diff --git a/manifests/init.pp b/manifests/init.pp
index 924eb02..1e77543 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,354 +1,368 @@
 # This class installs redis
 #
 # @example Default install
 #   include redis
 #
 # @example Slave Node
 #   class { '::redis':
 #     bind    => '10.0.1.2',
 #     slaveof => '10.0.1.1 6379',
 #   }
 #
 # @example Binding on multiple interfaces
 #   class { 'redis':
 #     bind => ['127.0.0.1', '10.0.0.1', '10.1.0.1'],
 #   }
 #
 # @example Binding on all interfaces
 #   class { 'redis':
 #     bind => [],
 #   }
 #
 # @param activerehashing
 #   Enable/disable active rehashing.
 # @param aof_load_truncated
 #   Enable/disable loading truncated AOF file
 # @param aof_rewrite_incremental_fsync
 #   Enable/disable fsync for AOF file
 # @param appendfilename
 #   The name of the append only file
 # @param appendfsync
 #   Adjust fsync mode
 # @param appendonly
 #   Enable/disable appendonly mode.
 # @param auto_aof_rewrite_min_size
 #   Adjust minimum size for auto-aof-rewrite.
 # @param auto_aof_rewrite_percentage
 #   Adjust percentatge for auto-aof-rewrite.
 # @param bind
 #   Configure which IP address(es) to listen on. To bind on all interfaces, use an empty array.
 # @param config_dir
 #   Directory containing the configuration files.
 # @param config_dir_mode
 #   Adjust mode for directory containing configuration files.
 # @param config_file_orig
 #   The location and name of a config file that provides the source
 # @param config_file
 #   Adjust main configuration file.
 # @param config_file_mode
 #   Adjust permissions for configuration files.
 # @param config_group
 #   Adjust filesystem group for config files.
 # @param config_owner
 #   Adjust filesystem owner for config files.
 # @param conf_template
 #   Define which template to use.
 # @param daemonize
 #   Have Redis run as a daemon.
 # @param default_install
 #   Configure a default install of redis.
 # @param databases
 #   Set the number of databases.
 # @param dbfilename
 #   The filename where to dump the DB
 # @param extra_config_file
 #   Optional extra config file to include
 # @param hash_max_ziplist_entries
 #   Set max ziplist entries for hashes.
 # @param hash_max_ziplist_value
 #   Set max ziplist values for hashes.
 # @param hll_sparse_max_bytes
 #   HyperLogLog sparse representation bytes limit
 # @param hz
 #   Set redis background tasks frequency
 # @param latency_monitor_threshold
 #   Latency monitoring threshold in milliseconds
 # @param list_max_ziplist_entries
 #   Set max ziplist entries for lists.
 # @param list_max_ziplist_value
 #   Set max ziplist values for lists.
 # @param log_dir
 #   Specify directory where to write log entries.
 # @param log_dir_mode
 #   Adjust mode for directory containing log files.
 # @param log_file
 #   Specify file where to write log entries.
 # @param log_level
 #   Specify the server verbosity level.
 # @param manage_repo
 #   Enable/disable upstream repository configuration.
 # @param manage_package
 #   Enable/disable management of package
 # @param managed_by_cluster_manager
 #   Choose if redis will be managed by a cluster manager such as pacemaker or rgmanager
 # @param masterauth
 #   If the master is password protected (using the "requirepass" configuration
 # @param maxclients
 #   Set the max number of connected clients at the same time.
 # @param maxmemory
 #   Don't use more memory than the specified amount of bytes.
 # @param maxmemory_policy
 #   How Redis will select what to remove when maxmemory is reached.
 # @param maxmemory_samples
 #   Select as well the sample size to check.
 # @param min_slaves_max_lag
 #   The lag in seconds
 # @param min_slaves_to_write
 #   Minimum number of slaves to be in "online" state
 # @param no_appendfsync_on_rewrite
 #   If you have latency problems turn this to 'true'. Otherwise leave it as
 # @param notify_keyspace_events
 #   Which events to notify Pub/Sub clients about events happening
 # @param notify_service
 #   You may disable service reloads when config files change if you
 # @param package_ensure
 #   Default action for package.
 # @param package_name
 #   Upstream package name.
 # @param pid_file
 #   Where to store the pid.
 # @param port
 #   Configure which port to listen on.
 # @param protected_mode
 #   Whether protected mode is enabled or not.  Only applicable when no bind is set.
 # @param ppa_repo
 #   Specify upstream (Ubuntu) PPA entry.
 # @param rdbcompression
 #   Enable/disable compression of string objects using LZF when dumping.
 # @param repl_backlog_size
 #   The replication backlog size
 # @param repl_backlog_ttl
 #   The number of seconds to elapse before freeing backlog buffer
 # @param repl_disable_tcp_nodelay
 #   Enable/disable TCP_NODELAY on the slave socket after SYNC
 # @param repl_ping_slave_period
 #   Slaves send PINGs to server in a predefined interval. It's possible
 # @param repl_timeout
 #   Set the replication timeout for:
 # @param requirepass
 #   Require clients to issue AUTH <PASSWORD> before processing any other commands.
 # @param save_db_to_disk
 #   Set if save db to disk.
 # @param save_db_to_disk_interval
 #   save the dataset every N seconds if there are at least M changes in the dataset
 # @param service_manage
 #   Specify if the service should be part of the catalog.
 # @param service_enable
 #   Enable/disable daemon at boot.
 # @param service_ensure
 #   Specify if the server should be running.
 # @param service_group
 #   Specify which group to run as.
 # @param service_hasrestart
 #   Does the init script support restart?
 # @param service_hasstatus
 #   Does the init script support status?
 # @param service_name
 #   Specify the service name for Init or Systemd.
 # @param service_provider
 #   Specify the service provider to use
 # @param service_user
 #   Specify which user to run as.
 # @param set_max_intset_entries
 #   The following configuration setting sets the limit in the size of the set
 #   in order to use this special memory saving encoding.
 # @param slave_priority
 #   The priority number for slave promotion by Sentinel
 # @param slave_read_only
 #   You can configure a slave instance to accept writes or not.
 # @param slave_serve_stale_data
 #   When a slave loses its connection with the master, or when the replication
 #   is still in progress, the slave can act in two different ways:
 #   1) if slave-serve-stale-data is set to 'yes' (the default) the slave will
 #      still reply to client requests, possibly with out of date data, or the
 #      data set may just be empty if this is the first synchronization.
 #   2) if slave-serve-stale-data is set to 'no' the slave will reply with
 #      an error "SYNC with master in progress" to all the kind of commands
 #      but to INFO and SLAVEOF.
 # @param slaveof
 #   Use slaveof to make a Redis instance a copy of another Redis server.
 # @param slowlog_log_slower_than
 #   Tells Redis what is the execution time, in microseconds, to exceed in order
 #   for the command to get logged.
 # @param slowlog_max_len
 #   Tells Redis what is the length to exceed in order for the command to get
 #   logged.
 # @param stop_writes_on_bgsave_error
 #   If false then Redis will continue to work as usual even if there are
 #   problems with disk, permissions, and so forth.
 # @param syslog_enabled
 #   Enable/disable logging to the system logger.
 # @param syslog_facility
 #   Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.
 # @param tcp_backlog
 #   Sets the TCP backlog
 # @param tcp_keepalive
 #   TCP keepalive.
 # @param timeout
 #   Close the connection after a client is idle for N seconds (0 to disable).
 # @param ulimit
 #   Limit the use of system-wide resources.
 # @param unixsocket
 #   Define unix socket path
 # @param unixsocketperm
 #   Define unix socket file permissions
 # @param workdir
 #   The DB will be written inside this directory, with the filename specified
 #   above using the 'dbfilename' configuration directive.
 # @param workdir_mode
 #   Adjust mode for data directory.
 # @param zset_max_ziplist_entries
 #   Set max entries for sorted sets.
 # @param zset_max_ziplist_value
 #   Set max values for sorted sets.
 # @param cluster_enabled
 #   Enables redis 3.0 cluster functionality
 # @param cluster_config_file
 #   Config file for saving cluster nodes configuration. This file is never
 #   touched by humans. Only set if cluster_enabled is true
 # @param cluster_node_timeout
 #   Node timeout. Only set if cluster_enabled is true
 # @param cluster_slave_validity_factor
 #   Control variable to disable promoting slave in case of disconnection from master
 #   Only set if cluster_enabled is true
 # @param cluster_require_full_coverage
 #   If false Redis Cluster will server queries even if requests about a subset of keys can be processed
 #   Only set if cluster_enabled is true
 # @param cluster_migration_barrier
 #   Minimum number of slaves master will remain connected with, for another
 #   slave to migrate to a master which is no longer covered by any slave.
 #   Only set if cluster_enabled is true
 # @param instances
 #   Iterate through multiple instance configurations
 class redis (
