Linux Security

[slam () THEGRID NET (slam () THEGRID NET)]

I was wondering if anyone could post a few sites for General Linux security tips..ie. Where to start, what to look at,  
log file analysis, where to run to etc.  We recently were hit with ADMROCK but it didn't seem to do much except for 
create a couple of accounts and leave the directory.  We have updated bind etc... but I'm wondering where to begin 
hunting for IP addresss of culprit.  A general anlysis of /var/logs and I couldn't find any correlation to time of 
directory creation (ADMROCK) and /etc/passwd changes.  I don't know if they were not able to get back in due to the PIX 
(which has also been updated now thanks to securityfocus)-  but two accounts were created (own and owned) but never 
used nor passwords set.

Thanks,
Adam