saving uncommitted changes in /etc prior to apt run

.etckeeper

@@ -16,7 +16,6 @@ mkdir -p './clamav/onupdateexecute.d'
 mkdir -p './clamav/virusevent.d'
 mkdir -p './dbus-1/session.d'
 mkdir -p './dbus-1/system.d'
-mkdir -p './dovecot/private'
 mkdir -p './dpkg/dpkg.cfg.d'
 mkdir -p './fail2ban/fail2ban.d'
 mkdir -p './gss/mech.d'
@@ -42,9 +41,6 @@ mkdir -p './network/if-post-down.d'
 mkdir -p './network/if-pre-up.d'
 mkdir -p './nginx/modules-available'
 mkdir -p './opt'
-mkdir -p './php/8.0/cgi/conf.d'
-mkdir -p './php/8.0/cli/conf.d'
-mkdir -p './php/8.0/fpm/conf.d'
 mkdir -p './postfix/dynamicmaps.cf.d'
 mkdir -p './postfix/sasl'
 mkdir -p './qemu/fsfreeze-hook.d'
@@ -52,13 +48,11 @@ mkdir -p './security/limits.d'
 mkdir -p './security/namespace.d'
 mkdir -p './ssh/ssh_config.d'
 mkdir -p './ssh/sshd_config.d'
-mkdir -p './ssl/private'
 mkdir -p './systemd/network'
-mkdir -p './tmpfiles.d'
 mkdir -p './udev/hwdb.d'
 maybe chmod 0755 '.'
 maybe chmod 0700 '.etckeeper'
-maybe chmod 0644 '.gitignore'
+maybe chmod 0600 '.gitignore'
 maybe chmod 0755 'ImageMagick-6'
 maybe chmod 0644 'ImageMagick-6/coder.xml'
 maybe chmod 0644 'ImageMagick-6/colors.xml'
@@ -78,6 +72,7 @@ maybe chmod 0644 'ImageMagick-6/type.xml'
 maybe chmod 0755 'NetworkManager'
 maybe chmod 0755 'NetworkManager/dispatcher.d'
 maybe chmod 0755 'NetworkManager/dispatcher.d/cloud-init-hook-network-manager'
+maybe chmod 0755 'NetworkManager/dispatcher.d/ntp'
 maybe chmod 0755 'X11'
 maybe chmod 0755 'X11/Xsession.d'
 maybe chmod 0644 'X11/Xsession.d/90gpg-agent'
@@ -86,6 +81,7 @@ maybe chmod 0644 'adduser.conf'
 maybe chmod 0755 'aide'
 maybe chmod 0755 'aide/aide.conf.d'
 maybe chmod 0755 'aide/aide.settings.d'
+maybe chmod 0644 'aliases'
 maybe chmod 0755 'alternatives'
 maybe chmod 0644 'alternatives/README'
 maybe chmod 0755 'amavis'
@@ -114,6 +110,8 @@ maybe chmod 0644 'amavis/en_US/template-virus-sender.txt'
 maybe chmod 0755 'apache2'
 maybe chmod 0755 'apache2/conf-available'
 maybe chmod 0644 'apache2/conf-available/javascript-common.conf'
+maybe chmod 0644 'apache2/conf-available/php8.0-cgi.conf'
+maybe chmod 0644 'apache2/conf-available/php8.0-fpm.conf'
 maybe chmod 0755 'apache2/mods-available'
 maybe chmod 0755 'apm'
 maybe chmod 0755 'apm/event.d'
@@ -246,7 +244,10 @@ maybe chmod 0755 'apparmor.d/local'
 maybe chmod 0644 'apparmor.d/local/README'
 maybe chmod 0644 'apparmor.d/local/lsb_release'
 maybe chmod 0644 'apparmor.d/local/nvidia_modprobe'
+maybe chmod 0644 'apparmor.d/local/usr.bin.freshclam'
 maybe chmod 0644 'apparmor.d/local/usr.bin.man'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.clamd'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.ntpd'
 maybe chmod 0644 'apparmor.d/lsb_release'
 maybe chmod 0644 'apparmor.d/nvidia_modprobe'
 maybe chmod 0755 'apparmor.d/tunables'
@@ -262,6 +263,7 @@ maybe chmod 0644 'apparmor.d/tunables/kernelvars'
 maybe chmod 0644 'apparmor.d/tunables/multiarch'
 maybe chmod 0755 'apparmor.d/tunables/multiarch.d'
 maybe chmod 0644 'apparmor.d/tunables/multiarch.d/site.local'
+maybe chmod 0644 'apparmor.d/tunables/ntpd'
 maybe chmod 0644 'apparmor.d/tunables/proc'
 maybe chmod 0644 'apparmor.d/tunables/run'
 maybe chmod 0644 'apparmor.d/tunables/securityfs'
@@ -270,8 +272,11 @@ maybe chmod 0644 'apparmor.d/tunables/sys'
 maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs'
 maybe chmod 0755 'apparmor.d/tunables/xdg-user-dirs.d'
 maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs.d/site.local'
+maybe chmod 0644 'apparmor.d/usr.bin.freshclam'
 maybe chmod 0644 'apparmor.d/usr.bin.man'
+maybe chmod 0644 'apparmor.d/usr.sbin.clamd'
 maybe chmod 0644 'apparmor.d/usr.sbin.mariadbd'
+maybe chmod 0644 'apparmor.d/usr.sbin.ntpd'
 maybe chmod 0755 'apparmor/init'
 maybe chmod 0755 'apparmor/init/network-interface-security'
 maybe chmod 0644 'apparmor/parser.conf'
@@ -284,6 +289,7 @@ maybe chmod 0444 'apt/apt.conf.d/01autoremove-kernels'
 maybe chmod 0644 'apt/apt.conf.d/05etckeeper'
 maybe chmod 0644 'apt/apt.conf.d/20listchanges'
 maybe chmod 0644 'apt/apt.conf.d/70debconf'
+maybe chmod 0644 'apt/apt.conf.d/90rkhunter'
 maybe chmod 0755 'apt/auth.conf.d'
 maybe chmod 0755 'apt/keyrings'
 maybe chmod 0644 'apt/keyrings/rspamd.gpg'
@@ -318,13 +324,16 @@ maybe chmod 0644 'ca-certificates.conf'
 maybe chmod 0755 'ca-certificates/update.d'
 maybe chmod 0755 'calendar'
 maybe chmod 0644 'calendar/default'
+maybe chmod 0644 'chkrootkit.conf'
 maybe chmod 0755 'clamav'
 maybe chmod 0755 'clamav-unofficial-sigs'
 maybe chmod 0644 'clamav-unofficial-sigs/master.conf'
 maybe chmod 0644 'clamav-unofficial-sigs/os.conf'
 maybe chmod 0644 'clamav-unofficial-sigs/user.conf'
 maybe chmod 0644 'clamav/clamd.conf'
-maybe chmod 0644 'clamav/freshclam.conf'
+maybe chown 'clamav' 'clamav/freshclam.conf'
+maybe chgrp 'adm' 'clamav/freshclam.conf'
+maybe chmod 0444 'clamav/freshclam.conf'
 maybe chmod 0755 'clamav/onerrorexecute.d'
 maybe chmod 0755 'clamav/onupdateexecute.d'
 maybe chmod 0755 'clamav/virusevent.d'
@@ -399,16 +408,21 @@ maybe chmod 0644 'console-setup/compose.VISCII.inc'
 maybe chmod 0644 'console-setup/remap.inc'
 maybe chmod 0755 'cron.d'
 maybe chmod 0644 'cron.d/.placeholder'
+maybe chmod 0644 'cron.d/amavisd-new'
 maybe chmod 0644 'cron.d/e2scrub_all'
 maybe chmod 0644 'cron.d/kernel'
 maybe chmod 0644 'cron.d/php'
 maybe chmod 0755 'cron.daily'
 maybe chmod 0644 'cron.daily/.placeholder'
 maybe chmod 0755 'cron.daily/apt-compat'
+maybe chmod 0755 'cron.daily/chkrootkit'
 maybe chmod 0755 'cron.daily/dpkg'
 maybe chmod 0755 'cron.daily/etckeeper'
 maybe chmod 0755 'cron.daily/logrotate'
 maybe chmod 0755 'cron.daily/man-db'
+maybe chmod 0755 'cron.daily/mlocate'
+maybe chmod 0755 'cron.daily/ntp'
+maybe chmod 0755 'cron.daily/rkhunter'
 maybe chmod 0755 'cron.hourly'
 maybe chmod 0644 'cron.hourly/.placeholder'
 maybe chmod 0755 'cron.monthly'
@@ -416,6 +430,7 @@ maybe chmod 0644 'cron.monthly/.placeholder'
 maybe chmod 0755 'cron.weekly'
 maybe chmod 0644 'cron.weekly/.placeholder'
