anchor.diff:  <8> Add something just to verify that you actually glanced the code.
   
   === Function list
  -`pre` Script setup +
  -`firewall` Enable ufw and allow port 22 from `$FW_ADMIN` +
  -`disablenet` Disable misc network protocols +
  -`disablemnt` Disable misc file systems +
  -`disablemod` Disable misc kernel modules +
  -`resolvedconf` Systemd/resolved.conf +
  -`systemdconf` Systemd/system.conf and Systemd/user.conf +
  -`journalctl` Systemd/journald.conf and logrotate.conf +
  -`timesyncd` Systemd/timesyncd.conf +
  -`coredump` Systemd/coredump.conf +
  -`fstab` /etc/fstab, system/tmp.mount and system/var-tmp.mount +
  -`prelink` Prelink +
  -`aptget` Updating the package index and upgrading installed packages +
  -`hosts` /etc/hosts.allow and /etc/hosts.deny +
  -`issue` Add message to /etc/issue, /etc/issue.net, /etc/motd +
  -`logindefs` /etc/login.defs +
  -`logindconf` Systemd/logind.conf +
  -`sysctl` /etc/sysctl.conf +
  -`limitsconf` /etc/security/limits.conf +
  -`adduser` /etc/adduser.conf and /etc/default/useradd +
  -`rootaccess` /etc/security/access.conf and /etc/securetty +
  -`packages` Installing base packages +
  -`apport` Disable apport +
  -`rkhunter` Configures rkhunter +
  -`sshdconfig` /etc/ssh/sshd_config +
  -`password` /etc/pam.d/common-password and /etc/pam.d/common-auth +
  -`cron` /etc/cron and /etc/at +
  -`ctrlaltdel` Ctrl-alt-delete +
  -`auditd` Auditd +
  -`aide` Aide +
  -`rhosts` .rhosts +
  -`users` Remove users +
  -`lockroot` Lock root user account +
  -`aptget_clean` Remove unused packages +
  -`suid` Remove suid bits +
  -`umask` Set umask +
  -`path` Modify paths +
  -`aa_enforce` Enforce apparmor profiles +
  -`aide_post` Create Aide db +
  -`aide_timer` Enable daily Aide check +
  -`systemddelta` systemd-delta +
  -`checkreboot` Check if reboot is required
  +
  +==== 01_pre
  +Setup script, sets APT flags and permission checks.
  +
  +==== 02_firewall
  +Enable `ufw`, use `/etc/sysctl.conf`, and allow port 22 from `$FW_ADMIN`.
  +
  +==== 03_disablenet
  +Disable `dccp` `sctp` `rds` `tipc` protocols.
  +
  +==== 04_disablemnt
  +Disable `cramfs` `freevxfs` `jffs2` `hfs` `hfsplus` `squashfs` `udf` `vfat` file systems.
  +
  +==== 05_systemdconf
  +Disable coredumps and crashshells, set `DefaultLimitNOFILE` and `DefaultLimitNPROC` to 100.
  +
  +==== 06_journalctl
  +Compress logs, forward to syslog and make log storage persistent.
  +
  +==== 07_timesyncd
  +Add four NTP-servers with a latency < 50ms from `$NTPSERVERPOOL`.
  +
  +==== 08_fstab
  +Configure `/tmp/` and `/var/tmp/`. Remove floppy drivers from `/etc/fstab` and add `hidepid=2` to `/proc`.
  +
  +==== 09_prelink
  +Undo prelinking, and remove `prelink` package.
  +
  +=== 10_aptget
  +`apt-get` update and upgrade.
  +
  +==== 11_hosts
  +`/etc/hosts.allow` and `/etc/hosts.deny` restrictions.
  +
  +==== 12_logindefs
  +Modify `/etc/login.defs`, e.g. `UMASK`, password age limits and `SHA_CRYPT_MAX_ROUNDS`.
  +
  +==== 13_sysctl
  +Update `$SYSCTL` with `$SYSCTL_CONF`.
  +
  +==== 14_limits
  +Set hard and soft limits.
  +
  +==== 15_adduser
  +Set `/bin/false` as default shell when adding users.
  +
  +==== 16_rootaccess
  +Limit `/etc/securetty` to `console`, and `root` from 127.0.0.1 in `/etc/security/access.conf`
  +
  +==== 17_packages
  +Installs `acct` `aide-common` `apparmor-profiles` `apparmor-utils` `auditd` `debsums`
  +`haveged` `libpam-cracklib` `libpam-tmpdir` `openssh-server` `postfix` `rkhunter`.
  +
  +==== 18_sshdconfig
  +Configure the `SSH`-daemon.
  +
  +==== 19_password
  +Configure `pam_cracklib.so` and `pam_tally.so`.
  +
  +==== 20_cron
  +Allow `root` to use `cron`. Mask `atd`.
  +
  +==== 21_ctraltdel
  +Disable Ctrl-alt-delete.
  +
  +==== 22_auditd
  +Configure `auditd`, use `$AUDITD_RULES`.
  +
  +==== 23_disablemod
  +Disable `bluetooth` `firewire-core` `n_hdlc` `net-pf-31` `soundcore`
  +`thunderbolt` `usb-midi` `usb-storage` kernel modules.
  +
  +==== 24_aide
  +Configure `aide`.
  +
  +==== 25_rhosts
  +Remove `hosts.equiv` and `.rhosts`.
  +
  +==== 26_users
  +Remove `games` `gnats` `irc` `list` `news` `uucp` users.
  +
  +==== 27_suid
  +Remove `suid` bits from `/bin/fusermount` `/bin/mount` `/bin/ping` `/bin/ping6`
  +`/bin/su` `/bin/umount` `/usr/bin/bsd-write` `/usr/bin/chage` `/usr/bin/chfn`
  +`/usr/bin/chsh` `/usr/bin/mlocate` `/usr/bin/mtr` `/usr/bin/newgrp`
  +`/usr/bin/pkexec` `/usr/bin/traceroute6.iputils` `/usr/bin/wall` `/usr/sbin/pppd`.
  +
  +==== 28_umask
  +Set `bash` and `/etc/profile` umask.
  +
  +==== 29_apparmor
  +Enforce present `apparmor` profiles.
  +
  +==== 30_path
  +Set `root` path to `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
  +and user path to `/usr/local/bin:/usr/bin:/bin`.
  +
  +==== 31_logindconf
  +Configure `systemd/logind.conf` and use `KillUserProcesses`.
  +
  +==== 32_resolvedconf
  +Configure `systemd/resolved.conf`.
  +
  +==== 33_rkhunter
  +Configure `rkhunter`.
  +
  +==== 34_issue
  +Update `/etc/issue` `/etc/issue.net` `/etc/motd`.
  +
  +==== 35_apport
  +Mask `apport.service` and disable `apport`.
  +
  +==== 36_lockroot
  +Lock the `root` user account.
  +
  +==== 37_coredump
  +Disable coredumps with `systemd/coredump.conf`.
  +
  +==== 38_postfix
  +Disable the `VRFY` command.
  +
  +==== 39_motdnews
  +Disable `motd-news`.
  +
  +==== 98_systemddelta
  +If verbose, show `systemd-delta`.
  +
  +==== 99_reboot
  +Print if a reboot is required.
  +
  +=== Function execution order
  +[source,shell]
  +----
  +f_pre
  +f_firewall
  +f_disablenet
  +f_disablemnt
  +f_disablemod
  +f_systemdconf
  +f_resolvedconf
  +f_logindconf
  +f_journalctl
  +f_timesyncd
  +f_coredump
  +f_fstab
  +f_prelink
  +f_aptget
  +f_hosts
  +f_issue
  +f_logindefs
  +f_sysctl
  +f_limitsconf
  +f_adduser
  +f_rootaccess
  +f_packages
  +f_postfix
  +f_apport
  +f_motdnews
  +f_rkhunter
  +f_sshdconfig
  +f_password
  +f_cron
  +f_ctrlaltdel
  +f_auditd
  +f_aide
  +f_rhosts
  +f_users
  +f_lockroot
  +f_aptget_clean
  +f_suid
  +f_umask
  +f_path
  +f_aa_enforce
  +f_aide_post
  +f_aide_timer
  +f_systemddelta
  +f_checkreboot
  +----
   
