anchor.diff:  Configure `pam_cracklib.so` and `pam_tally.so`.
   
   ==== 20_cron
  +CCE-27323-5, CCE-80345-2
  +
   Allow `root` to use `cron`. Mask `atd`.
   
   ==== 21_ctraltdel
  +CCE-27511-5
  +
   Disable Ctrl-alt-delete.
   
   ==== 22_auditd
  +CCE-27407-6
  +
   Configure `auditd`, use `$AUDITD_RULES`.
   
   ==== 23_disablemod
  +CCE-27327-6, CCE-27277-3
  +
   Disable `bluetooth` `firewire-core` `n_hdlc` `net-pf-31` `soundcore`
   `thunderbolt` `usb-midi` `usb-storage` kernel modules.
   
   ==== 24_aide
  +CCE-27096-7
  +
   Configure `aide`.
   
   ==== 25_rhosts
  +CCE-27406-8
  +
   Remove `hosts.equiv` and `.rhosts`.
   
   ==== 26_users
  
positive.code: `/usr/bin/pkexec` `/usr/bin/traceroute6.iputils` `/usr/bin/wall` `/usr/sbin/pppd`.
  
  ==== 28_umask
  Set `bash` and `/etc/profile` umask.
  
  ==== 29_apparmor
  
negative.code: Configure `/tmp/` and `/var/tmp/`. Remove floppy drivers from `/etc/fstab` and add `hidepid=2` to `/proc`.
  
  ==== 09_prelink
  CCE-27078-5
  
  Undo prelinking, and remove `prelink` package.
  
  === 10_aptget
  CCE-26895-3
  
  `apt-get` update and upgrade.
  
  ==== 11_hosts
  V-72315
  
  `/etc/hosts.allow` and `/etc/hosts.deny` restrictions.
  
  ==== 12_logindefs
  CCE-80205-8
  
  Modify `/etc/login.defs`, e.g. `UMASK`, password age limits and `SHA_CRYPT_MAX_ROUNDS`.
  
  ==== 13_sysctl
  Update `$SYSCTL` with `$SYSCTL_CONF`.
  
  ==== 14_limits
  CCE-80169-6, V-72049
  
  Set hard and soft limits.
  
  ==== 15_adduser
  