 maybe chmod 0755 'cron.weekly/man-db'
+maybe chmod 0755 'cron.weekly/rkhunter'
 maybe chmod 0644 'crontab'
 maybe chmod 0755 'cruft'
 maybe chmod 0755 'cruft/filters-unex'
@@ -426,9 +441,11 @@ maybe chmod 0755 'dbus-1/system.d'
 maybe chmod 0644 'debconf.conf'
 maybe chmod 0644 'debian_version'
 maybe chmod 0755 'default'
+maybe chmod 0644 'default/amavisd-snmp-subagent'
 maybe chmod 0644 'default/console-setup'
 maybe chmod 0644 'default/cron'
 maybe chmod 0644 'default/dbus'
+maybe chmod 0644 'default/dovecot'
 maybe chmod 0644 'default/fail2ban'
 maybe chmod 0644 'default/grub'
 maybe chmod 0755 'default/grub.d'
@@ -439,7 +456,12 @@ maybe chmod 0644 'default/locale'
 maybe chmod 0644 'default/networking'
 maybe chmod 0644 'default/nginx'
 maybe chmod 0644 'default/nss'
+maybe chmod 0644 'default/ntp'
+maybe chmod 0644 'default/ntpdate'
+maybe chmod 0644 'default/opendkim'
+maybe chmod 0644 'default/postgrey'
 maybe chmod 0644 'default/redis-server'
+maybe chmod 0644 'default/rkhunter'
 maybe chmod 0644 'default/rsync'
 maybe chmod 0644 'default/ssh'
 maybe chmod 0644 'default/useradd'
@@ -449,6 +471,8 @@ maybe chmod 0644 'dhcp/debug'
 maybe chmod 0755 'dhcp/dhclient-enter-hooks.d'
 maybe chmod 0755 'dhcp/dhclient-exit-hooks.d'
 maybe chmod 0755 'dhcp/dhclient-exit-hooks.d/hook-dhclient'
+maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/ntp'
+maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/ntpdate'
 maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes'
 maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/timesyncd'
 maybe chmod 0644 'dhcp/dhclient.conf'
@@ -456,10 +480,14 @@ maybe chmod 0755 'dictionaries-common'
 maybe chmod 0644 'discover-modprobe.conf'
 maybe chmod 0755 'discover.conf.d'
 maybe chmod 0644 'discover.conf.d/00discover'
-maybe chmod 0755 'dkimkeys'
+maybe chown 'opendkim' 'dkimkeys'
+maybe chgrp 'opendkim' 'dkimkeys'
+maybe chmod 0700 'dkimkeys'
 maybe chmod 0644 'dkimkeys/README.PrivateKeys'
 maybe chmod 0755 'dkms'
 maybe chmod 0644 'dkms/framework.conf'
+maybe chmod 0755 'dkms/kernel_install.d_dkms'
+maybe chmod 0755 'dkms/sign_helper.sh'
 maybe chmod 0755 'dkms/template-dkms-mkbmdeb'
 maybe chmod 0644 'dkms/template-dkms-mkbmdeb/Makefile'
 maybe chmod 0755 'dkms/template-dkms-mkbmdeb/debian'
@@ -483,12 +511,41 @@ maybe chmod 0755 'dkms/template-dkms-mkdeb/debian/prerm'
 maybe chmod 0755 'dkms/template-dkms-mkdeb/debian/rules'
 maybe chmod 0755 'dovecot'
 maybe chmod 0755 'dovecot/conf.d'
+maybe chmod 0644 'dovecot/conf.d/10-auth.conf'
+maybe chmod 0644 'dovecot/conf.d/10-director.conf'
+maybe chmod 0644 'dovecot/conf.d/10-logging.conf'
+maybe chmod 0644 'dovecot/conf.d/10-mail.conf'
+maybe chmod 0644 'dovecot/conf.d/10-master.conf'
 maybe chmod 0644 'dovecot/conf.d/10-ssl.conf'
+maybe chmod 0644 'dovecot/conf.d/10-tcpwrapper.conf'
+maybe chmod 0644 'dovecot/conf.d/15-lda.conf'
+maybe chmod 0644 'dovecot/conf.d/15-mailboxes.conf'
 maybe chmod 0644 'dovecot/conf.d/20-imap.conf'
+maybe chmod 0644 'dovecot/conf.d/20-lmtp.conf'
+maybe chmod 0644 'dovecot/conf.d/20-managesieve.conf'
+maybe chmod 0644 'dovecot/conf.d/20-pop3.conf'
+maybe chmod 0644 'dovecot/conf.d/90-acl.conf'
+maybe chmod 0644 'dovecot/conf.d/90-plugin.conf'
+maybe chmod 0644 'dovecot/conf.d/90-quota.conf'
+maybe chmod 0644 'dovecot/conf.d/90-sieve-extprograms.conf'
 maybe chmod 0644 'dovecot/conf.d/90-sieve.conf'
+maybe chmod 0644 'dovecot/conf.d/auth-checkpassword.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-deny.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-dict.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-master.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-passwdfile.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-sql.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-static.conf.ext'
+maybe chmod 0644 'dovecot/conf.d/auth-system.conf.ext'
+maybe chgrp 'dovecot' 'dovecot/dovecot-dict-auth.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-dict-auth.conf.ext'
+maybe chgrp 'dovecot' 'dovecot/dovecot-dict-sql.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-dict-sql.conf.ext'
 maybe chmod 0644 'dovecot/dovecot-mysql.conf'
+maybe chgrp 'dovecot' 'dovecot/dovecot-sql.conf.ext'
+maybe chmod 0640 'dovecot/dovecot-sql.conf.ext'
 maybe chmod 0644 'dovecot/dovecot.conf'
-maybe chmod 0755 'dovecot/private'
+maybe chmod 0700 'dovecot/private'
 maybe chmod 0755 'dovecot/sieve'
 maybe chmod 0755 'dovecot/sieve-after'
 maybe chmod 0644 'dovecot/sieve-after/spam-to-folder.sieve'
@@ -501,6 +558,8 @@ maybe chmod 0644 'dpkg/dpkg.cfg'
 maybe chmod 0755 'dpkg/dpkg.cfg.d'
 maybe chmod 0755 'dpkg/origins'
 maybe chmod 0644 'dpkg/origins/debian'
+maybe chmod 0644 'dpkg/shlibs.default'
+maybe chmod 0644 'dpkg/shlibs.override'
 maybe chmod 0644 'e2scrub.conf'
 maybe chmod 0755 'emacs'
 maybe chmod 0755 'emacs/site-start.d'
@@ -803,7 +862,12 @@ maybe chmod 0644 'hosts'
 maybe chmod 0644 'hosts.allow'
 maybe chmod 0644 'hosts.deny'
 maybe chmod 0755 'init.d'
+maybe chmod 0755 'init.d/amavis'
+maybe chmod 0755 'init.d/amavis-mc'
+maybe chmod 0755 'init.d/amavisd-snmp-subagent'
 maybe chmod 0755 'init.d/apparmor'
+maybe chmod 0755 'init.d/clamav-daemon'
+maybe chmod 0755 'init.d/clamav-freshclam'
 maybe chmod 0755 'init.d/cloud-config'
 maybe chmod 0755 'init.d/cloud-final'
 maybe chmod 0755 'init.d/cloud-init'
@@ -811,6 +875,7 @@ maybe chmod 0755 'init.d/cloud-init-local'
 maybe chmod 0755 'init.d/console-setup.sh'
 maybe chmod 0755 'init.d/cron'
 maybe chmod 0755 'init.d/dbus'
+maybe chmod 0755 'init.d/dovecot'
 maybe chmod 0755 'init.d/fail2ban'
 maybe chmod 0755 'init.d/hwclock.sh'
 maybe chmod 0755 'init.d/keyboard-setup.sh'
@@ -819,11 +884,18 @@ maybe chmod 0755 'init.d/lm-sensors'
 maybe chmod 0755 'init.d/mariadb'
 maybe chmod 0755 'init.d/networking'
 maybe chmod 0755 'init.d/nginx'
+maybe chmod 0755 'init.d/ntp'
+maybe chmod 0755 'init.d/opendkim'
+maybe chmod 0755 'init.d/php8.0-fpm'
+maybe chmod 0755 'init.d/postfix'
