diff --git a/aaa_base-13.2+git20170308.c0ecf2e.dif b/aaa_base-13.2+git20170308.c0ecf2e.dif
new file mode 100644
index 0000000..9e2733d
--- /dev/null
+++ b/aaa_base-13.2+git20170308.c0ecf2e.dif
@@ -0,0 +1,41 @@
+--- aaa_base.post
++++ aaa_base.post	2017/03/16 14:44:45
+@@ -175,7 +175,6 @@
+ done <<EOT
+ /root/.bash_history root:root 600
+ /var/log/lastlog    root:root 644
+-/var/log/faillog    root:root 600
+ /var/log/wtmp       root:utmp 664
+ /var/log/btmp       root:root 600
+ /run/utmp       root:utmp 664
+--- aaa_base.pre
++++ aaa_base.pre	2017/03/15 21:57:51
+@@ -34,26 +34,14 @@
+ #
+ mkdir -p /etc
+ mkdir -p /var/adm/fillup-templates
+-echo "root:x:0:0:root:/root:/bin/bash
+-lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
+-mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
+-wwwrun:x:30:8:WWW daemon apache:/var/lib/wwwrun:/bin/false
+-ftp:x:40:49:FTP account:/srv/ftp:/bin/bash
+-nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash" \
++echo "root:x:0:0:root:/root:/bin/bash" \
+  > /var/adm/fillup-templates/passwd.aaa_base
+ 
+ echo "root:x:0:
+-sys:x:3:
+-lp:x:7:
+-www:x:8:
+-mail:x:12:
+ shadow:x:15:
+ dialout:x:16:
+ utmp:x:22:
+-ftp:x:49:
+-users:x:100:
+-nobody:x:65533:
+-nogroup:x:65534:nobody" > /var/adm/fillup-templates/group.aaa_base
++users:x:100:" > /var/adm/fillup-templates/group.aaa_base
+ 
+ rm -f /var/adm/fillup-templates/shadow.aaa_base
+ while read LINE ; do
diff --git a/aaa_base-13.2+git20170308.c0ecf2e.tar.xz b/aaa_base-13.2+git20170308.c0ecf2e.tar.xz
index 2213cd2..c2aab92 100644
--- a/aaa_base-13.2+git20170308.c0ecf2e.tar.xz
+++ b/aaa_base-13.2+git20170308.c0ecf2e.tar.xz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:3d602a3ae064ada9c8b897d10113e8717ebb02af7fb9701978d85883e6d28edc
-size 80404
+oid sha256:b16b22de97ff001b0441f3c42ec8d7317112cc6111bc30719d41c0690798af65
+size 83040
diff --git a/aaa_base.changes b/aaa_base.changes
index d4fe059..9aaa090 100644
--- a/aaa_base.changes
+++ b/aaa_base.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Thu Mar 16 15:33:37 CET 2017 - kukuk@suse.de
+
+- Remove users and groups mail, lp, wwwrun, ftp and nobody
+- Remove group sys
+- Don't create /var/log/faillog [bsc#980484]
+
 -------------------------------------------------------------------
 Wed Mar  8 09:11:59 UTC 2017 - werner@suse.de
 
diff --git a/aaa_base.spec b/aaa_base.spec
index f2cb18b..408e507 100644
--- a/aaa_base.spec
+++ b/aaa_base.spec
@@ -56,6 +56,7 @@ Source:         aaa_base-%{version}.tar.xz
 #
 Source1:        README.packaging.txt
 Source99:       aaa_base-rpmlintrc
+Patch:          aaa_base-13.2+git20170308.c0ecf2e.dif
 
 %description
 This package installs several important configuration files and central scripts.
@@ -84,6 +85,7 @@ installed by default as it may degrade performance.
 
 %prep
 %setup -q
+%patch
 
 %build
 make CFLAGS="$RPM_OPT_FLAGS" CC="%{__cc}" %{?_smp_mflags}
@@ -169,7 +171,6 @@ rm -f /root/.gnupg/secring.gpg.aaa_save
 # don't forget to also change aaa_base.post, boot.cleanup
 # and /etc/permissions!
 %ghost %attr(0644,root,root) %verify(not md5 size mtime) /var/log/lastlog
-%ghost %attr(0600,root,root) %verify(not md5 size mtime) /var/log/faillog
 %ghost %attr(0664,root,utmp) %verify(not md5 size mtime) /var/log/wtmp
 %ghost %attr(0600,root,root) %verify(not md5 size mtime) /var/log/btmp
 %ghost %attr(0664,root,utmp) %verify(not md5 size mtime) /run/utmp