   Boolean $activerehashing                                       = true,
   Boolean $aof_load_truncated                                    = true,
   Boolean $aof_rewrite_incremental_fsync                         = true,
   String[1] $appendfilename                                      = 'appendonly.aof',
   Enum['no', 'always', 'everysec'] $appendfsync                  = 'everysec',
   Boolean $appendonly                                            = false,
   String[1] $auto_aof_rewrite_min_size                           = '64mb',
   Integer[0] $auto_aof_rewrite_percentage                        = 100,
   Variant[Stdlib::IP::Address, Array[Stdlib::IP::Address]] $bind = ['127.0.0.1'],
   String[1] $output_buffer_limit_slave                           = '256mb 64mb 60',
   String[1] $output_buffer_limit_pubsub                          = '32mb 8mb 60',
   String[1] $conf_template                                       = 'redis/redis.conf.erb',
   Stdlib::Absolutepath $config_dir                               = $redis::params::config_dir,
   Stdlib::Filemode $config_dir_mode                              = $redis::params::config_dir_mode,
   Stdlib::Absolutepath $config_file                              = $redis::params::config_file,
   Stdlib::Filemode $config_file_mode                             = '0644',
   Stdlib::Absolutepath $config_file_orig                         = $redis::params::config_file_orig,
   String[1] $config_group                                        = $redis::params::config_group,
   String[1] $config_owner                                        = $redis::params::config_owner,
   Boolean $daemonize                                             = $redis::params::daemonize,
   Integer[1] $databases                                          = 16,
   Boolean $default_install                                       = true,
   Variant[String[1], Boolean] $dbfilename                        = 'dump.rdb',
   Optional[String] $extra_config_file                            = undef,
   Integer[0] $hash_max_ziplist_entries                           = 512,
   Integer[0] $hash_max_ziplist_value                             = 64,
   Integer[0] $hll_sparse_max_bytes                               = 3000,
   Integer[1, 500] $hz                                            = 10,
   Integer[0] $latency_monitor_threshold                          = 0,
   Integer[0] $list_max_ziplist_entries                           = 512,
   Integer[0] $list_max_ziplist_value                             = 64,
   Stdlib::Absolutepath $log_dir                                  = '/var/log/redis',
   Stdlib::Filemode $log_dir_mode                                 = $redis::params::log_dir_mode,
   Stdlib::Absolutepath $log_file                                 = '/var/log/redis/redis.log',
   Redis::LogLevel $log_level                                     = 'notice',
   Boolean $manage_service_file                                   = false,
   Boolean $manage_package                                        = true,
   Boolean $manage_repo                                           = false,
   Optional[String[1]] $masterauth                                = undef,
   Integer[1] $maxclients                                         = 10000,
   $maxmemory                                                     = undef,
   $maxmemory_policy                                              = undef,
   $maxmemory_samples                                             = undef,
   Integer[0] $min_slaves_max_lag                                 = 10,
   Integer[0] $min_slaves_to_write                                = 0,
   Boolean $no_appendfsync_on_rewrite                             = false,
   Optional[String[1]] $notify_keyspace_events                    = undef,
   Boolean $notify_service                                        = true,
   Boolean $managed_by_cluster_manager                            = false,
+  String[1] $minimum_version                                     = $redis::params::minimum_version,
   String[1] $package_ensure                                      = 'present',
   String[1] $package_name                                        = $redis::params::package_name,
   Stdlib::Absolutepath $pid_file                                 = $redis::params::pid_file,
   Stdlib::Port $port                                             = 6379,
   Boolean $protected_mode                                        = true,
   Optional[String] $ppa_repo                                     = $redis::params::ppa_repo,
   Boolean $rdbcompression                                        = true,
   String[1] $repl_backlog_size                                   = '1mb',
   Integer[0] $repl_backlog_ttl                                   = 3600,
   Boolean $repl_disable_tcp_nodelay                              = false,
   Integer[1] $repl_ping_slave_period                             = 10,
   Integer[1] $repl_timeout                                       = 60,
   Optional[String] $requirepass                                  = undef,
   Boolean $save_db_to_disk                                       = true,
   Hash $save_db_to_disk_interval                                 = { '900' => '1', '300' => '10', '60' => '10000' },
   Boolean $service_enable                                        = true,
   Stdlib::Ensure::Service $service_ensure                        = 'running',
   String[1] $service_group                                       = 'redis',
   Boolean $service_hasrestart                                    = true,
   Boolean $service_hasstatus                                     = true,
   Boolean $service_manage                                        = true,
   String[1] $service_name                                        = $redis::params::service_name,
   Optional[String] $service_provider                             = undef,
   String[1] $service_user                                        = 'redis',
   Integer[0] $set_max_intset_entries                             = 512,
   Integer[0] $slave_priority                                     = 100,
   Boolean $slave_read_only                                       = true,
   Boolean $slave_serve_stale_data                                = true,
   Optional[String[1]] $slaveof                                   = undef,
   Integer[0] $slowlog_log_slower_than                            = 10000,
   Integer[0] $slowlog_max_len                                    = 1024,
   Boolean $stop_writes_on_bgsave_error                           = true,
   Boolean $syslog_enabled                                        = false,
   Optional[String[1]] $syslog_facility                           = undef,
   Integer[0] $tcp_backlog                                        = 511,
   Integer[0] $tcp_keepalive                                      = 0,
   Integer[0] $timeout                                            = 0,
   Variant[Stdlib::Absolutepath, Enum['']] $unixsocket            = '/var/run/redis/redis.sock',
   Variant[Stdlib::Filemode, Enum['']] $unixsocketperm            = '0755',
   Integer[0] $ulimit                                             = 65536,
   Stdlib::Absolutepath $workdir                                  = $redis::params::workdir,
   Stdlib::Filemode $workdir_mode                                 = '0750',
   Integer[0] $zset_max_ziplist_entries                           = 128,
   Integer[0] $zset_max_ziplist_value                             = 64,
   Boolean $cluster_enabled                                       = false,
   String[1] $cluster_config_file                                 = 'nodes.conf',
   Integer[1] $cluster_node_timeout                               = 5000,
   Integer[0] $cluster_slave_validity_factor                      = 0,
   Boolean $cluster_require_full_coverage                         = true,
   Integer[0] $cluster_migration_barrier                          = 1,
   Hash[String[1], Hash] $instances                               = {},
 ) inherits redis::params {
+  if $package_ensure =~ /^([0-9]+:)?[0-9]+\.[0-9]/ {
+    if ':' in $package_ensure {
+      $_redis_version_real = split($package_ensure, ':')
+      $redis_version_real = $_redis_version_real[1]
+    } else {
+      $redis_version_real = $package_ensure
+    }
+  } else {
+    $redis_version_real = pick(getvar('redis_server_version'), $minimum_version)
+  }
+
+  $supports_protected_mode = !$redis_version_real or versioncmp($redis_version_real, '3.2.0') >= 0
+
   contain redis::preinstall
   contain redis::install
   contain redis::config
   contain redis::service
 