+maybe chmod 0755 'init.d/postgrey'
 maybe chmod 0755 'init.d/procps'
 maybe chmod 0755 'init.d/qemu-guest-agent'
 maybe chmod 0755 'init.d/redis-server'
+maybe chmod 0755 'init.d/rspamd'
 maybe chmod 0755 'init.d/rsync'
 maybe chmod 0755 'init.d/rsyslog'
+maybe chmod 0755 'init.d/screen-cleanup'
 maybe chmod 0755 'init.d/ssh'
 maybe chmod 0755 'init.d/sudo'
 maybe chmod 0755 'init.d/udev'
@@ -847,6 +919,7 @@ maybe chmod 0755 'initramfs-tools/scripts/panic'
 maybe chmod 0644 'initramfs-tools/update-initramfs.conf'
 maybe chmod 0644 'inputrc'
 maybe chmod 0755 'insserv.conf.d'
+maybe chmod 0644 'insserv.conf.d/postfix'
 maybe chmod 0755 'iproute2'
 maybe chmod 0644 'iproute2/bpf_pinning'
 maybe chmod 0644 'iproute2/ematch_map'
@@ -866,22 +939,27 @@ maybe chmod 0644 'issue.net'
 maybe chmod 0755 'kernel'
 maybe chmod 0644 'kernel-img.conf'
 maybe chmod 0755 'kernel/header_postinst.d'
+maybe chmod 0755 'kernel/header_postinst.d/dkms'
 maybe chmod 0755 'kernel/install.d'
 maybe chmod 0755 'kernel/postinst.d'
 maybe chmod 0755 'kernel/postinst.d/apt-auto-removal'
+maybe chmod 0755 'kernel/postinst.d/dkms'
 maybe chmod 0755 'kernel/postinst.d/initramfs-tools'
 maybe chmod 0755 'kernel/postinst.d/zz-update-grub'
 maybe chmod 0755 'kernel/postrm.d'
 maybe chmod 0755 'kernel/postrm.d/initramfs-tools'
 maybe chmod 0755 'kernel/postrm.d/zz-update-grub'
 maybe chmod 0755 'kernel/prerm.d'
+maybe chmod 0755 'kernel/prerm.d/dkms'
 maybe chmod 0644 'ld.so.conf'
 maybe chmod 0755 'ld.so.conf.d'
+maybe chmod 0644 'ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf'
 maybe chmod 0644 'ld.so.conf.d/libc.conf'
 maybe chmod 0644 'ld.so.conf.d/x86_64-linux-gnu.conf'
 maybe chmod 0755 'ldap'
 maybe chmod 0644 'ldap/ldap.conf'
 maybe chmod 0755 'ldap/schema'
+maybe chmod 0644 'ldap/schema/amavis.schema'
 maybe chmod 0755 'letsencrypt'
 maybe chmod 0644 'letsencrypt/.updated-options-ssl-apache-conf-digest.txt'
 maybe chmod 0644 'letsencrypt/.updated-options-ssl-nginx-conf-digest.txt'
@@ -3521,11 +3599,16 @@ maybe chmod 0755 'logrotate.d'
 maybe chmod 0644 'logrotate.d/alternatives'
 maybe chmod 0644 'logrotate.d/apt'
 maybe chmod 0644 'logrotate.d/btmp'
+maybe chmod 0644 'logrotate.d/clamav-daemon'
+maybe chmod 0644 'logrotate.d/clamav-freshclam'
 maybe chmod 0644 'logrotate.d/dpkg'
 maybe chmod 0644 'logrotate.d/fail2ban'
 maybe chmod 0644 'logrotate.d/mysql-server'
 maybe chmod 0644 'logrotate.d/nginx'
+maybe chmod 0644 'logrotate.d/php8.0-fpm'
 maybe chmod 0644 'logrotate.d/redis-server'
+maybe chmod 0644 'logrotate.d/rkhunter'
+maybe chmod 0644 'logrotate.d/rspamd'
 maybe chmod 0644 'logrotate.d/rsyslog'
 maybe chmod 0644 'logrotate.d/wtmp'
 maybe chmod 0755 'logwatch'
@@ -3539,6 +3622,7 @@ maybe chmod 0644 'magic'
 maybe chmod 0644 'magic.mime'
 maybe chmod 0755 'mail'
 maybe chmod 0755 'mail/m4'
+maybe chmod 0644 'mail/m4/opendkim.m4'
 maybe chmod 0644 'mailcap'
 maybe chmod 0644 'mailcap.order'
 maybe chmod 0644 'mailname'
@@ -3546,6 +3630,7 @@ maybe chmod 0644 'manpath.config'
 maybe chmod 0644 'mime.types'
 maybe chmod 0644 'mke2fs.conf'
 maybe chmod 0755 'modprobe.d'
+maybe chmod 0644 'modprobe.d/dkms.conf'
 maybe chmod 0644 'modules'
 maybe chmod 0755 'modules-load.d'
 maybe chmod 0755 'monit'
@@ -3572,9 +3657,13 @@ maybe chmod 0644 'neofetch/neofetch.config'
 maybe chmod 0644 'netconfig'
 maybe chmod 0755 'network'
 maybe chmod 0755 'network/if-down.d'
+maybe chmod 0755 'network/if-down.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'network/if-down.d/postfix'
 maybe chmod 0755 'network/if-post-down.d'
 maybe chmod 0755 'network/if-pre-up.d'
 maybe chmod 0755 'network/if-up.d'
+maybe chmod 0755 'network/if-up.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'network/if-up.d/postfix'
 maybe chmod 0644 'network/interfaces'
 maybe chmod 0755 'network/interfaces.d'
 maybe chmod 0644 'network/interfaces.d/50-cloud-init.cfg'
@@ -3619,6 +3708,7 @@ maybe chmod 0644 'nginx/uwsgi_params'
 maybe chmod 0644 'nginx/uwsgi_params.default'
 maybe chmod 0644 'nginx/win-utf'
 maybe chmod 0644 'nsswitch.conf'
+maybe chmod 0644 'ntp.conf'
 maybe chmod 0755 'opendkim'
 maybe chmod 0644 'opendkim.conf'
 maybe chmod 0755 'opendkim/keys'
@@ -3639,6 +3729,7 @@ maybe chmod 0644 'pam.d/common-password'
 maybe chmod 0644 'pam.d/common-session'
 maybe chmod 0644 'pam.d/common-session-noninteractive'
 maybe chmod 0644 'pam.d/cron'
+maybe chmod 0644 'pam.d/dovecot'
 maybe chmod 0644 'pam.d/login'
 maybe chmod 0644 'pam.d/newusers'
 maybe chmod 0644 'pam.d/other'
@@ -3660,12 +3751,60 @@ maybe chmod 0755 'php'
 maybe chmod 0755 'php/8.0'
 maybe chmod 0755 'php/8.0/cgi'
 maybe chmod 0755 'php/8.0/cgi/conf.d'
+maybe chmod 0644 'php/8.0/cgi/php.ini'
 maybe chmod 0755 'php/8.0/cli'
 maybe chmod 0755 'php/8.0/cli/conf.d'
+maybe chmod 0644 'php/8.0/cli/php.ini'
 maybe chmod 0755 'php/8.0/fpm'
 maybe chmod 0755 'php/8.0/fpm/conf.d'
+maybe chmod 0644 'php/8.0/fpm/php-fpm.conf'
+maybe chmod 0644 'php/8.0/fpm/php.ini'
 maybe chmod 0755 'php/8.0/fpm/pool.d'
+maybe chmod 0644 'php/8.0/fpm/pool.d/www.conf'
 maybe chmod 0755 'php/8.0/mods-available'
+maybe chmod 0644 'php/8.0/mods-available/apcu.ini'
+maybe chmod 0644 'php/8.0/mods-available/bcmath.ini'
+maybe chmod 0644 'php/8.0/mods-available/calendar.ini'
+maybe chmod 0644 'php/8.0/mods-available/ctype.ini'
+maybe chmod 0644 'php/8.0/mods-available/curl.ini'
+maybe chmod 0644 'php/8.0/mods-available/dom.ini'
+maybe chmod 0644 'php/8.0/mods-available/exif.ini'
+maybe chmod 0644 'php/8.0/mods-available/ffi.ini'
+maybe chmod 0644 'php/8.0/mods-available/fileinfo.ini'
+maybe chmod 0644 'php/8.0/mods-available/ftp.ini'
+maybe chmod 0644 'php/8.0/mods-available/gd.ini'
+maybe chmod 0644 'php/8.0/mods-available/gettext.ini'
+maybe chmod 0644 'php/8.0/mods-available/gmp.ini'
+maybe chmod 0644 'php/8.0/mods-available/iconv.ini'
+maybe chmod 0644 'php/8.0/mods-available/igbinary.ini'
+maybe chmod 0644 'php/8.0/mods-available/imagick.ini'
+maybe chmod 0644 'php/8.0/mods-available/imap.ini'
