anchor.diff:  Setup script, sets APT flags and permission checks.
   
   ==== 02_firewall
  +RHEL-07-040520
  +
   Enable `ufw`, use `/etc/sysctl.conf`, and allow port 22 from `$FW_ADMIN`.
   
   ==== 03_disablenet
  +CCE-26828-4, CCE-27106-4
  +
   Disable `dccp` `sctp` `rds` `tipc` protocols.
   
   ==== 04_disablemnt
  +CCE-80137-3, CCE-80138-1, CCE-80139-9, CCE-80140-7, CCE-80141-5, CCE-80142-3, CCE-80143-1
  +
   Disable `cramfs` `freevxfs` `jffs2` `hfs` `hfsplus` `squashfs` `udf` `vfat` file systems.
   
   ==== 05_systemdconf
  
positive.code: Configure `/tmp/` and `/var/tmp/`. Remove floppy drivers from `/etc/fstab` and add `hidepid=2` to `/proc`.
  
  ==== 09_prelink
  Undo prelinking, and remove `prelink` package.
  
  === 10_aptget
  `apt-get` update and upgrade.
  
  ==== 11_hosts
  `/etc/hosts.allow` and `/etc/hosts.deny` restrictions.
  
  ==== 12_logindefs
  Modify `/etc/login.defs`, e.g. `UMASK`, password age limits and `SHA_CRYPT_MAX_ROUNDS`.
  
  ==== 13_sysctl
  Update `$SYSCTL` with `$SYSCTL_CONF`.
  
  ==== 14_limits
  Set hard and soft limits.
  
  ==== 15_adduser
  
negative.code: Configure `pam_cracklib.so` and `pam_tally.so`.
  
  ==== 20_cron
  CCE-27323-5, CCE-80345-2
  
  Allow `root` to use `cron`. Mask `atd`.
  
  ==== 21_ctraltdel
  CCE-27511-5
  
  Disable Ctrl-alt-delete.
  
  ==== 22_auditd
  CCE-27407-6
  
  Configure `auditd`, use `$AUDITD_RULES`.
  
  ==== 23_disablemod
  CCE-27327-6, CCE-27277-3
  
  Disable `bluetooth` `firewire-core` `n_hdlc` `net-pf-31` `soundcore`
  `thunderbolt` `usb-midi` `usb-storage` kernel modules.
  
  ==== 24_aide
  CCE-27096-7
  
  Configure `aide`.
  
  ==== 25_rhosts
  CCE-27406-8
  
  Remove `hosts.equiv` and `.rhosts`.
  
  ==== 26_users
  