Check for duplicate usernames and prompt again
Remember user choice for codename length on subsequent requests
Merge pull request #655 from freedomofpress/default-codename-length

Remember user choice for codename length on subsequent requests
This adds back the libpam-google-authenticator module for 2fa for ssh access.
This does not configure the users 2fa code. The admin users will need to run `google-authenticator` on each server prior to trying to authenticate without the ssh-keyfile
If a admin users 2fa secret file is not created and the user does not have the ssh-private key, they will just see a password prompt and will not be able to authenticate.

There are different errors shown if the pasword failed or if it was the 2fa code.

This does not disable ssh-key files. When you are authenticating via ssh-keyfile the 2fa pam module will not be used.
unattended-upgrades regex should block all kernels except grsec

grsec patches are periodically upgraded for LTS releases of the Linux
kernel, while the kernel itself is upgraded more frequently by default
in Ubuntu. We want to allow the installation and auto-upgrade of the
grsec kernel that we provide, but do not want unattended-upgrades to
clobber our grsec kernel with a newer (but not grsec-hardened) version
of the Linux kernel provided by the default repos.

This regular expression matches (therefore blacklists) any package name
that begins with "linux-(image|headers)" unless the string "grsec"
appears later in the string.
Merge pull request #656 from dolanjs/ssh-2fa

Password + TOTP as a ssh authentication option
Remove starred/unstarred headings, replace with gap
Yes, you will need a cable to hook the NUC up to a monitor