+maybe chmod 0644 'php/8.0/mods-available/intl.ini'
+maybe chmod 0644 'php/8.0/mods-available/mbstring.ini'
+maybe chmod 0644 'php/8.0/mods-available/memcache.ini'
+maybe chmod 0644 'php/8.0/mods-available/memcached.ini'
+maybe chmod 0644 'php/8.0/mods-available/msgpack.ini'
+maybe chmod 0644 'php/8.0/mods-available/mysqli.ini'
+maybe chmod 0644 'php/8.0/mods-available/mysqlnd.ini'
+maybe chmod 0644 'php/8.0/mods-available/opcache.ini'
+maybe chmod 0644 'php/8.0/mods-available/pdo.ini'
+maybe chmod 0644 'php/8.0/mods-available/pdo_mysql.ini'
+maybe chmod 0644 'php/8.0/mods-available/phar.ini'
+maybe chmod 0644 'php/8.0/mods-available/posix.ini'
+maybe chmod 0644 'php/8.0/mods-available/readline.ini'
+maybe chmod 0644 'php/8.0/mods-available/redis.ini'
+maybe chmod 0644 'php/8.0/mods-available/shmop.ini'
+maybe chmod 0644 'php/8.0/mods-available/simplexml.ini'
+maybe chmod 0644 'php/8.0/mods-available/sockets.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvmsg.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvsem.ini'
+maybe chmod 0644 'php/8.0/mods-available/sysvshm.ini'
+maybe chmod 0644 'php/8.0/mods-available/tokenizer.ini'
+maybe chmod 0644 'php/8.0/mods-available/xml.ini'
+maybe chmod 0644 'php/8.0/mods-available/xmlreader.ini'
+maybe chmod 0644 'php/8.0/mods-available/xmlwriter.ini'
+maybe chmod 0644 'php/8.0/mods-available/xsl.ini'
+maybe chmod 0644 'php/8.0/mods-available/zip.ini'
 maybe chmod 0755 'postfix'
 maybe chmod 0644 'postfix/dh_1024.pem'
 maybe chmod 0644 'postfix/dh_512.pem'
@@ -3706,7 +3845,11 @@ maybe chmod 0644 'postgrey/whitelist_clients'
 maybe chmod 0644 'postgrey/whitelist_recipients'
 maybe chmod 0755 'ppp'
 maybe chmod 0755 'ppp/ip-down.d'
+maybe chmod 0755 'ppp/ip-down.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'ppp/ip-down.d/postfix'
 maybe chmod 0755 'ppp/ip-up.d'
+maybe chmod 0755 'ppp/ip-up.d/clamav-freshclam-ifupdown'
+maybe chmod 0755 'ppp/ip-up.d/postfix'
 maybe chmod 0644 'profile'
 maybe chmod 0755 'profile.d'
 maybe chmod 0644 'profile.d/Z99-cloud-locale-test.sh'
@@ -3762,6 +3905,7 @@ maybe chmod 0640 'redis/redis.conf'
 maybe chmod 0644 'reportbug.conf'
 maybe chmod 0755 'resolvconf'
 maybe chmod 0755 'resolvconf/update-libc.d'
+maybe chmod 0755 'resolvconf/update-libc.d/postfix'
 maybe chmod 0644 'rkhunter.conf'
 maybe chmod 0644 'rkhunter.conf.local'
 maybe chmod 0644 'rpc'
@@ -3804,6 +3948,8 @@ maybe chmod 0755 'rspamd/modules.d'
 maybe chmod 0644 'rspamd/modules.d/antivirus.conf'
 maybe chmod 0644 'rspamd/modules.d/arc.conf'
 maybe chmod 0644 'rspamd/modules.d/asn.conf'
+maybe chmod 0644 'rspamd/modules.d/aws_s3.conf'
+maybe chmod 0644 'rspamd/modules.d/bimi.conf'
 maybe chmod 0644 'rspamd/modules.d/chartable.conf'
 maybe chmod 0644 'rspamd/modules.d/clickhouse.conf'
 maybe chmod 0644 'rspamd/modules.d/dcc.conf'
@@ -3812,6 +3958,7 @@ maybe chmod 0644 'rspamd/modules.d/dkim_signing.conf'
 maybe chmod 0644 'rspamd/modules.d/dmarc.conf'
 maybe chmod 0644 'rspamd/modules.d/elastic.conf'
 maybe chmod 0644 'rspamd/modules.d/emails.conf'
+maybe chmod 0644 'rspamd/modules.d/external_relay.conf'
 maybe chmod 0644 'rspamd/modules.d/external_services.conf'
 maybe chmod 0644 'rspamd/modules.d/force_actions.conf'
 maybe chmod 0644 'rspamd/modules.d/forged_recipients.conf'
@@ -3875,9 +4022,11 @@ maybe chmod 0644 'rspamd/worker-proxy.inc'
 maybe chmod 0644 'rsyslog.conf'
 maybe chmod 0755 'rsyslog.d'
 maybe chmod 0644 'rsyslog.d/21-cloudinit.conf'
+maybe chmod 0644 'rsyslog.d/postfix.conf'
 maybe chmod 0755 'runit'
 maybe chmod 0755 'runit/runsvdir'
 maybe chmod 0755 'runit/runsvdir/default'
+maybe chmod 0644 'screenrc'
 maybe chmod 0755 'security'
 maybe chmod 0644 'security/access.conf'
 maybe chmod 0644 'security/faillock.conf'
@@ -3911,6 +4060,7 @@ maybe chmod 0644 'skel/.bashrc'
 maybe chmod 0644 'skel/.profile'
 maybe chmod 0755 'spamassassin'
 maybe chmod 0755 'spamassassin/sa-update-hooks.d'
+maybe chmod 0755 'spamassassin/sa-update-hooks.d/amavisd-new'
 maybe chmod 0755 'ssh'
 maybe chmod 0644 'ssh/moduli'
 maybe chmod 0644 'ssh/ssh_config'
@@ -3928,8 +4078,12 @@ maybe chmod 0755 'ssh/sshd_config.d'
 maybe chmod 0755 'ssl'
 maybe chmod 0755 'ssl/certs'
 maybe chmod 0644 'ssl/certs/ca-certificates.crt'
+maybe chmod 0644 'ssl/certs/ssl-cert-snakeoil.pem'
 maybe chmod 0644 'ssl/openssl.cnf'
-maybe chmod 0700 'ssl/private'
+maybe chgrp 'ssl-cert' 'ssl/private'
+maybe chmod 0710 'ssl/private'
+maybe chgrp 'ssl-cert' 'ssl/private/ssl-cert-snakeoil.key'
+maybe chmod 0640 'ssl/private/ssl-cert-snakeoil.key'
 maybe chmod 0644 'subgid'
 maybe chmod 0644 'subgid-'
 maybe chmod 0644 'subuid'
@@ -3993,6 +4147,8 @@ maybe chmod 0644 'systemd/resolved.conf'
 maybe chmod 0644 'systemd/sleep.conf'
 maybe chmod 0755 'systemd/system'
 maybe chmod 0644 'systemd/system.conf'
+maybe chmod 0755 'systemd/system/clamav-daemon.service.d'
+maybe chmod 0644 'systemd/system/clamav-daemon.service.d/extend.conf'
 maybe chmod 0755 'systemd/system/cloud-init.target.wants'
 maybe chmod 0755 'systemd/system/default.target.wants'
 maybe chmod 0755 'systemd/system/getty.target.wants'
@@ -4010,6 +4166,7 @@ maybe chmod 0755 'terminfo'
 maybe chmod 0644 'terminfo/README'
 maybe chmod 0644 'timezone'
 maybe chmod 0755 'tmpfiles.d'
+maybe chmod 0644 'tmpfiles.d/screen-cleanup.conf'
 maybe chmod 0644 'ucf.conf'
 maybe chmod 0755 'udev'
 maybe chmod 0755 'udev/hwdb.d'
@@ -4019,10 +4176,14 @@ maybe chmod 0644 'udev/rules.d/80-hotplug-cpu-mem.rules'
 maybe chmod 0644 'udev/udev.conf'
 maybe chmod 0755 'ufw'
 maybe chmod 0755 'ufw/applications.d'
+maybe chmod 0644 'ufw/applications.d/dovecot-imapd'
+maybe chmod 0644 'ufw/applications.d/dovecot-pop3d'
 maybe chmod 0644 'ufw/applications.d/nginx'
 maybe chmod 0644 'ufw/applications.d/openssh-server'
+maybe chmod 0644 'ufw/applications.d/postfix'
 maybe chmod 0755 'update-motd.d'
 maybe chmod 0755 'update-motd.d/10-uname'
+maybe chmod 0644 'updatedb.conf'
 maybe chmod 0644 'vconsole.conf'
 maybe chmod 0755 'vim'
 maybe chmod 0644 'vim/vimrc'

