These are the changes that will be obvious to users such as display changes or
breakage of previous functionality.

For changes made under the covers not visible to users refer to the change history in
the bash script files, and for new parameters the documentation html file and example
ALL.custom file provided.

Backward compatibility is not guaranteed although most changes for adding additional
data collection wil be ignored by older processing versions, and newer processing versions
should cope with expected new information missing. Ideally you would keep the collector
and processing script versions the same but still works if you do not.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.27 and version 0.28 are
-------------------------------------------------------------------------------------
(1) New custom file option MUST_PATCH_WITHIN_DAYS=nn added. If (only if) this exists
    in a server custom file will a new section F.5 be reported saying whether the
    server had been patched within the last NN days and create a new alert if over
    that limit. NOTE! from the data as of the time the data collection was run, not
    real time of course [I have a nrpe plugin for that].
(2) From 0.28 onward the last date a server was patched is collected by the script
    and the processing script reprts that in the server index page as information;
    no checks on it unless (1) above is used for the server custom file. 
(3) Bug-fix (workaround) for SunOS "ps -ef" display using start dates like
    "May 15" instead of Linux "May15" that was throwing out the awk field
    numbers when collector was run on openindiana that had been up for a while,
    was causing false alerts in network check process matches

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.26 and version 0.27 are
-------------------------------------------------------------------------------------
Lots of cleanup while I am still on annual leave, then project may be dormant for another year.
(1) Bug fix so version bump. Multiple entries for tcp port custom entries (such as
    adding overrides) were not being handled correctly; The visible change is that
    for ports defined as WILD (permitted to listen on all interfaces) the report will
    now be correct instead of being confused by multiple port customfile lines.
(2) New custom file flag SSHD_LISTEN_ON_ALL=WARN:reasontext added so an
    exact_alert_reason is not needed to flag it as expected for servers that must
    listen on 0.0.0.0 for sshd; and drops alert count by 1 :-).
(3) Another bug fix, in 3 places warning counts were not being recorded correctly.
(4) Already handled Debians use of 'nonexistent' as a valid user home dir, added
    rhels use of 'nonexisting' as valid also to stop alerting on that missing.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.25 and version 0.26 are
-------------------------------------------------------------------------------------
(1) new check on authorized_keys file to alert is any user keys file does not
    contain a from=host prefix to restrict what host a client can connect from
    using the public key (so the ability for private keys being copied/shared will
    be visible).
    New tests only done if collector version used was -ge 0.26 (and processing
    version -ge 0.26) else new tests are skipped as data would not be collected.
(2) any imbedded commands within a users authorized_keys file will be more
    prominantly highlighted [ie: gitea uses a command= line in the authorized_keys file]
    any command line will be an alert (for now, still thinking about how to handle
    expected ones as would have to be exact matches so treating all as a a risk)
(3) SunOS specific check, the SUID files it creates as /proc/PID/object/a.out 
    are now warnings instead of alerts, as they cannot be added to the expected 
    suid file list as PID changes on every reboot coded as warning to review as
    they will always be there rather than an alert to fix.
    Intended in future to lookup the process using the PID to automate ok check
    (far future as it only affects SunOS).
(4) Additional checks and info for servers with ansible will show in new A.12

