Adding dpkg-divert to save modified config files for monitor package
fixed up comments and removed extra lines related to the apt source.list that was previously removed
moved the dpkg-divert here doc out of postinst for monitor package
added dpkg-divert statement for auto-autoupgrades for monitor package
re-added unattended upgrade config files as dpkg-divert for app-hardening package
changed iptables rules from using gid/uid numbers to names and removed setting the corresponding uid/gid in app-interface postinst
added disabled-password for adduser
changed adduser and addgroup to functions
To be able to mount /var/securedrop/keys,db,store in both chroot
jails the users' uid need to match outside and inside both chroot
jails. The tor and interface users' groups need to exist outside
the chroot jails so they can be used to define outbound iptables
rules by process owner on the host system outside the chroot jails.
re-added inotify-tools to app-ossec and monitor packages. It is a req
for OSSEC's Realtime options for syscheck.
http://ossec-docs.readthedocs.org/en/latest/manual/syscheck/
changed areas where there was a mkdir and later chmod for same directory
so that mkdir set permissions with -m flag to avoid race condition scenario
added removing tor user/groups in app-interfaces, source and document postrm
removed auto-loading iptables rules on install since for first time
users once it applied the iptables rules it would break the ssh session
that is not over tor. This would stop the admin from ever getting their
tor url to ssh and google 2fa code to login

also updated order of iptables rules and removed fqdn
moving rc.local to init script
dpkg extracts the files from the deb package before installing the dependencies

If unattended-upgrades is not installed on the host system prior to
securedrop-hardening package being installed it will prompt to overwrite
the included 20auto-upgrades file with the unattended-upgrades version.
This will leave auto upgrades disabled. Since securedrop-interfaces is
installed before securedrop-hardening also included unattended-upgrades package there.

When I break up the monitor package into monitor-ossec and monitor-hardening, I'll do
the same there installing monitor-ossec first (including unattended-upgrades) so not to
rick admin disabling auto-upgrades
updated name of init script in app-interfaces postrm
added process owner to dns outbound rules and updated comments
various fixes for lintian errors
When more admins were added to the torrc config got update issues, so moved the torrc file to here doc in postinst that will only be written once
moved creating the app config here docs to postinst for source/documnet packages
and fixed the way the torrc file was handles so it doesn't get over written or prompt
the user during the next package update. And fixed typo in securedrop init script
Setting other packages conf files as a securedrop package cause updates issues. removed other packages config files from being listed as securedrio conffiles.
added putting apparmor profiles in complain mode in the prerm
apparmor profiles are still put back in enforce mode each time the postinst is run
added tor signing key to add-repos script instead of retrieving from keyserver
added -i to sed to actually edit the file