   $instances.each | String $key, Hash $values | {
     redis::instance { $key:
       * => $values,
     }
   }
 
   Class['redis::preinstall']
   -> Class['redis::install']
   -> Class['redis::config']
 
   if $redis::notify_service {
     Class['redis::config']
     ~> Class['redis::service']
   }
 }
diff --git a/manifests/instance.pp b/manifests/instance.pp
index bd94502..de24610 100644
--- a/manifests/instance.pp
+++ b/manifests/instance.pp
@@ -1,405 +1,392 @@
 # This is an defined type to allow the configuration of
 # multiple redis instances on one machine without conflicts
 #
 # @summary Allows the configuration of multiple redis configurations on one machine
 #
 # @example
 #   redis::instance {'6380':
 #     port => 6380,
 #   }
 #
 # @param activerehashing
 #   Enable/disable active rehashing.
 # @param aof_load_truncated
 #   Enable/disable loading truncated AOF file
 # @param aof_rewrite_incremental_fsync
 #   Enable/disable fsync for AOF file
 # @param appendfilename
 #   The name of the append only file
 # @param appendfsync
 #   Adjust fsync mode. Valid options: always, everysec, no.
 # @param appendonly
 #   Enable/disable appendonly mode.
 # @param auto_aof_rewrite_min_size
 #   Adjust minimum size for auto-aof-rewrite.
 # @param auto_aof_rewrite_percentage
 #   Adjust percentatge for auto-aof-rewrite.
 # @param bind
 #   Configure which IP address(es) to listen on. To bind on all interfaces, use an empty array.
 # @param config_file_orig
 #   The location and name of a config file that provides the source
 # @param config_file
 #   Adjust main configuration file.
 # @param config_file_mode
 #   Adjust permissions for configuration files.
 # @param config_group
 #   Adjust filesystem group for config files.
 # @param config_owner
 #   Adjust filesystem owner for config files.
 # @param conf_template
 #   Define which template to use.
 # @param daemonize
 #   Have Redis run as a daemon.
 # @param databases
 #   Set the number of databases.
 # @param dbfilename
 #   The filename where to dump the DB
 # @param extra_config_file
 #   Optional extra config file to include
 # @param hash_max_ziplist_entries
 #   Set max ziplist entries for hashes.
 # @param hash_max_ziplist_value
 #   Set max ziplist values for hashes.
 # @param hll_sparse_max_bytes
 #   HyperLogLog sparse representation bytes limit
 # @param hz
 #   Set redis background tasks frequency
 # @param latency_monitor_threshold
 #   Latency monitoring threshold in milliseconds
 # @param list_max_ziplist_entries
 #   Set max ziplist entries for lists.
 # @param list_max_ziplist_value
 #   Set max ziplist values for lists.
 # @param log_dir
 #   Specify directory where to write log entries.
 # @param log_dir_mode
 #   Adjust mode for directory containing log files.
 # @param log_file
 #   Specify file where to write log entries.
 # @param log_level
 #   Specify the server verbosity level.
 # @param masterauth
 #   If the master is password protected (using the "requirepass" configuration
 # @param maxclients
 #   Set the max number of connected clients at the same time.
 # @param maxmemory
 #   Don't use more memory than the specified amount of bytes.
 # @param maxmemory_policy
 #   How Redis will select what to remove when maxmemory is reached.
 # @param maxmemory_samples
 #   Select as well the sample size to check.
 # @param min_slaves_max_lag
 #   The lag in seconds
 # @param min_slaves_to_write
 #   Minimum number of slaves to be in "online" state
 # @param no_appendfsync_on_rewrite
 #   If you have latency problems turn this to 'true'. Otherwise leave it as
 # @param notify_keyspace_events
 #   Which events to notify Pub/Sub clients about events happening
 # @param pid_file
 #   Where to store the pid.
 # @param port
 #   Configure which port to listen on.
 # @param protected_mode
 #   Whether protected mode is enabled or not.  Only applicable when no bind is set.
 # @param rdbcompression
 #   Enable/disable compression of string objects using LZF when dumping.
 # @param repl_backlog_size
 #   The replication backlog size
 # @param repl_backlog_ttl
 #   The number of seconds to elapse before freeing backlog buffer
 # @param repl_disable_tcp_nodelay
 #   Enable/disable TCP_NODELAY on the slave socket after SYNC
 # @param repl_ping_slave_period
 #   Slaves send PINGs to server in a predefined interval. It's possible
 # @param repl_timeout
 #   Set the replication timeout for:
 # @param requirepass
 #   Require clients to issue AUTH <PASSWORD> before processing any other
 #   commands.
 # @param save_db_to_disk
 #   Set if save db to disk.
 # @param save_db_to_disk_interval
 #   save the dataset every N seconds if there are at least M changes in the dataset
 # @param service_name
 #   The service name for this instance
 # @param service_enable
 #   Enable/disable daemon at boot.
 # @param service_ensure
 #   Specify if the server should be running.
 # @param service_group
 #   Specify which group to run as.
 # @param service_hasrestart
 #   Does the init script support restart?
 # @param service_hasstatus
 #   Does the init script support status?
 # @param service_user
 #   Specify which user to run as.
 # @param set_max_intset_entries
 #   The following configuration setting sets the limit in the size of the set
 #   in order to use this special memory saving encoding.
 # @param slave_priority
 #   The priority number for slave promotion by Sentinel
 # @param slave_read_only
 #   You can configure a slave instance to accept writes or not.
 # @param slave_serve_stale_data
 #   When a slave loses its connection with the master, or when the replication
 #   is still in progress, the slave can act in two different ways:
 #   1) if slave-serve-stale-data is set to 'yes' (the default) the slave will
 #      still reply to client requests, possibly with out of date data, or the
 #      data set may just be empty if this is the first synchronization.
 #   2) if slave-serve-stale-data is set to 'no' the slave will reply with
 #      an error "SYNC with master in progress" to all the kind of commands
 #      but to INFO and SLAVEOF.
 # @param slaveof
 #   Use slaveof to make a Redis instance a copy of another Redis server.
 # @param slowlog_log_slower_than
 #   Tells Redis what is the execution time, in microseconds, to exceed in order
 #   for the command to get logged.
 # @param slowlog_max_len
 #   Tells Redis what is the length to exceed in order for the command
 #   to get logged.
 # @param stop_writes_on_bgsave_error
 #   If false then Redis will continue to work as usual even if there
 #   are problems with disk, permissions, and so forth.
 # @param syslog_enabled
 #   Enable/disable logging to the system logger.
 # @param syslog_facility
 #   Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7.
 # @param tcp_backlog
 #   Sets the TCP backlog
 # @param tcp_keepalive
 #   TCP keepalive.
 # @param timeout
 #   Close the connection after a client is idle for N seconds (0 to disable).
 # @param ulimit
 #   Limit the use of system-wide resources.
 # @param unixsocket
 #   Define unix socket path
 # @param unixsocketperm
 #   Define unix socket file permissions
 # @param workdir
 #   The DB will be written inside this directory, with the filename specified
 #   above using the 'dbfilename' configuration directive.
 # @param workdir_mode
 #   Adjust mode for data directory.
 # @param zset_max_ziplist_entries
 #   Set max entries for sorted sets.
 # @param zset_max_ziplist_value
 #   Set max values for sorted sets.
 # @param cluster_enabled
 #   Enables redis 3.0 cluster functionality
 # @param cluster_config_file
 #   Config file for saving cluster nodes configuration. This file is never
 #   touched by humans.  Only set if cluster_enabled is true
 # @param cluster_node_timeout
 #   Node timeout. Only set if cluster_enabled is true
 # @param cluster_slave_validity_factor
 #   Control variable to disable promoting slave in case of disconnection from
 #   master Only set if cluster_enabled is true
 # @param cluster_require_full_coverage
 #   If false Redis Cluster will server queries even if requests about a subset
 #   of keys can be processed Only set if cluster_enabled is true
 # @param cluster_migration_barrier
 #   Minimum number of slaves master will remain connected with, for another
 #   slave to migrate to a  master which is no longer covered by any slave Only
 #   set if cluster_enabled is true
 define redis::instance (
   Boolean $activerehashing                                       = $redis::activerehashing,
   Boolean $aof_load_truncated                                    = $redis::aof_load_truncated,
   Boolean $aof_rewrite_incremental_fsync                         = $redis::aof_rewrite_incremental_fsync,
   String[1] $appendfilename                                      = $redis::appendfilename,
   Enum['no', 'always', 'everysec'] $appendfsync                  = $redis::appendfsync,
   Boolean $appendonly                                            = $redis::appendonly,
   String[1] $auto_aof_rewrite_min_size                           = $redis::auto_aof_rewrite_min_size,
   Integer[0] $auto_aof_rewrite_percentage                        = $redis::auto_aof_rewrite_percentage,
   Variant[Stdlib::IP::Address, Array[Stdlib::IP::Address]] $bind = $redis::bind,
   String[1] $output_buffer_limit_slave                           = $redis::output_buffer_limit_slave,
   String[1] $output_buffer_limit_pubsub                          = $redis::output_buffer_limit_pubsub,
   String[1] $conf_template                                       = $redis::conf_template,
   Stdlib::Absolutepath $config_file                              = $redis::config_file,
   Stdlib::Filemode $config_file_mode                             = $redis::config_file_mode,
   Stdlib::Absolutepath $config_file_orig                         = $redis::config_file_orig,
   String[1] $config_group                                        = $redis::config_group,
   String[1] $config_owner                                        = $redis::config_owner,
   Boolean $daemonize                                             = true,
   Integer[1] $databases                                          = $redis::databases,
   Variant[String[1], Boolean] $dbfilename                        = $redis::dbfilename,
   Optional[String] $extra_config_file                            = $redis::extra_config_file,
   Integer[0] $hash_max_ziplist_entries                           = $redis::hash_max_ziplist_entries,
   Integer[0] $hash_max_ziplist_value                             = $redis::hash_max_ziplist_value,
   Integer[0] $hll_sparse_max_bytes                               = $redis::hll_sparse_max_bytes,
   Integer[1, 500] $hz                                            = $redis::hz,
   Integer[0] $latency_monitor_threshold                          = $redis::latency_monitor_threshold,
   Integer[0] $list_max_ziplist_entries                           = $redis::list_max_ziplist_entries,
   Integer[0] $list_max_ziplist_value                             = $redis::list_max_ziplist_value,
   Stdlib::Absolutepath $log_dir                                  = $redis::log_dir,
   Stdlib::Filemode $log_dir_mode                                 = $redis::log_dir_mode,
   Redis::LogLevel $log_level                                     = $redis::log_level,
-  String[1] $minimum_version                                     = $redis::minimum_version,
   Optional[String[1]] $masterauth                                = $redis::masterauth,
