http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2...
and TLDR version: http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731....
It is starting to get a little bit dated (RHEL 5 is quite old), but general rules still apply and usually they explain their reasoning.
This isn't clear. Are you saying you think automating these updates is good or bad?
> 5) Avoid storing anything that makes you a particularly desirable
Well, in some cases your user's uid and pwd is the most valuable chunk-o-data a would be attacker wants.
> Most extensive security procedures contain a lot of questionable advice
List?
> and few will prevent human error which most compromise can be traced back to.
I think this would be the power of having a canonical auto-provision script on Github that many can review and contribute to. The script could certainly take the form of sections that could be commented out as needed. In other words, a well documented and reviewed set of recommendations that someone could edit based on pier-reviewed information in the comments and then use to automatically configure a server. That, I think, could be of value.
Most extensive security procedures contain a lot of questionable advice and few will prevent human error which most compromise can be traced back to.
The only semi-universal list amounts to 1) use keys for ssh
2) block/turn off everything except your (web) service
3) automated security updates or some sort of failsafe procedure to install security updates very regularly (this is by far the most common error)
4) Learn about web application security threats especially sql injection and consider them at design and implementation and have some kind of regular review (this can be very difficult to get right)
5) Avoid storing anything that makes you a particularly desirable target like bitcoins or secret defense plans as anything can be hacked with enough incentive.
Most everything else probably won't make too much of a difference to you.