CentOS

There's also been an article on O'Reilly Network on how to build your own repo with patches already applied:
http://www.linuxdevcenter.com/pub/a/linux/2005/02/17/kickstart_updates.html

The "firewall" GUI is indeed pretty limited. You can only "open" ports globally there. The /etc/hosts file is not such a good idea IMHO, because not all services read this file. You should take a look at the IPTables documentation and tutorials at http://www.netfilter.org and add use a custom iptabl...

There are a couple of httpd-related SELinux options (so called "booleans"), e.g. "httpd_enable_homedirs", which allows Apache to read user's public_html directories. It is off by default, afaik. Perhaps you need to enable it? You can get a list of all options with
# getsebool -a

If you're running a web server, you should make sure you run no vulnerable php/perl whatever- CGI applications. The next thing to check is if you have user accounts with weak passwords (name == password or similar) that can be exploited via ssh.