   Integer[1] $maxclients                                         = $redis::maxclients,
   $maxmemory                                                     = $redis::maxmemory,
   $maxmemory_policy                                              = $redis::maxmemory_policy,
   $maxmemory_samples                                             = $redis::maxmemory_samples,
   Integer[0] $min_slaves_max_lag                                 = $redis::min_slaves_max_lag,
   Integer[0] $min_slaves_to_write                                = $redis::min_slaves_to_write,
   Boolean $no_appendfsync_on_rewrite                             = $redis::no_appendfsync_on_rewrite,
   Optional[String[1]] $notify_keyspace_events                    = $redis::notify_keyspace_events,
   Boolean $managed_by_cluster_manager                            = $redis::managed_by_cluster_manager,
-  String[1] $package_ensure                                      = $redis::package_ensure,
   Stdlib::Port $port                                             = $redis::port,
   Boolean $protected_mode                                        = $redis::protected_mode,
   Boolean $rdbcompression                                        = $redis::rdbcompression,
   String[1] $repl_backlog_size                                   = $redis::repl_backlog_size,
   Integer[0] $repl_backlog_ttl                                   = $redis::repl_backlog_ttl,
   Boolean $repl_disable_tcp_nodelay                              = $redis::repl_disable_tcp_nodelay,
   Integer[1] $repl_ping_slave_period                             = $redis::repl_ping_slave_period,
   Integer[1] $repl_timeout                                       = $redis::repl_timeout,
   Optional[String] $requirepass                                  = $redis::requirepass,
   Boolean $save_db_to_disk                                       = $redis::save_db_to_disk,
   Hash $save_db_to_disk_interval                                 = $redis::save_db_to_disk_interval,
   String[1] $service_user                                        = $redis::service_user,
   Integer[0] $set_max_intset_entries                             = $redis::set_max_intset_entries,
   Integer[0] $slave_priority                                     = $redis::slave_priority,
   Boolean $slave_read_only                                       = $redis::slave_read_only,
   Boolean $slave_serve_stale_data                                = $redis::slave_serve_stale_data,
   Optional[String[1]] $slaveof                                   = $redis::slaveof,
   Integer[0] $slowlog_log_slower_than                            = $redis::slowlog_log_slower_than,
   Integer[0] $slowlog_max_len                                    = $redis::slowlog_max_len,
   Boolean $stop_writes_on_bgsave_error                           = $redis::stop_writes_on_bgsave_error,
   Boolean $syslog_enabled                                        = $redis::syslog_enabled,
   Optional[String[1]] $syslog_facility                           = $redis::syslog_facility,
   Integer[0] $tcp_backlog                                        = $redis::tcp_backlog,
   Integer[0] $tcp_keepalive                                      = $redis::tcp_keepalive,
   Integer[0] $timeout                                            = $redis::timeout,
   Variant[Stdlib::Filemode , Enum['']] $unixsocketperm           = $redis::unixsocketperm,
   Integer[0] $ulimit                                             = $redis::ulimit,
   Stdlib::Filemode $workdir_mode                                 = $redis::workdir_mode,
   Integer[0] $zset_max_ziplist_entries                           = $redis::zset_max_ziplist_entries,
   Integer[0] $zset_max_ziplist_value                             = $redis::zset_max_ziplist_value,
   Boolean $cluster_enabled                                       = $redis::cluster_enabled,
   String[1] $cluster_config_file                                 = $redis::cluster_config_file,
   Integer[1] $cluster_node_timeout                               = $redis::cluster_node_timeout,
   Integer[0] $cluster_slave_validity_factor                      = $redis::cluster_slave_validity_factor,
   Boolean $cluster_require_full_coverage                         = $redis::cluster_require_full_coverage,
   Integer[0] $cluster_migration_barrier                          = $redis::cluster_migration_barrier,
   String[1] $service_name                                        = "redis-server-${name}",
   Stdlib::Ensure::Service $service_ensure                        = $redis::service_ensure,
   Boolean $service_enable                                        = $redis::service_enable,
   String[1] $service_group                                       = $redis::service_group,
   Boolean $service_hasrestart                                    = $redis::service_hasrestart,
   Boolean $service_hasstatus                                     = $redis::service_hasstatus,
   Boolean $manage_service_file                                   = true,
   Optional[Stdlib::Absolutepath] $log_file                       = undef,
   Stdlib::Absolutepath $pid_file                                 = "/var/run/redis/redis-server-${name}.pid",
   Variant[Stdlib::Absolutepath, Enum['']] $unixsocket            = "/var/run/redis/redis-server-${name}.sock",
   Stdlib::Absolutepath $workdir                                  = "${redis::workdir}/redis-server-${name}",
 ) {
   if $title == 'default' {
     $redis_file_name_orig = $config_file_orig
     $redis_file_name      = $config_file
   } else {
     $redis_file_name_orig = sprintf('%s/%s.%s', dirname($config_file_orig), $service_name, 'conf.puppet')
     $redis_file_name      = sprintf('%s/%s.%s', dirname($config_file), $service_name, 'conf')
   }
 
