anchor.diff:  ----
   FW_ADMIN='127.0.0.1' // <1>
   SSH_GRPS='sudo' // <2>
  -SYSCTL_CONF='https://raw.githubusercontent.com/konstruktoid/hardening/master/misc/sysctl.conf' // <3>
  -AUDITD_RULES='https://raw.githubusercontent.com/konstruktoid/hardening/master/misc/audit.rules' // <4>
  -LOGROTATE_CONF='https://raw.githubusercontent.com/konstruktoid/hardening/master/misc/logrotate.conf' // <5>
  +SYSCTL_CONF='./misc/sysctl.conf' // <3>
  +AUDITD_RULES='./misc/audit.rules' // <4>
  +LOGROTATE_CONF='./misc/logrotate.conf' // <5>
   NTPSERVERPOOL='0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org pool.ntp.org' // <6>
   VERBOSE='N' // <7>
   CHANGEME='' // <8>
  
positive.code: <8> Add something just to verify that you actually glanced the code.
  
  === Function list
  `pre` Script setup +
  `firewall` Enable ufw and allow port 22 from `$FW_ADMIN` +
  `disablenet` Disable misc network protocols +
  `disablemnt` Disable misc file systems +
  `disablemod` Disable misc kernel modules +
  `resolvedconf` Systemd/resolved.conf +
  `systemdconf` Systemd/system.conf and Systemd/user.conf +
  `journalctl` Systemd/journald.conf and logrotate.conf +
  `timesyncd` Systemd/timesyncd.conf +
  `coredump` Systemd/coredump.conf +
  `fstab` /etc/fstab, system/tmp.mount and system/var-tmp.mount +
  `prelink` Prelink +
  `aptget` Updating the package index and upgrading installed packages +
  `hosts` /etc/hosts.allow and /etc/hosts.deny +
  `issue` Add message to /etc/issue, /etc/issue.net, /etc/motd +
  `logindefs` /etc/login.defs +
  `logindconf` Systemd/logind.conf +
  `sysctl` /etc/sysctl.conf +
  `limitsconf` /etc/security/limits.conf +
  `adduser` /etc/adduser.conf and /etc/default/useradd +
  `rootaccess` /etc/security/access.conf and /etc/securetty +
  `packages` Installing base packages +
  `apport` Disable apport +
  `rkhunter` Configures rkhunter +
  `sshdconfig` /etc/ssh/sshd_config +
  `password` /etc/pam.d/common-password and /etc/pam.d/common-auth +
  `cron` /etc/cron and /etc/at +
  `ctrlaltdel` Ctrl-alt-delete +
  `auditd` Auditd +
  `aide` Aide +
  `rhosts` .rhosts +
  `users` Remove users +
  `lockroot` Lock root user account +
  `aptget_clean` Remove unused packages +
  `suid` Remove suid bits +
  `umask` Set umask +
  `path` Modify paths +
  `aa_enforce` Enforce apparmor profiles +
  `aide_post` Create Aide db +
  `aide_timer` Enable daily Aide check +
  `systemddelta` systemd-delta +
  `checkreboot` Check if reboot is required
  
  == Tests
  There are approximately 275 https://github.com/sstephenson/bats[Bats tests] for most of the above settings available in the link:tests/[tests directory].
  
negative.code: 
  A quick way to make a Ubuntu server a bit more secure.
  
  Tested on `16.04 Xenial Xerus`, `16.10 Yakkety Yak` and `17.04 Zesty Zapus`.
  
  Systemd required.
  
  If you're just interested in the security focused systemd configuration, it's available as a link:systemd.adoc[separate document].
  
  If you're interested in testing your host settings, you'll find the link:README.adoc#tests[instructions here].
  
  If you're using Ansible, a playbook with most of the above functions implemented is available in my Ansible repository https://github.com/konstruktoid/ansible-role-hardening[konstruktoid/ansible-role-hardening].
  
  NOTE: This is a constant work in progress. Make sure you understand what it does. `Read the code`.
  
  == Howto
  Start the installation of the server. +
  