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.24 and version 0.25 are
-------------------------------------------------------------------------------------
(1) Logic change that will change lots of alerts to OK. The checks that tested to
    ensure that only the owner of a system file (in /usr, /bin, /etc etc.) could
    update it that would alert if there was group write as well as owner write have
    been updated so that if group write permissions are set a check is done on the
    entries in /etc/group to see if additional users are in the group; if there are
    no additional users in the group the updateable only by file owner test will now
    be considered OK. If there are additional group members alerts will be raised as
    in 0.24 and earlier for files writeable by others. 
    This is in response to lots of packages installing files with group write and I 
    am getting sick of resecuring them to 644.
(2) BREAKING CHANGE **** <<<<<<<<<<<<<< ****
    The below customfile values id used must now have values terminated with a :
    which is needed for implementation of (3), to stop =rpc matching =rpcbind
    also in a grep for example, a grep of =rpc: would not match =rpcbind: so it
    is safe to use (3) with this requirement
      ALLOW_OWNER_ROOT
      ALLOW_DIRPERM_SYSTEM
      SUID_ALLOW
      SUDOERS_ALLOW_ALL_SERVERS
      SUDOERS_ALLOW_ALL_COMMANDS
      ALLOW_DIRPERM_EXPLICIT
      FORCE_ANYFILE_OK
    >> Sample script ../doc/update_custom_files.sh may help with this.
(3) New customfile parameter UNSET_VAR=@line to match@ 
    This is available for those cases server_OS files are ok for 99% of your
    servers but that last 1% have had default packages removed causing alerts
    for things like expected users and directories not existing, or tcpv6 disabled
    and alerts for no tcpv6 listeners that exist on other servers.
    In order to avoid issues this parameter can only be used against custom file
    settings where a value ends with a :
(4) New customfile parameters
    iptype_PORTVn_GENERATE_RANGE_ALLOWED=:start-end:description
    where iptype is TCP or UDP and n is 4 or 6.
    This generates for the port range a whole lot of
      iptype_PORTvn_ALLOWED and NETWORK_PORT_NOLISTENER_iptypeVn_OK
    config file entries during processing, but it is inadvisable.
    OPENING A WIDE RANGE AS EXPECTED/ALLOWED IS INSECURE AND SHOULD NOT BE USED.
    The only justification I have for adding this customfile entry is on my home
    network lab openstack nova (even tho nothing is using 99% of the ports) adds
    iptables rules for ports 5900-5999 and 49152-49215 and I really did not want
    to manually add a custom file entry line for each one.
    Lines added this way will be tagged as '(range generated)' in the reports
    produced so in later versions of the scripts I can add a new color code :-)

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.23 and version 0.24 are
-------------------------------------------------------------------------------------
(1) Breaking change: all custom file variables containing =YES should now be
    uppercase. For some reason only the authorised keys flag was lowercase now all
    are consistent as uppercase.
(2) A bug fix in the processing script for ALLOW_OWNER_OVERRIDE where it would
    fail if multiple entries for the same directory (added a tail -1 where needed)
(3) If sftp sybsystem is configured in sshd_config that is now considered OK as
    by default Debian now requires that with the SCP command
(4) New custom file flag to change alert for no firewall present to just a warning
    for servers that I do not intend to put iptables or firewalld on, also needed
    for servers that use IPF as a firewall (ie: SunOS) as the scripts do not support
    IPF yet.
(5) Added a check to see if sshd is configured to listen on all interfaces which is 
    a bad default, you will be getting an extra alert for non-Debian servers if you
    use defaults; for Debian servers it is a warning as you must use 0.0.0.0 there
    or sshd will not start (Debian tries to start sshd before networking configures
    static ips so sshd fails with no available interfaces if config specifies an ip)

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.22 and version 0.23 are
-------------------------------------------------------------------------------------
(1) Started implementing checks for SunOS (openindiana).
    Not yet implemented for that are open firewall ports (the collection script
    does not yet support ipfilter) and processes using UDP.
(2) A bug fix in the collector script for the user .ssh dir check that was
    getting the perms from the home directory instead of the .ssh one.
    The bug fix needed the version bump and release.
(3) Possible bug fix ?. In network checks 'program match' for allowed listeners
    had stopped working, fixed that. Not sure if that ws an existing bug introduced
    in an earlier change or a new one I introduced working on other changes.
    Noted as if it was in an earlier commit the fix is important.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.21 and version 0.22 are
-------------------------------------------------------------------------------------
(1) Added checks for some places persistent backdoors could live, ie: checks for
    commands run from sshd_config, user .ssh/config, user .ssh/rc, hosts.allow files
    that can all have commands set in them. Also check perms on .ssh directories.
(2) Not all servers run SELinuux, added a config file option to prevent an alert if
    it is not installed (even if you should install it on servers without it).
(3) additional check in hosts.allow to report as an alert if the server field is ALL
    for any entry instead of a hostname or ip-mask
(4) Minor non-visible bug fixes.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.20 and version 0.21 are
-------------------------------------------------------------------------------------
(1) Checks that sshd entries exist in hosts.allow and hosts.deny but as if you use
    ssh you would already use those so you probably won't notice, if you don't
    have them setup a new alert check
(2) display only change, extra field on the server summary page

