This adds back the libpam-google-authenticator module for 2fa for ssh access.
This does not configure the users 2fa code. The admin users will need to run `google-authenticator` on each server prior to trying to authenticate without the ssh-keyfile
If a admin users 2fa secret file is not created and the user does not have the ssh-private key, they will just see a password prompt and will not be able to authenticate.

There are different errors shown if the pasword failed or if it was the 2fa code.

This does not disable ssh-key files. When you are authenticating via ssh-keyfile the 2fa pam module will not be used.
unattended-upgrades regex should block all kernels except grsec

grsec patches are periodically upgraded for LTS releases of the Linux
kernel, while the kernel itself is upgraded more frequently by default
in Ubuntu. We want to allow the installation and auto-upgrade of the
grsec kernel that we provide, but do not want unattended-upgrades to
clobber our grsec kernel with a newer (but not grsec-hardened) version
of the Linux kernel provided by the default repos.

This regular expression matches (therefore blacklists) any package name
that begins with "linux-(image|headers)" unless the string "grsec"
appears later in the string.
Merge pull request #656 from dolanjs/ssh-2fa

Password + TOTP as a ssh authentication option
Remove starred/unstarred headings, replace with gap
Updated the bin path for both the apache and tor apparmor profiles.
Updated the corresponding lines for the securedrop-app-code postinst.

The securedrop-app-code currentyl only puts the profile in complain mode. This will need to be changed to `aa-enforce` when the apparmor profiles are flushed out
Ignore .DS_Store

Interestingly, these files were only created once I navigated into the
directories using the Mac OS X Finder.
Fixes for "Disable JS" bubble

1. Fix matching the TB user agent
2. Fix position of bubble for new TB (NoScript icon moved in TB 4.0)
3. Use correct icon for "Forbid scripts globally (advised)"
4. Nicer design for bubble
Formatting nit
Remove unnecessary verbiage from submission notifications
More compact submission list
Merge pull request #657 from dolanjs/ansible-apparmor-complain

Update apparmor profiles for ubntu 14.04
re-added handler to postmap /etc/postfix/header_checks

This needs to run before restart postfix for it to take affect.
Yes, you will need a cable to hook the NUC up to a monitor
added ssh commands for mon-staging vm
@kevinmg pointed out that the command to start the webserver for development VM was missing from the documentation.
Updated the grsec package name to current. a meta package will need to be put in place so we don't need to hard code a specific version

The grsec lock will not exist until the system is rebooted in the kernel.

Removed extra pax changes that were required for 12.04
Add cheat sheet for log file locations
Temporarily disable vagrant-cachier

This will slow down provisioning times, but fixes issues with apt that
appear to be caused by vagrant-cachier. Should re-enable when
https://github.com/fgrehm/vagrant-cachier/issues/128 is resolved.
Merge pull request #658 from dolanjs/smtp-header-check

re-added ansible handler to run postmap /etc/postfix/header_checks
Merge pull request #659 from runasand/develop

Yes, you will need a cable to hook the NUC up to a monitor