NetworkManager/dispatcher.d/ntp

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+old_ntp_servers="unknown and invalid"
+new_ntp_servers=$DHCP4_NTP_SERVERS
+case "$2" in
+	up|vpn-up) reason=BOUND; ;;
+	down|vpn-down) reason=RELEASE; ;;
+	*) exit 0; ;;
+esac
+
+test -f /etc/dhcp/dhclient-exit-hooks.d/ntp || exit 0
+. /etc/dhcp/dhclient-exit-hooks.d/ntp

aliases

@@ -0,0 +1,3 @@
+# See man 5 aliases for format
+postmaster:    root
+clamav: root

alternatives/animate

@@ -0,0 +1 @@
+/usr/bin/animate-im6.q16

alternatives/animate-im6

@@ -0,0 +1 @@
+/usr/bin/animate-im6.q16

alternatives/animate-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/animate-im6.q16.1.gz

alternatives/animate.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/animate-im6.q16.1.gz

alternatives/c++

@@ -0,0 +1 @@
+/usr/bin/g++

alternatives/c89

@@ -0,0 +1 @@
+/usr/bin/c89-gcc

alternatives/c89.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/c89-gcc.1.gz

alternatives/c99

@@ -0,0 +1 @@
+/usr/bin/c99-gcc

alternatives/c99.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/c99-gcc.1.gz

alternatives/cc

@@ -0,0 +1 @@
+/usr/bin/gcc

alternatives/compare

@@ -0,0 +1 @@
+/usr/bin/compare-im6.q16

alternatives/compare-im6

@@ -0,0 +1 @@
+/usr/bin/compare-im6.q16

alternatives/compare-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/compare-im6.q16.1.gz

alternatives/compare.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/compare-im6.q16.1.gz

alternatives/composite

@@ -0,0 +1 @@
+/usr/bin/composite-im6.q16

alternatives/composite-im6

@@ -0,0 +1 @@
+/usr/bin/composite-im6.q16

alternatives/composite-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/composite-im6.q16.1.gz

alternatives/composite.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/composite-im6.q16.1.gz

alternatives/conjure

@@ -0,0 +1 @@
+/usr/bin/conjure-im6.q16

alternatives/conjure-im6

@@ -0,0 +1 @@
+/usr/bin/conjure-im6.q16

alternatives/conjure-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/conjure-im6.q16.1.gz

alternatives/conjure.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/conjure-im6.q16.1.gz

alternatives/convert

@@ -0,0 +1 @@
+/usr/bin/convert-im6.q16

alternatives/convert-im6

@@ -0,0 +1 @@
+/usr/bin/convert-im6.q16

alternatives/convert-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/convert-im6.q16.1.gz

alternatives/convert.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/convert-im6.q16.1.gz

alternatives/cpp

@@ -0,0 +1 @@
+/usr/bin/cpp

alternatives/display

@@ -0,0 +1 @@
+/usr/bin/display-im6.q16

alternatives/display-im6

@@ -0,0 +1 @@
+/usr/bin/display-im6.q16

alternatives/display-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/display-im6.q16.1.gz

alternatives/display.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/display-im6.q16.1.gz

alternatives/faked.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/faked-sysv.1.gz

alternatives/faked.es.1.gz

@@ -0,0 +1 @@
+/usr/share/man/es/man1/faked-sysv.1.gz

alternatives/faked.fr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/faked-sysv.1.gz

alternatives/faked.sv.1.gz

@@ -0,0 +1 @@
+/usr/share/man/sv/man1/faked-sysv.1.gz

alternatives/fakeroot

@@ -0,0 +1 @@
+/usr/bin/fakeroot-sysv

alternatives/fakeroot.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/fakeroot-sysv.1.gz

alternatives/fakeroot.es.1.gz

@@ -0,0 +1 @@
+/usr/share/man/es/man1/fakeroot-sysv.1.gz

alternatives/fakeroot.fr.1.gz

@@ -0,0 +1 @@
+/usr/share/man/fr/man1/fakeroot-sysv.1.gz

alternatives/fakeroot.sv.1.gz

@@ -0,0 +1 @@
+/usr/share/man/sv/man1/fakeroot-sysv.1.gz

alternatives/identify

@@ -0,0 +1 @@
+/usr/bin/identify-im6.q16

alternatives/identify-im6

@@ -0,0 +1 @@
+/usr/bin/identify-im6.q16

alternatives/identify-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/identify-im6.q16.1.gz

alternatives/identify.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/identify-im6.q16.1.gz

alternatives/import

@@ -0,0 +1 @@
+/usr/bin/import-im6.q16

alternatives/import-im6

@@ -0,0 +1 @@
+/usr/bin/import-im6.q16

alternatives/import-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/import-im6.q16.1.gz