   if $log_dir != $redis::log_dir {
     file { $log_dir:
       ensure => directory,
       group  => $service_group,
       mode   => $log_dir_mode,
       owner  => $service_user,
     }
   }
 
   $_real_log_file = $log_file ? {
     undef   => "${log_dir}/redis-server-${name}.log",
     default => $log_file,
   }
 
   if $workdir != $redis::workdir {
     file { $workdir:
       ensure => directory,
       group  => $service_group,
       mode   => $workdir_mode,
       owner  => $service_user,
     }
   }
 
   if $manage_service_file {
     $service_provider_lookup = pick(getvar('service_provider'), false)
 
     if $service_provider_lookup == 'systemd' {
       file { "/etc/systemd/system/${service_name}.service":
         ensure  => file,
         owner   => 'root',
         group   => 'root',
         mode    => '0644',
         content => template('redis/service_templates/redis.service.erb'),
       }
 
       # Only necessary for Puppet < 6.1.0,
       # See https://github.com/puppetlabs/puppet/commit/f8d5c60ddb130c6429ff12736bfdb4ae669a9fd4
       if versioncmp($facts['puppetversion'],'6.1.0') < 0 {
         include systemd::systemctl::daemon_reload
         File["/etc/systemd/system/${service_name}.service"] ~> Class['systemd::systemctl::daemon_reload']
       }
 
       if $title != 'default' {
         service { $service_name:
           ensure     => $service_ensure,
           enable     => $service_enable,
           hasrestart => $service_hasrestart,
           hasstatus  => $service_hasstatus,
           subscribe  => [
             File["/etc/systemd/system/${service_name}.service"],
             Exec["cp -p ${redis_file_name_orig} ${redis_file_name}"],
           ],
         }
       }
     } else {
       file { "/etc/init.d/${service_name}":
         ensure  => file,
         mode    => '0755',
         content => template("redis/service_templates/redis.${facts['os']['family']}.erb"),
       }
 
       if $title != 'default' {
         service { $service_name:
           ensure     => $service_ensure,
           enable     => $service_enable,
           hasrestart => $service_hasrestart,
           hasstatus  => $service_hasstatus,
           subscribe  => [
             File["/etc/init.d/${service_name}"],
             Exec["cp -p ${redis_file_name_orig} ${redis_file_name}"],
           ],
         }
       }
     }
   }
 
   File {
     owner  => $config_owner,
     group  => $config_group,
     mode   => $config_file_mode,
   }
 
   file { $redis_file_name_orig:
     ensure  => file,
   }
 
   exec { "cp -p ${redis_file_name_orig} ${redis_file_name}":
     path        => '/usr/bin:/bin',
     subscribe   => File[$redis_file_name_orig],
     refreshonly => true,
   }
 
   $bind_arr = [$bind].flatten
 
-  if $package_ensure =~ /^([0-9]+:)?[0-9]+\.[0-9]/ {
-    if ':' in $package_ensure {
-      $_redis_version_real = split($package_ensure, ':')
-      $redis_version_real = $_redis_version_real[1]
-    } else {
-      $redis_version_real = $package_ensure
-    }
-  } else {
-    $redis_version_real = pick(getvar('redis_server_version'), $minimum_version)
-  }
-
-  $supports_protected_mode = !$redis_version_real or versioncmp($redis_version_real, '3.2.0') >= 0
+  $supports_protected_mode = $redis::supports_protected_mode
 