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.19 and version 0.20 are
-------------------------------------------------------------------------------------
(1) New custom file parameters 
    For home directory ownership checks allow a shared directory to be owned by
    a non-root user without raising an alert
    ALLOW_OWNER_OVERRIDE=dirname:username:
    For systems running docker where container files are owned by UIDs not on
    the system suppress 'orphan' files under docker directories from alerting
    DOCKER_ORPHANS_SUPPRESS=YES

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.18 and version 0.19 are
-------------------------------------------------------------------------------------
(1) Bugfix: the expected allowed alerts link mapped to the work directory rather
    than a URL, corrected
(2) Bugfix: orphaned files were being reported multiple times, should be fixed
(3) report section C.1.3 moved to C.1.4, added a new C.1.3 for bluetooth active connections.
(4) Added as netstat run on OS Rocky8 on a laptop I have now reports on active bluetooth
    sessions on the wireless interface (which I never saw with Fedora netstat); only usefull
    if you have a laptop or server with a wireless card and an appropriate version
    of netstat on the machine. All bluetooth connections default to reporting as alerts
    as I consider them unexpected on a server. Can be downgraded to warnings with
    a new BLUETOOTH_ALERT_TO_WARN=yes customisation file flag but will never be
    permitted to be considered OK as servers should not be doing this
(*) No version bump !. A minor bugfix merged into 0.19 on 27Dec2021 was that I
    noticed Debian in /etc/sudoers used '@includedir' and the script origionally
    designed for rhel family server only followed '#includedir' statements in
    the data collection script; it now handles both

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.17 and version 0.18 are
-------------------------------------------------------------------------------------
(1) Some bug fixes since 0.17 tag base have been included to correct firewall check 
    reports and a incorrect logic check (where == should have been != in a rather
    important place in firewall rule checks).
(2) Added handling (and a lot of code cleanup as a result) for complicated iptables
    and netfilter rules openstack uses (such as 'nnn,nnn,nnn:nnn,nnn-nnn,nnn)
    where lists of comma seperated ports, including ranges can be intermingled).
    This results in more ports defined in firewall rules being checked so you may get
    some additional alerts (especially if you use something like kdeconnect that opens
    50 ports with its default firewalld rules [/usr/lib/firewalld/services/kdeconnectd.xml]),
    the location of firewalld services mentioned as you really should review/edit some
    of the defaults and place custom copies in /etc/firewalld/services directory to
    override bad defaults.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.16 and version 0.17 are
-------------------------------------------------------------------------------------
(1) Handling for include files in a servers 'custom' file using the parameter
    INCLUDE_CUSTOM_RULES=filename. This allows common applications to be grouped
    into discrete files (ie: nrpe, bacula_client, mysql etc.) that can be included
    rather than having to repeat the paramaters in multiple individual servers
    custom files. The processing will always be that individual server custom
    files will override included file parameters in the case of duplicates that
    may be provided by include files as the individual server custom files should
    always take precedence. A custom_includes directory has samples.
    Note: only available from a server main custom file, include files cannot
    themselves include files as that would raise the possibility of an infinite loop
(2) Changes handling of parameter SUID_SUPPRESS_SNAP_OVERLAYS=yes to always raise
    a single alert (while still not raising alerts for the 100s suppressed) as
    snap packages are dangerous in the way they install copies of setuid programs
    that any user on the system can run, so at least one alert should always be
    raised