alternatives/import.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/import-im6.q16.1.gz

alternatives/libblas.so.3-x86_64-linux-gnu

@@ -0,0 +1 @@
+/usr/lib/x86_64-linux-gnu/blas/libblas.so.3

alternatives/locate

@@ -0,0 +1 @@
+/usr/bin/mlocate

alternatives/locate.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mlocate.1.gz

alternatives/mogrify

@@ -0,0 +1 @@
+/usr/bin/mogrify-im6.q16

alternatives/mogrify-im6

@@ -0,0 +1 @@
+/usr/bin/mogrify-im6.q16

alternatives/mogrify-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mogrify-im6.q16.1.gz

alternatives/mogrify.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/mogrify-im6.q16.1.gz

alternatives/montage

@@ -0,0 +1 @@
+/usr/bin/montage-im6.q16

alternatives/montage-im6

@@ -0,0 +1 @@
+/usr/bin/montage-im6.q16

alternatives/montage-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/montage-im6.q16.1.gz

alternatives/montage.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/montage-im6.q16.1.gz

alternatives/phar

@@ -0,0 +1 @@
+/usr/bin/phar8.0

alternatives/phar.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/phar8.0.1.gz

alternatives/phar.phar

@@ -0,0 +1 @@
+/usr/bin/phar.phar8.0

alternatives/phar.phar.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/phar.phar8.0.1.gz

alternatives/php

@@ -0,0 +1 @@
+/usr/bin/php8.0

alternatives/php-cgi

@@ -0,0 +1 @@
+/usr/bin/php-cgi8.0

alternatives/php-cgi-bin

@@ -0,0 +1 @@
+/usr/lib/cgi-bin/php8.0

alternatives/php-cgi.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/php-cgi8.0.1.gz

alternatives/php-fpm.sock

@@ -0,0 +1 @@
+/run/php/php8.0-fpm.sock

alternatives/php.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/php8.0.1.gz

alternatives/stream

@@ -0,0 +1 @@
+/usr/bin/stream-im6.q16

alternatives/stream-im6

@@ -0,0 +1 @@
+/usr/bin/stream-im6.q16

alternatives/stream-im6.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/stream-im6.q16.1.gz

alternatives/stream.1.gz

@@ -0,0 +1 @@
+/usr/share/man/man1/stream-im6.q16.1.gz

alternatives/updatedb

@@ -0,0 +1 @@
+/usr/bin/updatedb.mlocate

alternatives/updatedb.8.gz

@@ -0,0 +1 @@
+/usr/share/man/man8/updatedb.mlocate.8.gz

amavis/conf.d/05-node_id

@@ -8,6 +8,6 @@ chomp($myhostname = `hostname --fqdn`);
 # To manually set $myhostname, edit the following line with the correct Fully
 # Qualified Domain Name (FQDN) and remove the # at the beginning of the line.
 #
-#$myhostname = "mail.example.com";
+$myhostname = "mail.solusar.de";
 
 1;  # ensure a defined return

amavis/conf.d/50-user

@@ -52,7 +52,7 @@ $enable_dkim_verification = 1;
 ###
 
 ### Spam-Checks aktivieren
-@bypass_spam_checks_maps = (\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
+#@bypass_spam_checks_maps = (\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
 $sa_tag_level_deflt = -999;         # Informationen zu Spam-Score ab diesem Level (hier: immer) in den Header schreiben
 $sa_tag2_level_deflt = 5.0;         # Ab diesem Level E-Mails als Spam markieren
 $sa_kill_level_deflt = 5.9;         # Ab diesem Level E-Mails nicht annehmen, sondern Aktion in "final_spam_destiny" auslösen (REJECT)

apache2/conf-available/php8.0-cgi.conf

@@ -0,0 +1,32 @@
+# This file replaces old system MIME types and sets them only in the
+# Apache webserver
+
+# application/x-httpd-php                        phtml php
+<FilesMatch ".+\.ph(ar|p|tml)$">
+    SetHandler application/x-httpd-php
+</FilesMatch>
+# application/x-httpd-php-source                 phps
+<FilesMatch ".+\.phps$">
+    SetHandler application/x-httpd-php-source
+    # Deny access to raw php sources by default
+    # To re-enable it's recommended to enable access to the files
+    # only in specific virtual host or directory
+    Require all denied
+</FilesMatch>
+# Deny access to files without filename (e.g. '.php')
+<FilesMatch "^\.ph(ar|p|ps|tml)$">
+    Require all denied
+</FilesMatch>
+
+# To enable PHP CGI site-wide, just uncomment following lines, however
+# as a security measure, it's recommended to enable PHP just in the
+# specific virtual servers or just specific directories
+
+#ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+#<Directory "/usr/lib/cgi-bin">
+#    AllowOverride None
+#    Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+#    Order allow,deny
+#    Allow from all
+#</Directory>
+#Action application/x-httpd-php /cgi-bin/php8.0

apache2/conf-available/php8.0-fpm.conf

@@ -0,0 +1,32 @@
+# Redirect to local php-fpm if mod_php is not available
+<IfModule !mod_php8.c>
+<IfModule proxy_fcgi_module>
+    # Enable http authorization headers
+    <IfModule setenvif_module>
+    SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
+    </IfModule>
+
+    <FilesMatch ".+\.ph(ar|p|tml)$">
+        SetHandler "proxy:unix:/run/php/php8.0-fpm.sock|fcgi://localhost"
+    </FilesMatch>
+# The default configuration works for most of the installation, however it could
+# be improved in various ways. One simple improvement is to not pass files that
+# doesn't exist to the handler as shown below, for more configuration examples
+# see https://wiki.apache.org/httpd/PHP-FPM
+#    <FilesMatch ".+\.ph(ar|p|tml)$">
+#        <If "-f %{REQUEST_FILENAME}">
+#            SetHandler "proxy:unix:/run/php/php8.0-fpm.sock|fcgi://localhost"
+#        </If>
+#    </FilesMatch>
+    <FilesMatch ".+\.phps$">
+        # Deny access to raw php sources by default
+        # To re-enable it's recommended to enable access to the files
+        # only in specific virtual host or directory
+        Require all denied
+    </FilesMatch>
+    # Deny access to files without filename (e.g. '.php')
+    <FilesMatch "^\.ph(ar|p|ps|tml)$">
+        Require all denied
+    </FilesMatch>
+</IfModule>
+</IfModule>

apparmor.d/tunables/ntpd

@@ -0,0 +1,15 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#Add your ntpd devices here eg. if you have a DCF clock
+# @{NTPD_DEVICE}="/dev/ttyS1"
+@{NTPD_DEVICE}="/dev/null"

apparmor.d/usr.bin.freshclam

@@ -0,0 +1,47 @@
+# vim:syntax=apparmor
+# Author: Jamie Strandboge <jamie@ubuntu.com>
+# Last Modified: Sun Aug  3 09:39:03 2008
+
+#include <tunables/global>
+
+/usr/bin/freshclam flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+  #include <abstractions/openssl>
+
+  capability dac_override,
+  capability chown,
+
+  capability setgid,
+  capability setuid,
+
+  @{PROC}/filesystems r,
+  owner @{PROC}/[0-9]*/status r,
+
+  /etc/clamav/clamd.conf r,
+  /etc/clamav/freshclam.conf r,
+  /etc/clamav/onerrorexecute.d/* mr,
+  /etc/clamav/onupdateexecute.d/* mr,
+  /etc/clamav/virusevent.d/* mr,
+
+  owner @{HOME}/.clamtk/db/ rw,
+  owner @{HOME}/.clamtk/db/** rwk,
+
+  owner @{HOME}/.klamav/database/ rw,
+  owner @{HOME}/.klamav/database/** rwk,
+
+  /usr/bin/freshclam mr,
+
+  /var/lib/clamav/ r,
+  /var/lib/clamav/** krw,
+
+  /var/log/clamav/* krw,
+  /{,var/}run/clamav/freshclam.pid w,
+  /{,var/}run/clamav/clamd.ctl rw,
+
+  deny /{,var/}run/samba/{gencache,unexpected}.tdb mrwkl,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.bin.freshclam>
+}