   File[$redis_file_name_orig] { content => template($conf_template) }
 }
diff --git a/manifests/sentinel.pp b/manifests/sentinel.pp
index fb3e3ef..ad5b169 100644
--- a/manifests/sentinel.pp
+++ b/manifests/sentinel.pp
@@ -1,193 +1,194 @@
 # @summary Install redis-sentinel
 #
 # @param auth_pass
 #   The password to use to authenticate with the master and slaves.
 #
 # @param config_file
 #   The location and name of the sentinel config file.
 #
 # @param config_file_orig
 #   The location and name of a config file that provides the source
 #   of the sentinel config file. Two different files are needed
 #   because sentinel itself writes to its own config file and we do
 #   not want override that when puppet is run unless there are
 #   changes from the manifests.
 #
 # @param config_file_mode
 #   Permissions of config file.
 #
 # @param conf_template
 #   Define which template to use.
 #
 # @param daemonize
 #   Have Redis sentinel run as a daemon.
 #
 # @param down_after
 #   Number of milliseconds the master (or any attached slave or sentinel)
 #   should be unreachable (as in, not acceptable reply to PING, continuously,
 #   for the specified period) in order to consider it in S_DOWN state.
 #
 # @param failover_timeout
 #   Specify the failover timeout in milliseconds.
 #
 # @param init_script
 #   Specifiy the init script that will be created for sentinel.
 #
 # @param log_file
 #   Specify where to write log entries.
 #
 # @param log_level
 #   Specify how much we should log.
 #
 # @param master_name
 #   Specify the name of the master redis server.
 #   The valid charset is A-z 0-9 and the three characters ".-_".
 #
 # @param redis_host
 #   Specify the bound host of the master redis server.
 #
 # @param redis_port
 #   Specify the port of the master redis server.
 #
 # @param protected_mode
 #   Whether protected mode is enabled or not. Only applicable when no bind is set.
 #
 # @param package_name
 #   The name of the package that installs sentinel.
 #
 # @param package_ensure
 #   Do we ensure this package.
 #
 # @param parallel_sync
 #   How many slaves can be reconfigured at the same time to use a
 #   new master after a failover.
 #
 # @param pid_file
 #   If sentinel is daemonized it will write its pid at this location.
 #
 # @param quorum
 #   Number of sentinels that must agree that a master is down to
 #   signal sdown state.
 #
 # @param sentinel_bind
 #   Allow optional sentinel server ip binding.  Can help overcome
 #   issues arising from protect-mode added Redis 3.2
 #
 # @param sentinel_port
 #   The port of sentinel server.
 #
 # @param service_group
 #   The group of the config file.
 #
 # @param service_name
 #   The name of the service (for puppet to manage).
 #
 # @param service_user
 #   The owner of the config file.
 #
 # @param service_enable
 #   Enable the service at boot time.
 #
 # @param working_dir
 #   The directory into which sentinel will change to avoid mount
 #   conflicts.
 #
 # @param notification_script
 #   Path to the notification script
 #
 # @param client_reconfig_script
 #   Path to the client-reconfig script
 #
 # @example Basic inclusion
 #   include redis::sentinel
 #
 # @example Configuring options
 #   class {'redis::sentinel':
 #     down_after => 80000,
 #     log_file   => '/var/log/redis/sentinel.log',
 #   }
 #
 class redis::sentinel (
   Optional[String[1]] $auth_pass = undef,
   Stdlib::Absolutepath $config_file = $redis::params::sentinel_config_file,
   Stdlib::Absolutepath $config_file_orig = $redis::params::sentinel_config_file_orig,
   Stdlib::Filemode $config_file_mode = '0644',
   String[1] $conf_template = 'redis/redis-sentinel.conf.erb',
   Boolean $daemonize = $redis::params::sentinel_daemonize,
   Boolean $protected_mode = $redis::params::sentinel_protected_mode,
   Integer[1] $down_after = 30000,
   Integer[1] $failover_timeout = 180000,
   Optional[Stdlib::Absolutepath] $init_script = $redis::params::sentinel_init_script,
   String[1] $init_template = 'redis/redis-sentinel.init.erb',
   Redis::LogLevel $log_level = 'notice',
   Stdlib::Absolutepath $log_file = $redis::params::sentinel_log_file,
   String[1] $master_name  = 'mymaster',
   Stdlib::Host $redis_host = '127.0.0.1',
   Stdlib::Port $redis_port = 6379,
   String[1] $package_name = $redis::params::sentinel_package_name,
   String[1] $package_ensure = 'present',
   Integer[0] $parallel_sync = 1,
   Stdlib::Absolutepath $pid_file = $redis::params::sentinel_pid_file,
   Integer[1] $quorum = 2,
   Variant[Undef, Stdlib::IP::Address, Array[Stdlib::IP::Address]] $sentinel_bind = undef,
   Stdlib::Port $sentinel_port = 26379,
   String[1] $service_group = 'redis',
   String[1] $service_name = $redis::params::sentinel_service_name,
   Stdlib::Ensure::Service $service_ensure = 'running',
   Boolean $service_enable = true,
   String[1] $service_user = 'redis',
   Stdlib::Absolutepath $working_dir = $redis::params::sentinel_working_dir,
   Optional[Stdlib::Absolutepath] $notification_script = undef,
   Optional[Stdlib::Absolutepath] $client_reconfig_script = undef,
 ) inherits redis::params {
   require 'redis'
 
   if $facts['os']['family'] == 'Debian' {
     package { $package_name:
       ensure => $package_ensure,
       before => File[$config_file_orig],
     }
 
     if $init_script {
       Package[$package_name] -> File[$init_script]
     }
   }
 
   $sentinel_bind_arr = delete_undef_values([$sentinel_bind].flatten)
+  $supports_protected_mode = $redis::supports_protected_mode
 
   file { $config_file_orig:
     ensure  => file,
     owner   => $service_user,
     group   => $service_group,
     mode    => $config_file_mode,
     content => template($conf_template),
   }
 
   exec { "cp -p ${config_file_orig} ${config_file}":
     path        => '/usr/bin:/bin',
     subscribe   => File[$config_file_orig],
     notify      => Service[$service_name],
     refreshonly => true,
   }
 
   if $init_script {
     file { $init_script:
       ensure  => file,
       owner   => 'root',
       group   => 'root',
       mode    => '0755',
       content => template($init_template),
     }
 
     exec { '/usr/sbin/update-rc.d redis-sentinel defaults':
       subscribe   => File[$init_script],
       refreshonly => true,
       notify      => Service[$service_name],
     }
   }
 
   service { $service_name:
     ensure => $service_ensure,
     enable => $service_enable,
   }
 }
diff --git a/spec/classes/redis_sentinel_spec.rb b/spec/classes/redis_sentinel_spec.rb
index 21935ec..9d277c8 100644
--- a/spec/classes/redis_sentinel_spec.rb
+++ b/spec/classes/redis_sentinel_spec.rb
@@ -1,159 +1,161 @@
 require 'spec_helper'
 
 describe 'redis::sentinel' do
   on_supported_os.each do |os, facts|
     context "on #{os}" do
       let(:facts) { facts }
       let(:config_file_orig) do
         case facts[:osfamily]
         when 'Archlinux'
           '/etc/redis/redis-sentinel.conf.puppet'
         when 'Debian'
           '/etc/redis/redis-sentinel.conf.puppet'
         when 'Suse'
           '/etc/redis/redis-sentinel.conf.puppet'
         when 'FreeBSD'
           '/usr/local/etc/redis-sentinel.conf.puppet'
         when 'RedHat'
           '/etc/redis-sentinel.conf.puppet'
         end
       end
 
       let(:pidfile) do
         if facts[:operatingsystem] == 'Ubuntu'
           facts[:operatingsystemmajrelease] == '16.04' ? '/var/run/redis/redis-sentinel.pid' : '/var/run/sentinel/redis-sentinel.pid'
         elsif facts[:operatingsystem] == 'Debian'
           facts[:operatingsystemmajrelease] == '9' ? '/var/run/redis/redis-sentinel.pid' : '/run/sentinel/redis-sentinel.pid'
         else
           '/var/run/redis/redis-sentinel.pid'
         end
       end
 