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.15 and version 0.16 are
-------------------------------------------------------------------------------------
additional checks added - so you have new alerts in the report
(1) Appendix L added for checks against /etc/sudoers to check for install defaults 
    that should have been changed and newer insecure entries users may have added.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.14 and version 0.15 are
-------------------------------------------------------------------------------------
main index page changes
(1) Changes made only affect the main index page produced by the processing script,
    and will result in a noticably slower rebuild of the main index page if there
    are alerts for a server.
    Configuration file changes are only needed for those using the custom file
    parameter EXACT_ALERT_REASON introduced in version 0.14
    The expected alerts parameter EXACT_ALERT_REASON handling has changed, now
    the reason must exactly match the text of a real alert.
    The link in the index page that used to show the expected alert parameters
    still shows those, but it also now lists all alerts that may be matched plus
    the alerts that did actually match. Note: only selected alerts can be matched
    this way (critical alerts for things such as network and cron cannot be matched
    as these must be fixed rather than documeneted as being expected)
    Also the checks for EXACT_ALERT_REASON handling will now only be performed if
    there are no more than thirty alerts for a server (and I may lower that in
    the next release).

additional checks added
(2) User authorized_keys files are now searched for and reported on in new
    Appendix K. New appendix only produced if those files exist on the server.
    New customfile parameter to suppress alerting on those and just report on
    then with the exception of the root user which should never have them so
    will always alert.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.13 and version 0.14 are
-------------------------------------------------------------------------------------
(1) Main index page display changes and specifying expected alerts
    If alert count for a server is 0 that total will show in green text on the main
    index. Additional custom file parameter added to specify an alert that is
    expected that is considered OK which will also show the alert total for a server
    in green text on the main index page if the total of the expected alerts
    match the number of alerts; this parameter is added for servers that
    will have known issues that will never be fixed such as debian based servers
    always reporting password minlen is 0 (until I figure out how to obtain it) and
    openindianna/solaris servers reporting there is no firewall installed (as they use
    ipfilter and I have only coded checks for iptables and netfilter which are all
    I care about at the moment). HOWEVER unless you have a good reason, such as examples
    mentioned, you should not use the new parameter but strive for zero alerts which
    is easily possible on RHEL based systems using existing parameters in this toolkilt.
    If the new parameter is used you must provide N reson text entries to match the
    expected N alert counts which will be made available as a link from the index
(2) Now checks are done to see if subsystems are configured in sshd_config and an
    alert raised for each one configured. A customfile parameter can be used to
    downgrade the alert to a warning. On servers managed by ansible which must
    have the sftp subsystem available an additional customfile parameter is provided
    to downgrade the warning to OK only if the subsystem is named sftp.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.12 and version 0.13 are
IMPORTANT: backward compatibility for crontab checks made by collector versions
           prior to 0.13 is not provided. You must use the latest collector on
           all servers.
-------------------------------------------------------------------------------------
(1) *important* changes in crontab handling have been made, if you upgrade to
    processing version 0.13 you must use data collection files collected by
    version 0.13; I chose not to provide backward compability for the cron 
    section of the report. The effect of using an old version of the collector
    is that no crontab entries will be reported on when processed
(2) Not using at.allow/at.deny on the server will now alert
(3) Allow suppression of suid file alerts for the files installed as snap packages
    on Ubuntu that come bundled with thier own copy of system files

