1.2 Ensure minimum days between password changes is 7 or more (Scored)
* CIS 5.4.1.3 Ensure password expiration warning days is 7 or more (Scored)
* CIS 5.4.1.4 Ensure inactive password lock is 30 days or less (Scored)

Related-Prod: PROD-18386

Change-Id: I42697c31823c631acb1528ca917b39c069fb72bf

The following parameters defined in /etc/login.defs can
be overridden per-user:

* PASS_MAX_DAYS
* PASS_MIN_DAYS
* PASS_WARN_DAYS
* INACTIVE

Related-Prod: PROD-18386

Change-Id: I5b182128f9dd8a043b48fb86e61febb2fd5c7e0a

* apt tool sensetive for tralling spaces, and 2 files
    aka:
    cat -E mcp_saltstack
    $
    Package: libsodium18$
    Pin: release o=SaltStack$
    Pin-Priority: 50$
      $
    Package: *$
    Pin: release o=SaltStack$
    Pin-Priority: 1100$
      $
    # VS
    cat -E mcp_saltstack
    $
    Package: libsodium18$
    Pin: release o=SaltStack$
    Pin-Priority: 50$
    $
    Package: *$
    Pin: release o=SaltStack$
    Pin-Priority: 1100$
    $
    Make's different logic for apt

Change-Id: Ia5fdbe319a65b0fa017c8c065905db1837f9f982

Prod-Related: EME-405

Change-Id: Id9a8ebefb227c4b0a99d8cdd955c39401720bbee

* Ubuntu pinning params allow to be used
     multiply times. In same time, old `list`
     format now allowing to be predictable
     iterated inside jinja

Related-Bug: PROD-21604 (PROD:21604)

Change-Id: If1c0f0f834a296b9a19d0af5fc7673c9229a7ac5

Fixes: PROD-23149 (PROD:23149)

Change-Id: I14c68a0a519a63951571f966fae72fd01ec2e556

Change-Id: Ibbbb99511544ab3bb1532b71942fea15ae0f34a1

Related-Prod: PROD-22653

Change-Id: I5b389309f0cb2890cf9a9a777348efb5a9d7d735

* CIS 1.4.1 Ensure permissions on bootloader config are configured

Related-Prod: PROD-22655

Change-Id: Ia282baae0be5c038d42b672758662aaed9aae6f5

* CIS 1.1.1.1 Ensure mounting of cramfs filesystems is disabled
* CIS 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled
* CIS 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled
* CIS 1.1.1.4 Ensure mounting of hfs filesystems is disabled
* CIS 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled
* CIS 1.1.1.6 Ensure mounting of squashfs filesystems is disabled
* CIS 1.1.1.7 Ensure mounting of udf filesystems is disabled
* CIS 1.1.1.8 Ensure mounting of FAT filesystems is disabled
* CIS 3.5.1 Ensure DCCP is disabled
* CIS 3.5.2 Ensure SCTP is disabled
* CIS 3.5.3 Ensure RDS is disabled
* CIS 3.5.4 Ensure TIPC is disabled

Related-Prod: PROD-20756
Related-Prod: PROD-20757
Related-Prod: PROD-20758
Related-Prod: PROD-20759

Change-Id: Ia8bf992498ef739a4a40fb108fcb449900caf6e3

Permissions 640 root:root doesn't allow regular user to read
/etc/{at,cron}.allow files, that changes behavior of at / crontab
commands:

* crontab command can't read /etc/cron.allow and allow any user to modify
  their crontab files.
* at command can't read /etc/at.allow and deny every user.

at / crontab files have SGID bits set, so setting correct group
on /etc/{at,cron}.allow fixes the issue.

Change-Id: I4a3fc8d8e823498d6715e26307424e3065cbd6ca

* CIS 5.4.4 Ensure default user umask is 027 or more restrictive (Scored)
* CIS 5.4.5 Ensure default user shell timeout is 900 seconds or less (Scored)

Related-Prod: PROD-20765

Change-Id: I5ff5e5bc76e1d87432caec70f2b35eec288e9213

* CIS 1.5.4 Ensure prelink is disabled
* CIS 2.3.1 Ensure NIS Client is not installed
* CIS 2.3.2 Ensure rsh client is not installed
* CIS 2.3.3 Ensure talk client is not installed
* CIS 2.3.4 Ensure telnet client is not installed

Change-Id: I0eb11d39deaa28f238a2e618bf95cc248189197c

* CIS 1.1.14 Ensure nodev option set on /dev/shm partition (Scored)
* CIS 1.1.15 Ensure nosuid option set on /dev/shm partition (Scored)
* CIS 1.1.16 Ensure noexec option set on /dev/shm partition (Scored)

Related-Prod: PROD-22652

Change-Id: I35f371ce36bae6104e0176f63bd43a8fc4e5bad3