In general it is a great start and works as our chef implementation. Why should we whitelist squid by default? For chef and puppet os hardening we need a documentation about the whitelisted and blacklisted services as well as a reason. I agree that we should whitelist most of the well-known and most used applications but we need a definition for a border, where users of the puppet module need to configure on top.