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.11 and version 0.12 are
-------------------------------------------------------------------------------------
(1) If both netfilter and iptables are in use raise a warning (in 0.11 was an alert)
(2) New customfile parm REFRESH_INTERVAL_EXPECTED=nn which is an enhancement to
    change '2' for version 0.11 so custom files can override the default of 14 days
    being used to mark a servers collected data as obsolete. As each server can now
    have a different value the value used is shown on the main index display next
    to the snapshot data capture date.
(3) Lots of additional new custom file entries created/managed to suppress more
    alerts users will never bother to fix (such as system users with non-existing home directories),
    examples in ALL.custom and documentation html file has been updated, refer to those
(4) New customfile sanity check, users in the system file owner list (parm ADD_SYSTEM_FILE_OWNER)
    that do not exist on the server being checked now alert as obsolete entries
    that need to be removed from the custom file
(5) IMPORTANT: the default list of users than can own system files has been shortened to
    "root bin lp tss" so you will have to make use of the ADD_SYSTEM_FILE_OWNER custom
    file parameter to define others depending on what packages you have installed.
    reason: point 6 above, with a long default list a long list of alerts
(6) the collector scriot now takes a noticable longer run time, as it collects
    additional info such as searching for and recording orphaned files under
    specific directories (system directories and /home), the
    0.12 processing script will produce an extra 'appendix j' if orphaned
    files or directories are found

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.10 and version 0.11 are
-------------------------------------------------------------------------------------
main change
(1) netfilter checks now match iptables checks for configured open port checks,
    no longer a beta 'fix' for f32/rhel8 firewalld changes but a working solution

other visible changes
(2) main index now highlights any servers with collected data files over 14 days old
(3) not a change but a note: on servers with both iptables and netfilter in use
    different ports may be opened on each. Normally with firewalld since F32/RHEL8
    using netfilter instead of iptabled there would be an empty iptables ruleset
    but some applications (such as docker-ce) will populate both iptables and
    netfilter rules so the reports produced by the script can show more ports
    open in netfilter than iptables in that case. That is normal but highlighted
    here as it will show up in the reports. Also an alert will be raised if both
    iptables and netfilter are installed.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.09 and version 0.10 are
-------------------------------------------------------------------------------------
collection script changes
(1) Bugfix: the test by grep for "\-c" on a crontab line (testing for syntax such
    as 'sh -c "command"' has been changed to "\ \-c\ " to ensure there is a space
    on either side of the -c. It was unfortunately matching on script names with
    -c (such as /home/mark/cron_jobs/list-changes). Also made that test on the
    first few fields of the command instead of the entire crintab line to avoid
    it matching if any commands had a aparemetr of -c.

feature enhancements
(2) new processing option --indexkernel=yes|no added for my use; default is 'no' to
    ensure users notice no difference by default. If it is used then on the main
    index page the kernel version running on each server is also displayed. Added
    for my use so I could see at a glance what servers were not running the 
    latest kernel. (Tip: I use it in conjunction with the --indexonly option to
    quickly switch between the two index displays as needed, as I prefer the default
    of not displaying it in most cases).
(3) new custom file parameter to identify a firewall port as an outbound port rule,
    so a firewall rule for the port does not alert if no local listening process
    has the port open

>>>BETA<<< feature enhancements
(4) Fedora32/CentOS8/RHEL8 have all changed the way firewalld behaves in that on those
    (and presumably any future releases) firewalld has changed from using iptables to netfilter
    rules as a backend to firewalld. This means that on systems using firewalld the
    existing firewall checks that expect iptables no longer work as iptables will
    always show 'accept' on everything.
    Initial BETA changes have been made to try to accomodate that change and at least
    provide some checking to provide initial reporting in a format that matches
    the existing iptables checks.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.08 and version 0.09 are
-------------------------------------------------------------------------------------
collection script changes
(1) the collection script parameters --backup-etc and --record-packages have had
    the defaults changed from yes to no. A personal preference as I was not yet
    doing anything with that data collected. If you want the data any scripts
    you run from cron (or other schedulers) will have to be updated to now
    provide these options.

new custom file parameters
(2) SUID_SUPPRESS_DOCKER_OVERLAYS=yes
    Yes I got sick of them generating alerts in the reports. If this parameter is
    added to the customisation file for a server alerts will no longer be raised
    for SUID files under the /var/lib/docker/overlay2 filesystem path which contains
    SUID files created for docker containers in directories named for the
    running container id (or more simply, random so always raised unexpected suid
    file alerts. Instead the report will now just say nnn alerts for docker suid files
    suppressed and provide a link to a new page listing all the files that were
    suppressed from the report.
    It only suppressed alerts for files under /var/lib/docker/overlay2, if used
    it has no effect on the reporting for other files.

