Puppet

At the moment I'm doing something like this:

  exec { "allow-ssh":
    command => "echo 'sshd : ALL' >> /etc/hosts.allow",
    onlyif  => "grep -qv ^sshd /etc/hosts.allow";
  }

Would much prefer this:

  tcpwrapper { sshd:
    ensure => allow,  # default is to allow
    hosts => "ALL";
  }