anchor.diff:  Note that disabling the `usb-storage` will disable any usage of USB storage
   devices, if such devices are needed `USBGuard` should be configured accordingly.
   
  -==== aide
  -Configure `aide`.
  -
  -==== rhosts
  +==== `aide`
  +Configure https://aide.github.io/[aide].
  +
  +==== `rhosts`
   Remove `hosts.equiv` and `.rhosts`.
   
  -==== users
  +==== `users`
   Remove `games` `gnats` `irc` `list` `news` `sync` `uucp` users.
   
  -==== suid
  +==== `suid`
   Remove `suid` bits from the executables listed in
   link:misc/suid.list[this document].
   
  -==== umask
  +==== `umask`
   Set `bash` and `/etc/profile` umask.
   
  -==== apparmor
  +==== `apparmor`
   Enforce present `apparmor` profiles.
   
  -==== path
  +==== `path`
   Set `root` path to `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
   and user path to `/usr/local/bin:/usr/bin:/bin`.
   
  -==== logindconf
  +==== `logindconf`
   Configure `systemd/logind.conf` and use `KillUserProcesses`.
   
  -==== resolvedconf
  +==== `resolvedconf`
   Configure `systemd/resolved.conf`.
   
  -==== rkhunter
  -Configure `rkhunter`.
  -
  -==== issue
  +==== `rkhunter`
  +Configure https://sourceforge.net/projects/rkhunter/[rkhunter].
  +
  +==== `issue`
   Update `/etc/issue` `/etc/issue.net` `/etc/motd`.
   
  -==== apport
  +==== `apport`
   Disable `apport`, `ubuntu-report` and `popularity-contest`.
   
  -==== lockroot
  +==== `lockroot`
   Lock the `root` user account.
   
  -==== coredump
  +==== `coredump`
   Disable coredumps with `systemd/coredump.conf`.
   
  -==== postfix
  -Disable the `VRFY` command, configure `smtpd_banner`, `smtpd_client_restrictions`
  -and `inet_interfaces`.
  -
  -==== motdnews
  +==== `postfix`
  +Configure https://www.postfix.org[postfix]. Disable the `VRFY` command,
  +configure `smtpd_banner`, `smtpd_client_restrictions` and `inet_interfaces`.
  +
  +==== `motdnews`
   Disable `motd-news`.
   
  -==== usbguard
  -Install and configure `usbguard`.
  -
  -==== compilers
  +==== `usbguard`
  +Install and configure https://usbguard.github.io/[usbguard].
  +
  +==== `compilers`
   Restrict compiler access.
   
  -==== kernel
  +==== `kernel`
   Set `lockdown=confidentiality` if `/sys/kernel/security/lockdown` is present.
   
  -==== sudo
  +==== `sudo`
   Configure `sudo` with `use_pty`, `logfile`, `!visiblepw`, `!pwfeedback`,
   `passwd_timeout` and `timestamp_timeout`.
   
   Restrict `su` to the `sudo` group.
   
  -==== psad
  -Configure `psad`.
  -
  -==== systemddelta
  +==== `psad`
  +Configure https://www.cipherdyne.org/psad/[psad].
  +
  +==== `systemddelta`
   If verbose, show `systemd-delta`.
   
  -==== post
  +==== `post`
   Ensure `secureboot-db` is installed, update grub and ensure strict permissions
   on boot files.
   
  -==== reboot
  +==== `reboot`
   Print if a reboot is required.
   
   === Function execution order
  
positive.code: `popularity-contest` `rsh*` `rsync` `talk*` `telnet*` `tftp*` `whoopsie`
  `xinetd` `yp-tools` `ypbind`.
  
  ==== sshdconfig
  Configure the `OpenSSH` daemon. The configuration changes will be placed in
  the directory defined by the `Include` option if present, otherwise the default
  `sshd_config` will be modified.
  
  ==== password
  Configure `pam_pwquality.so` and `pam_tally2.so`.
  
  ==== cron
  Allow `root` to use `cron`. Mask `atd`.
  
  ==== ctraltdel
  Disable Ctrl-alt-delete.
  
  ==== auditd
  Configure `auditd`, use `$AUDITD_RULES` and set failure mode `$AUDITD_MODE`.
  
  ==== disablemod
  Disable `bluetooth` `bnep` `btusb` `cpia2` `firewire-core` `floppy` `n_hdlc`
  `net-pf-31` `pcspkr` `soundcore` `thunderbolt` `usb-midi` `usb-storage`
  `uvcvideo` `v4l2_common` kernel modules.
  
negative.code: 
  === Function list
  
  ==== `pre`
  Setup script, sets APT flags and permission checks.
  
  ==== `firewall`
  Enable `ufw`, use `/etc/sysctl.conf`, prepare to `psad`, and allow port 22 from `$FW_ADMIN`.
  
  ==== `disablenet`
  Disable `dccp` `sctp` `rds` `tipc` protocols.
  
  ==== `disablemnt`
  Disable `cramfs` `freevxfs` `jffs2` `hfs` `hfsplus` `udf` file systems.
  
  ==== `systemdconf`
  Disable coredumps and crash shells, set `DefaultLimitNOFILE` and
  `DefaultLimitNPROC` to 1024.
  
  ==== `journalctl`
  Compress logs, forward to syslog and make log storage persistent. Ensure rsyslog
  writes logs with stricter permissions.
  
  ==== `timesyncd`
  Add four NTP-servers with a latency < 50ms from `$NTPSERVERPOOL`.
  
  ==== `fstab`
  Configure `/tmp/` and `/var/tmp/`. Remove floppy drivers from `/etc/fstab`
  and add `hidepid=2` to `/proc`.
  
  ==== `prelink`
  Undo prelinking, and remove `prelink` package.
  
  ==== `aptget`
  Configure `dpkg` and `apt-get`. `apt-get` update and upgrade.
  
  ==== `hosts`
  `/etc/hosts.allow` and `/etc/hosts.deny` restrictions.
  
  ==== `logindefs`
  Modify `/etc/login.defs`, e.g. `UMASK`, password age limits and
  `SHA_CRYPT_MAX_ROUNDS`.
  
  ==== `sysctl`
  Update `$SYSCTL` with `$SYSCTL_CONF`.
  
  ==== `limits`
  Set hard and soft limits.
  
  ==== `adduser`
  Configure `useradd` and `adduser` to set `/bin/false` as default shell,
  home directory permissions to `0750` and lock users 30 days after password
  expires.
  
  ==== `rootaccess`
  Limit `/etc/securetty` to `console`, and `root` from 127.0.0.1 in
  `/etc/security/access.conf`.
  
  ==== `packages`
  Installs `acct` `aide-common` `apparmor-profiles` `apparmor-utils` `auditd`
  `audispd-plugins` `debsums` `gnupg2` `haveged`
  `libpam-apparmor` `libpam-pwquality` `libpam-tmpdir` `needrestart`
  