Security checklist/howto:

CERT UNIX security checklist:
http://www.cert.org/tech_tips/usc20_full.html
Linux security checklist:
http://www.wfu.edu/~rbhm/linux.html
SANS institute securing solaris paper:
http://rr.sans.org/unix/sec_solaris.php
Linux security:
http://www.linuxsecurity.com
Linux security HOWTO:
http://www.tldp.org/HOWTO/Security-HOWTO.html
Securing UNIX, part 1 with links to 2:
http://www.boran.com/security/unix1.html
Matt's UNIX security page (tons of links, not updated recently)
http://www.deter.com/unix/
NewOrder. Goes without saying.
http://neworder.box.sk/
Insecure. Why hasn't this been in here from the start?
http://www.insecure.org
Check for rootkits...
http://www.chkrootkit.org

General documentation:

The Linux documentation project:
http://www.tldp.org/

Routing and firewall docs:

Linux advanced routing and traffic control HOWTO:
http://lartc.org/HOWTO//cvs/2.4routing/2.4routing-howto.html
Linux firewall and proxy HOWTO:
http://www.tldp.org/HOWTO/Firewall-HOWTO.html
Linux rootkit checker:
http://www.chkrootkit.org/

www, CGI and scripting:

Small faq on cgis:
http://hoohoo.ncsa.uiuc.edu/cgi/security.html
The WWW security faq:
http://www.inet.co.th/security/www-security-faq.html#contents

User and system accounts:

See the first link at the top, section 5. 
Also, some of the sans links have nice explinations of accounts.

Live checks:

Tripwire:
http://www.tripwire.org
aide:
http://www.cs.tut.fi/~rammer/aide.html
afick:
http://afick.sourceforge.net

Hash functions:
The MD5 specification, RFC 1321, is available at
http://www.ietf.org/rfc/rfc1321.txt

The SHA-1 specification, RFC 3174, is available at
http://www.faqs.org/rfcs/rfc3174.html

The SHA-256 specification, FIPS 180-2, is available at
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf

The Tiger specification is available at
http://www.cs.technion.ac.il/~biham/Reports/Tiger/

The Whirlpool specification is available at
http://planeta.terra.com.br/informatica/paulobarreto/WhirlpoolPage.html
