Some advanced security hints

Use tcpwrappers

Use tcpwrappers to limit exposure of services to the Internet. For instance, set up tcpwrappers to only allow services to be used from a very strict number of places eg

/etc/hosts.allow

ssh: 192.168.2.

/etc/hosts.deny

ssh: DENY

Consider where you will be connecting from, for instance within a netblock, within NZ, or not from korea and configure tcpwrappers accordingly.

Change offsets

use

preload -R

which randomises offsets of libraries, making more exploits fail. Not a great help, but worth a try, every bit helps. As a nice side effect, dynamic linking time is improved too :)

Prevent system accounts using networking in unauthorised ways

use iptables(8) stateful firewalling to disallow incoming connections to ports that aren't explicitly allowed by the administrator, but still allow ftp etc through. Thus exploits which open a rootshell on port 6666 will fail, as incoming connections to port 6666 will be firewalled.

use iptables(8) uid matching to disallow outgoing connections from system accounts. This prevents exploits from downloading more stuff (such as a local root exploit to get root) and is usually a very good indicator that your box is compromised and can be used to generate automatic notifications.

iptables --insert OUTPUT --jump DROP -m state --state NEW --uid-owner www-data

(note, check the above line, I've not tested it, although I've used the principle before).

Remember to allow system accounts access to things such as SMTP on the local machine, and DNS if they require them. If you're running web mail, you'll also need access from the web server to imap for instance.