   == Tests
   There are approximately 275 https://github.com/sstephenson/bats[Bats tests] for most of the above settings available in the link:tests/[tests directory].
  
positive.code: 
  A quick way to make a Ubuntu server a bit more secure.
  
  Tested on `15.10 Ubuntu Wily Werewolf`, `16.04 Xenial Xerus`, `16.10 Yakkety Yak` and `17.04 Zesty Zapus (development branch)`. +
  Systemd required.
  
  If you're just interested in the security focused systemd configuration, it's available as a link:systemd.adoc[separate document]. +
  If you're interested in testing your host settings, you'll find the link:README.adoc#tests[instructions here]. +
  If you're using Ansible, a playbook with most of the above functions implemented is available in my Ansible repository https://github.com/konstruktoid/ansible-role-hardening[konstruktoid/ansible-role-hardening].
  
  NOTE: This is a constant work in progress. Make sure you understand what it does. Read the code.
  
  == Howto
  Start the installation of the server. +
  
negative.code: ----
  FW_ADMIN='127.0.0.1' // <1>
  SSH_GRPS='sudo' // <2>
  SYSCTL_CONF='./misc/sysctl.conf' // <3>
  AUDITD_RULES='./misc/audit.rules' // <4>
  LOGROTATE_CONF='./misc/logrotate.conf' // <5>
  NTPSERVERPOOL='0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org pool.ntp.org' // <6>
  VERBOSE='N' // <7>
  CHANGEME='' // <8>
  