merlyn started an excellent thread on writing secure Perl code here.

Two things that really ought to be considered when securing a box:

1. Follow your software. You don't necessarily have to follow BUGTRAQ (although it's a damn good idea), but if you don't at least check for security patches every week for your OS and daemons, you're in trouble. The Code Red worm proliferated as widely and as quickly as it did mostly because systems weren't being patched to close the hole it exploited.

   Of course, very few of us have the time to constantly monitor software for available patches and upgrades, evaluate any patches that come along, and install the useful ones in a timely manner. That's where our favourite system-administration language (no, not ksh!) comes along. Some clever work with Mail::Audit can pull interesting-looking BUGTRAQ messages out of the noise for your attention, and a weekly cron job to check the status of your favourite packages from the FreeBSD Ports tree (or Freshmeat, or whatever) can at least spare you the burden of remembering to do it by hand. (When I get a few dozen round tuits, I'll finish and post my stuff.)

2. If you're running an MTA, ferglubsakes make sure that your box isn't an open relay. Open relay abuse isn't as sexy a computer crime as your bog-standard remote root exploit (or VBscript worm), but it is an attack: someone's using your box without your authorization to do (very impolite) things you didn't intend it to do. Make sure your MTA's locked down, and nobody's going to have to blacklist you.

Update: Oh, and flame, flame for using the deprecated sense of hacker.

Update 2: So merlyn didn't provide any concrete, spelled-out "this is a common problem, this is how you solve it" examples in that node, but IMAO the "design for security" mindset is at least an order of magnitude more important than a cookbook approach based on checking off a list of common vulnerabilities. That said, the thread as a whole is more useful than merlyn's node taken by itself -- not the least thanks to cjf's response -- so I've changed the wording a bit.

--
The hell with paco, vote for Erudil!
:wq