apparmor.d/usr.sbin.clamd

@@ -0,0 +1,61 @@
+# vim:syntax=apparmor
+# Author: Jamie Strandboge <jamie@ubuntu.com>
+# Last Modified: Sun Aug  3 09:39:03 2008
+
+#include <tunables/global>
+
+/usr/sbin/clamd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/openssl>
+
+  # LP: #433764:
+  capability dac_override,
+
+  # needed, when using systemd
+  capability setgid,
+  capability setuid,
+  capability chown,
+
+  @{PROC}/filesystems r,
+  @{PROC}/[0-9]*/status r,
+
+  /etc/clamav/clamd.conf r,
+
+  /usr/sbin/clamd mr,
+
+  /tmp/ rw,
+  /tmp/** krw,
+
+  /var/lib/clamav/ r,
+  /var/lib/clamav/** krw,
+  /var/log/clamav/* krw,
+
+  /{,var/}run/clamav/clamd.ctl w,
+  /{,var/}run/clamav/clamd.pid w,
+
+  /var/spool/clamsmtp/* r,
+
+  /var/spool/qpsmtpd/* r,
+
+  /var/spool/p3scan/children/** r,
+
+  /var/spool/havp/** r,
+
+  # For amavisd-new integration
+  /var/lib/amavis/tmp/** r,
+  
+  # For mimedefang integration
+  /var/spool/MIMEDefang/mdefang-*/Work/ r,
+  /var/spool/MIMEDefang/mdefang-*/Work/** r,
+
+  # For use with exim
+  /var/spool/exim4/** r,
+
+  # Allow home dir to be scanned
+  @{HOME}/ r,
+  @{HOME}/** r,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.clamd>
+}

apparmor.d/usr.sbin.ntpd

@@ -0,0 +1,86 @@
+# vim:syntax=apparmor
+# Updated for Ubuntu by: Jamie Strandboge <jamie@canonical.com>
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2009-2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#include <tunables/global>
+#include <tunables/ntpd>
+/usr/sbin/ntpd flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+
+  capability ipc_lock,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+  capability sys_time,
+  capability sys_nice,
+
+  # ntp uses AF_INET, AF_INET6 and AF_UNSPEC
+  network dgram,
+  network stream,
+
+  @{PROC}/net/if_inet6 r,
+  @{PROC}/*/net/if_inet6 r,
+  @{NTPD_DEVICE} rw,
+  # pps devices are almost exclusively used with NTP
+  /dev/pps[0-9]* rw,
+
+  /{,s}bin/      r,
+  /usr/{,s}bin/  r,
+  /usr/local/{,s}bin/  r,
+  /usr/sbin/ntpd rmix,
+
+  /etc/ntp.conf r,
+  /etc/ntp.conf.dhcp r,
+  /etc/ntpd.conf r,
+  /etc/ntpd.conf.tmp r,
+  /run/ntp.conf.dhcp r,
+
+  /etc/ntp.keys r,
+  /etc/ntp/** r,
+
+  /etc/ntp.drift rwl,
+  /etc/ntp.drift.TEMP rwl,
+  /etc/ntp/drift* rwl,
+  /var/lib/ntp/*drift rw,
+  /var/lib/ntp/*drift.TEMP rw,
+
+  /var/log/ntp w,
+  /var/log/ntp.log w,
+  /var/log/ntpd w,
+  /var/log/ntpstats/clockstats* rwl,
+  /var/log/ntpstats/loopstats*  rwl,
+  /var/log/ntpstats/peerstats*  rwl,
+  /var/log/ntpstats/protostats* rwl,
+  /var/log/ntpstats/rawstats*   rwl,
+  /var/log/ntpstats/sysstats*   rwl,
+
+  /{,var/}run/ntpd.pid w,
+
+  # to be able to check for running ntpdate
+  /run/lock/ntpdate wk,
+
+  # To sign replies to MS-SNTP clients by the smbd daemon /var/lib/samba
+  /var/lib/samba/ntp_signd/socket rw,
+
+  # For use with clocks that report via shared memory (e.g. gpsd),
+  # you may need to give ntpd access to all of shared memory, though
+  # this can be considered dangerous. See https://launchpad.net/bugs/722815
+  # for details. To enable, add this to local/usr.sbin.ntpd:
+  #     capability ipc_owner,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.ntpd>
+}

apt/apt.conf.d/90rkhunter

@@ -0,0 +1,2 @@
+// Makes sure that rkhunter file properties database is updated after each remove or install only APT_AUTOGEN is enabled
+DPkg::Post-Invoke { "if [ -x /usr/bin/rkhunter ] && grep -qiE '^APT_AUTOGEN=.?(true|yes)' /etc/default/rkhunter; then /usr/share/rkhunter/scripts/rkhupd.sh; fi"; };

chkrootkit.conf

@@ -0,0 +1,3 @@
+RUN_DAILY="false"
+RUN_DAILY_OPTS="-q"
+DIFF_MODE="false"

clamav/freshclam.conf

@@ -7,20 +7,20 @@ LogVerbose false
 LogSyslog false
 LogFacility LOG_LOCAL6
 LogFileMaxSize 0
+LogRotate true
 LogTime true
 Foreground false
 Debug false
 MaxAttempts 5
 DatabaseDirectory /var/lib/clamav
 DNSDatabaseInfo current.cvd.clamav.net
-#AllowSupplementaryGroups false
-PidFile /var/run/clamav/freshclam.pid
 ConnectTimeout 30
 ReceiveTimeout 30
 TestDatabases yes
 ScriptedUpdates yes
 CompressLocalDatabase no
 Bytecode true
+NotifyClamd /etc/clamav/clamd.conf
 # Check for new database 24 times a day
 Checks 24
 DatabaseMirror db.local.clamav.net
@@ -28,3 +28,4 @@ DatabaseMirror database.clamav.net
 DatabaseMirror clamav.ilisys.com.au
 DatabaseMirror 193.27.50.222
 DatabaseMirror clamav.inode.at
+PidFile /var/run/clamav/freshclam.pid

cron.d/amavisd-new

@@ -0,0 +1,6 @@
+#
+#  SpamAssassin maintenance for amavisd-new
+#
+# m h dom mon dow user  command
+18 */3	* * *	amavis	test -e /usr/sbin/amavisd-new-cronjob && /usr/sbin/amavisd-new-cronjob sa-sync
+24 1  * * *   amavis  test -e /usr/sbin/amavisd-new-cronjob && /usr/sbin/amavisd-new-cronjob sa-clean

cron.daily/chkrootkit

@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -e
+
+CHKROOTKIT=/usr/sbin/chkrootkit
+CF=/etc/chkrootkit.conf
+LOG_DIR=/var/log/chkrootkit
+IGNORE_FILE=/dev/null
+
+if [ ! -x $CHKROOTKIT ]; then
+  exit 0
+fi
+
+if [ -f $CF ]; then
+    . $CF
+fi
+
+if [ ! -r "${IGNORE_FILE}" ]; then
+ IGNORE_FILE=/dev/null
+fi
+
+
+if [ "$RUN_DAILY" = "true" ]; then
+    if [ "$DIFF_MODE" = "true" ]; then
+				eval $CHKROOTKIT $RUN_DAILY_OPTS 2>&1 | egrep -v -f "${IGNORE_FILE}" > $LOG_DIR/log.today || true
+        if [ ! -f $LOG_DIR/log.expected ]; then
+						echo "ERROR: No file $LOG_DIR/log.expected"
+						echo "This file should contain expected output from chkrootkit"
+						echo
+						echo "Today's run produced the following output:"
+						echo "--- [ BEGIN: cat $LOG_DIR/log.today  ] ---"
+						cat $LOG_DIR/log.today
+						echo "--- [ END: cat $LOG_DIR/log.today ] ---"
+						echo
+						echo "To create this file containing all output from today's run, do (as root)"
+						echo "# cp -a $LOG_DIR/log.today $LOG_DIR/log.expected"
+				elif ! diff -q $LOG_DIR/log.expected $LOG_DIR/log.today > /dev/null 2>&1; then
+						echo "ERROR: chkrootkit output was not as expected."
+						echo
+						echo "The difference is:"
+						echo "---[ BEGIN: diff -u $LOG_DIR/log.expected $LOG_DIR/log.today ] ---"
+						diff -u $LOG_DIR/log.expected $LOG_DIR/log.today || true
+						echo "---[ END: diff -u $LOG_DIR/log.expected $LOG_DIR/log.today ] ---"
+						echo
+           					echo "To update the expected output, run (as root)"
+						echo "#  cp -a -f $LOG_DIR/log.today $LOG_DIR/log.expected"
+        fi
+    else
+        eval $CHKROOTKIT $RUN_DAILY_OPTS 2>&1 | (egrep -v -f "${IGNORE_FILE}") || true
+    fi
+fi

