Greetings,

I am a security researcher, who is looking for security smells in Puppet scripts.
I noticed two instances of hard-coded passwords, which are against the best practices
recommended by Common Weakness Enumeration (CWE) [https://cwe.mitre.org/data/definitions/259.html] and also by other security practitioners.
I have added hiera support to mitigate this smell. Feedback is welcome.

Pull request: #397

Here is where I noticed hard-coded passwords:
https://github.com/puppetlabs/pltraining-classroom/blob/master/manifests/params.pp

In the repositories.pp:

if $manageyum and $::osfamily == 'RedHat' {
yumrepo { $repositories:
enabled => $offline ? {
true => '0',
false => '1',
},
}
# Don't choke if another module has "include epel"
if ! defined(Class['epel']) {
class { 'epel':
epel_enabled => $offline,
}
}

When a user sets $offline = true, the epel_enabled's value will become true as well. Shouldn't there be a selector state similar tot he yumrepo resource above it?