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.07 and version 0.08 are
-------------------------------------------------------------------------------------
Changes between the two releases are feature enhancements and the obsoleting of 
old custom file parameters previously retained for backward compatibility.
NOTE: customisation file parameter changes require you to update customisation
      files if you use any of the changed parameters in (1) or (2), you should
      have already made changes needed for (3) as 0.07 reported the need for those.

changes to existing custom file parameters
(1) The custom file parameter FORCE_PERM_OK=/path/to/file has been changed to be
    FORCE_PERM_OK=/path/to/file:exactperm where exactperm must be the actual
    file permission expected
    Using the old format (without the :exactperm) will result in the custom file
    entry being ignored so if you used it you will get alerts for the file
    until you update the custom file
(2) The custom file parameter FORCE_OWNER_OK=/path/to/file has been changed to be
    FORCE_OWNER_OK=/path/to/file:userid where userid must be the actual userid
    that owns the file
    Using the old format (without the :userid) will result in the custom file
    entry being ignored so if you used it you will get alerts for the file
    until you update the custom file
(3) version 0.07 has been warning users custom file network parms will be obsoleted
    in 0.08 and users need to update their custom files. The 0.06 and lower parms 
    are now no longer supported

feature enhancements
(4) new processing option '--clearlock' is provided. If you ctrl-C or reboot during 
    processing a logical lockfile will be left behind preventing any further
    processing, this can be used to remove it, if no running process is using the pid
(5) MAJOR NEW FEATURE added a seperate appendix for firewall port checking to report on
    open inbound firewall ports [firewalld and iptables] if iptables is installed on the
    server which are checked against ports that are actualy in use on the server to 
    identify obsolete filewall rules (traffic allowed to a port but the server is not
    using the port). Many servers by default accept everything relying on external
    firewalls so this new report is not necesarily useful there but if you do use
    a firewall on the server itself this is very useful
(6) to fill the gap between all server processing and single server processing a
    new parameter --checkchanged=list|process can be used to list or process
    all datafiles captured and placed in the --datadir directory since the
    server associated with the datafile was last processed. As well as the
    --checkchanged=list option the main index page highlights servers that need
    re-processing for this reason (of course only after a server is processed 
    to refresh the index or a '--indexonly' exection is preformed to rebuild the
    index)
(7) primarily for my use, the collector has a new --webpathlist=/some/file which
    refers to a file containing a list of filesystem paths under which all files
    can be considered static or seldom changing webserver served files that should
    all be read-only. If this option is used on a server when collecting info the
    processing script will automatically process the entries and generate a
    report page for this. If used the server custom file should contain new
    entries ADD_WEBSERVER_FILE_OWNER=userid for each user that owns the files,
    if not provided the default 'apache' will be the only user permitted to own the
    files
(8) main index page - when a single server or 'changed' server processing run is
    done the main index shows the server as 'being processed' insead of the old
    information (if it had already been processed in the past and had a main index
    page entry); for full processing instead of no main index.html until processing
    completes the main index is updated as each server is processed so the user
    has a page with a growing list of server results instead of a page not found

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.06 and version 0.07 are
-------------------------------------------------------------------------------------
Changes between these two releases is primarily to enhance the data captured to
permit features added in 0.06 to be fully utilised.

