/etc/ferm is now also (kind of, almost) under puppet control