cron.daily/mlocate

@@ -0,0 +1,32 @@
+#! /bin/bash
+
+set -e
+
+# skip in favour of systemd timer
+if [ -d /run/systemd/system ]; then
+    exit 0
+fi
+
+[ -x /usr/bin/updatedb.mlocate ] || exit 0
+
+if which on_ac_power >/dev/null 2>&1; then
+    ON_BATTERY=0
+    on_ac_power >/dev/null 2>&1 || ON_BATTERY=$?
+    if [ "$ON_BATTERY" -eq 1 ]; then
+	exit 0
+    fi
+fi
+
+# See ionice(1)
+if [ -x /usr/bin/ionice ] &&
+    /usr/bin/ionice -c3 true 2>/dev/null; then
+    IONICE="/usr/bin/ionice -c3"
+fi
+
+# See nocache(1)
+NOCACHE=
+if [ -x /usr/bin/nocache ]; then
+    NOCACHE="/usr/bin/nocache"
+fi
+
+flock --nonblock /run/mlocate.daily.lock $NOCACHE $IONICE nice /usr/bin/updatedb.mlocate

cron.daily/ntp

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# The default Debian ntp.conf enables logging of various statistics to
+# the /var/log/ntpstats directory.  The daemon automatically changes
+# to a new datestamped set of files at midnight, so all we need to do
+# is delete old ones, and compress the ones we're keeping so disk
+# usage is controlled.
+
+statsdir=$(cat /etc/ntp.conf | grep -v '^#' | sed -nr 's/^statsdir[[:space:]]+([^[:space:]]+).*$/\1/p')
+
+if [ -n "$statsdir" ] && [ -d "$statsdir" ]; then
+	# only keep a week's depth of these. Delete only files exactly
+	# within the directory and do not descend into subdirectories
+	# to avoid security risks on platforms where find is not using
+	# fts-library.
+	find "$statsdir" -maxdepth 1 -type f -name "*stats*" -mtime +7 -delete
+
+	# compress whatever is left to save space but make sure to really
+	# do it only in the expected directory.
+	cd "$statsdir" || exit 1
+	ls -d -- *stats.???????? > /dev/null 2>&1
+	if [ $? -eq 0 ]; then
+		# Note that gzip won't compress the file names that
+		# are hard links to the live/current files, so this
+		# compresses yesterday and previous, leaving the live
+		# log alone.  We suppress the warnings gzip issues
+		# about not compressing the linked file.
+		gzip --best --quiet -- *stats.????????
+		return=$?
+		case $return in
+		    2)
+			exit 0			# squash all warnings
+			;;
+		    *)
+			exit $return	 	# but let real errors through
+			;;
+		esac
+	fi
+fi

cron.daily/rkhunter

@@ -0,0 +1,45 @@
+#!/bin/sh
+
+RKHUNTER=/usr/bin/rkhunter
+
+test -x $RKHUNTER || exit 0
+
+# source our config
+. /etc/default/rkhunter
+
+if [ -z "$NICE" ]; then
+    NICE=0
+fi
+
+if [ -z "$RUN_CHECK_ON_BATTERY" ]; then
+    RUN_CHECK_ON_BATTERY="false"
+fi
+
+# Do not run daily check if running on battery except if explicitely allowed
+case "$RUN_CHECK_ON_BATTERY" in
+    [NnFf]*)
+        if [ -x /usr/bin/on_ac_power ]; then
+            on_ac_power >/dev/null 2>&1
+            [ $? -eq 1 ] && exit 0
+        fi
+esac
+
+case "$CRON_DAILY_RUN" in
+    [YyTt]*)
+        OUTFILE=`mktemp` || exit 1
+        /usr/bin/nice -n $NICE $RKHUNTER --cronjob --report-warnings-only --appendlog > $OUTFILE
+        if [ -s "$OUTFILE" -a -n "$REPORT_EMAIL" ]; then
+          (
+            echo "Subject: [rkhunter] $(hostname) - Daily report"
+            echo "To: $REPORT_EMAIL"
+            echo ""
+            cat $OUTFILE
+          ) | /usr/sbin/sendmail $REPORT_EMAIL
+        fi
+        rm -f $OUTFILE
+        ;;
+      *)
+       exit 0
+       ;;
+esac
+

cron.weekly/rkhunter

@@ -0,0 +1,51 @@
+#!/bin/sh
+
+RKHUNTER=/usr/bin/rkhunter
+
+test -x $RKHUNTER || exit 0
+
+# source our config
+. /etc/default/rkhunter
+
+case "$CRON_DB_UPDATE" in
+        [YyTt]*)
+
+                if [ ! -x /usr/bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /usr/bin/links ] && \
+                   [ ! -x /usr/bin/elinks ] && [ ! -x /usr/bin/lynx ]; then
+                     echo "No tool with which to download rkhunter updates was found on your system. Please install wget, curl, (e)links or lynx"
+                     exit 1
+                fi
+
+                OUTFILE=`mktemp` || exit 1
+
+                case "$DB_UPDATE_EMAIL" in
+                    [YyTt]*)
+                        (
+                        echo "Subject: [rkhunter] $(hostname) - Weekly database update"
+                        echo "To: $REPORT_EMAIL"
+                        echo ""
+                        $RKHUNTER --versioncheck --nocolors --appendlog
+                        $RKHUNTER --update --nocolors --appendlog
+                        ) | /usr/sbin/sendmail $REPORT_EMAIL
+                    ;;
+                    *)
+                        $RKHUNTER --versioncheck --appendlog 1>/dev/null 2>$OUTFILE
+                        $RKHUNTER --update --appendlog 1>/dev/null 2>>$OUTFILE
+                    ;;
+                esac
+
+                if [ -s "$OUTFILE" ]; then
+                    (
+                    echo "Subject: [rkhunter] $(hostname) - Weekly rkhunter database update"
+                    echo "To: $REPORT_EMAIL"
+                    echo ""
+                    cat $OUTFILE
+                    ) | /usr/sbin/sendmail $REPORT_EMAIL
+                fi
+                rm -f $OUTFILE
+        ;;
+
+        *)
+                exit 0
+        ;;
+esac

default/amavisd-snmp-subagent

@@ -0,0 +1,12 @@
+# there are two implementations of the subagent daemon:
+# 1) the default bdb version
+# 2) a zero mq based version
+# if you want to use this agent you need at least 
+# libnet-snmp-perl installed.
+# the zeromq version also needs libzeromq-perl.
+# You also have to enable zeromq
+# in amavis: $enable_zmq = 1; 
+#  
+# See RELEASE_NOTES for details. 
+
+AGENT_BACKEND="bdb" # use zeromq for the zeromq version

default/dovecot

@@ -0,0 +1,4 @@
+# /etc/default/dovecot
+
+# Set to '1' to allow Dovecot daemons to produce core dumps
+#ALLOW_COREDUMPS=1