+      let(:protected_mode) do
+        facts[:operatingsystem] != 'Ubuntu' || facts[:operatingsystemmajrelease] != '16.04'
+      end
+
       describe 'without parameters' do
         let(:expected_content) do
           <<CONFIG
 port 26379
 dir #{facts[:osfamily] == 'Debian' ? '/var/lib/redis' : '/tmp'}
 daemonize #{facts[:osfamily] == 'RedHat' ? 'no' : 'yes'}
 pidfile #{pidfile}
-protected-mode yes
-
+#{protected_mode ? "protected-mode yes\n" : ''}
 sentinel monitor mymaster 127.0.0.1 6379 2
 sentinel down-after-milliseconds mymaster 30000
 sentinel parallel-syncs mymaster 1
 sentinel failover-timeout mymaster 180000
 
 loglevel notice
 logfile #{facts[:osfamily] == 'Debian' ? '/var/log/redis/redis-sentinel.log' : '/var/log/redis/sentinel.log'}
 CONFIG
         end
 
         it { is_expected.to create_class('redis::sentinel') }
 
         it {
           is_expected.to contain_file(config_file_orig).
             with_ensure('file').
             with_mode('0644').
             with_owner('redis').
             with_content(expected_content)
         }
 
         it {
           is_expected.to contain_service('redis-sentinel').
             with_ensure('running').
             with_enable('true')
         }
 
         if facts[:os]['family'] == 'Debian'
           it { is_expected.to contain_package('redis-sentinel').with_ensure('present') }
         else
           it { is_expected.not_to contain_package('redis-sentinel') }
         end
       end
 
       describe 'with custom parameters' do
         let(:params) do
           {
             auth_pass: 'password',
             sentinel_bind: '192.0.2.10',
             protected_mode: false,
             master_name: 'cow',
             down_after: 6000,
             working_dir: '/tmp/redis',
             log_file: '/tmp/barn-sentinel.log',
             failover_timeout: 28_000,
             notification_script: '/path/to/bar.sh',
             client_reconfig_script: '/path/to/foo.sh'
           }
         end
 
         let(:expected_content) do
           <<CONFIG
 bind 192.0.2.10
 port 26379
 dir /tmp/redis
 daemonize #{facts[:osfamily] == 'RedHat' ? 'no' : 'yes'}
 pidfile #{pidfile}
-protected-mode no
-
+#{protected_mode ? "protected-mode no\n" : ''}
 sentinel monitor cow 127.0.0.1 6379 2
 sentinel down-after-milliseconds cow 6000
 sentinel parallel-syncs cow 1
 sentinel failover-timeout cow 28000
 sentinel auth-pass cow password
 sentinel notification-script cow /path/to/bar.sh
 sentinel client-reconfig-script cow /path/to/foo.sh
 
 loglevel notice
 logfile /tmp/barn-sentinel.log
 CONFIG
         end
 
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to create_class('redis::sentinel') }
         it { is_expected.to contain_file(config_file_orig).with_content(expected_content) }
       end
 
       describe 'with array sentinel bind' do
         let(:params) do
           {
             auth_pass: 'password',
             sentinel_bind: ['192.0.2.10', '192.168.1.1'],
             master_name: 'cow',
             down_after: 6000,
             working_dir: '/tmp/redis',
             log_file: '/tmp/barn-sentinel.log',
             failover_timeout: 28_000,
             notification_script: '/path/to/bar.sh',
             client_reconfig_script: '/path/to/foo.sh'
           }
         end
 
         let(:expected_content) do
           <<CONFIG
 bind 192.0.2.10 192.168.1.1
 port 26379
 dir /tmp/redis
 daemonize #{facts[:osfamily] == 'RedHat' ? 'no' : 'yes'}
 pidfile #{pidfile}
-
+#{protected_mode ? "protected-mode yes\n" : ''}
 sentinel monitor cow 127.0.0.1 6379 2
 sentinel down-after-milliseconds cow 6000
 sentinel parallel-syncs cow 1
 sentinel failover-timeout cow 28000
 sentinel auth-pass cow password
 sentinel notification-script cow /path/to/bar.sh
 sentinel client-reconfig-script cow /path/to/foo.sh
 
 loglevel notice
 logfile /tmp/barn-sentinel.log
 CONFIG
         end
 
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to create_class('redis::sentinel') }
         it { is_expected.to contain_file(config_file_orig).with_content(expected_content) }
       end
     end
   end
 end
diff --git a/templates/redis-sentinel.conf.erb b/templates/redis-sentinel.conf.erb
index 38bb322..632fa30 100644
--- a/templates/redis-sentinel.conf.erb
+++ b/templates/redis-sentinel.conf.erb
@@ -1,25 +1,27 @@
 <% unless @sentinel_bind_arr.empty? -%>
 bind <%= @sentinel_bind_arr.join(' ') %>
 <% end -%>
 port <%= @sentinel_port %>
 dir <%= @working_dir %>
 daemonize <%= @daemonize ? 'yes' : 'no' %>
 pidfile <%= @pid_file %>
+<% if @supports_protected_mode -%>
 protected-mode <%= @protected_mode ? 'yes' : 'no' %>
+<% end -%>
 
 sentinel monitor <%= @master_name %> <%= @redis_host %> <%= @redis_port %> <%= @quorum %>
 sentinel down-after-milliseconds <%= @master_name %> <%= @down_after %>
 sentinel parallel-syncs <%= @master_name %> <%= @parallel_sync %>
 sentinel failover-timeout <%= @master_name %> <%= @failover_timeout %>
 <% if @auth_pass -%>
 sentinel auth-pass <%= @master_name %> <%= @auth_pass %>
 <% end -%>
 <% if @notification_script -%>
 sentinel notification-script <%= @master_name %> <%= @notification_script %>
 <% end -%>
 <% if @client_reconfig_script -%>
 sentinel client-reconfig-script <%= @master_name %> <%= @client_reconfig_script %>
 <% end -%>
 
 loglevel <%= @log_level %>
 logfile <%= @log_file %>