open network port checks report
(1) collection script:remove requirement for fuser, use a combination of netstat
   output and ps instead as this will capture info that fuser simply could not
(2) collection script:major internal parameter changes to get better
   isolation between data types, this means old collector datafiles
   are not supported so all servers collection scripts must be
   updated and collection run to obtain the new formats
(3) processing script: changed to use the new format collection variables,
   if process info not available falls back to the truncated details
   obtained by netstat
(4) processing script:now we can get process details on raw ports
   implement 'process match ok' and 'port ok' overrides for raw ports
   (identical custom parameters as those for current tcp and udp checks)
(5) processing script: with the above changes we can now report on what 
    processes are using all the unix sockets rather than just listening ones,
    so we do

-------------------------------------------------------------------------------------
Noteable changes implemented between version 0.05 and version 0.06 are
-------------------------------------------------------------------------------------
Changes between these two releases were 'feature' additions.

bug fixes
(1)  processing script:checks added for mail files in 0.05 were inserted in the wrong place,
     those suppressions were being added to the totals of the groupsuppress count ( fixed )
(2)  collection script:was not handling quotes around crontab commands in lines with
     'shell -c' commands when checking job script permissions, now handles those ( fixed )

global - affecting main index page
(3)  collection script: change capture date format from server default to "YYYY/MM/DD HH:MM"
     to make the display size much smaller on the main index page and a fixed size
(4)  processing script: include a processed date column on the main index page, needed now
     individual servers can be processed to indicate if many have not been processed in a while

cron job check enhancements
(5)  collection script:remove attempts to record commands run by anacron files, as they never
     worked and it is too complex for now 
(6)  collection script:check for and record entries in cron.deny and cron.allow 
(7)  collection script:record entries cron job entries we were unable to perform file security
     checks against (due to crontab entry command stacking etc)
(8)  processing script:raise alerts/warnings as appropriate depending on use of cron.deny and
     cron.deny by the server 
(9)  processing script:raise warnings for cron job entries we were unable to perform file security
     checks against (due to crontab entry command stacking etc)

filesystem checks report
(10) processing script:when files are suppressed from the report totals (specifically if group
     write is allowed under /var) add an additional link on the filesystem check page to a page
     where users can see exactly what files were suppressed
(11) processing script:add execeptions for files in /var/spool/cron which can be owned by any
     user existing on the system if they are permitted to use cron and the filename is the
     username, they should not be alerted on

open network port checks report
(12) collection script:for open port details on servers with fuser installed also use
     fuser -n tcp/udp and ps to actually obtain the process listening on the port. The main
     reason for this is to be aware of what processes are litening on a port in cases where
     they cannot be configured to a specific port (for example rpcbind uses random ports so
     cannot be configured as an OK listener currently
(13) collection script: use fuser to report on what process is using a unix socket
(14) collection script: also report on what 'raw' network sockets are in use
     the existing tcp/udp/unix) although alas fuser cannot query what is using them
(15) processing script: use the details from the updated collection script to identify what is
     listening on an unexpected port rather than rely on /etc/services descriptions, still
     allow a user description to be included where provided for known ports. Must still be able
     to handle output from prior collector versions and servers without fuser installed so
     existing processing will be enhanced if additional data is present but old method still
     available as fallback which means we still need to capture the services file entries
(16) processing script:add a new custom file parameter to force a "permitted" process listening
     on an unexpected tcp/udp port into an OK state if using the a new version collector
     produced datafile. This will handle situations such as rpcbind using random ports
(17) processing script:add a new custom file parameter to allow configured network ports
     listening on all interfaces to be considered OK rather than a warning, not a global but
     on a per port basis as listening on all interfaces is insecure but some applications
     require it so this will allow known applications to be forced OK
(18) alter custom file parameters that allow tcp/udp ports to be version specific, in 0.05 and
     below an allow udp 53 would allow both udpv4 53 and udpv6 53 to be valid. This change
     will tighten that up. This change now will also generate a warning alert if the old obsolete
     parameters are used plus also write a list of all server custom files using the old
     parameters on the global results index page

-------------------------------------------------------------------------------------
Older version change history removed as obsolete. Older versions should not be in use
-------------------------------------------------------------------------------------
