See also:

http://www.debian.org/doc/manuals/securing-debian-howto/ch4.en.html#s4.9