It's too long to post here. A good read if you're not locked down.
http://www.securityfocus.com/columnists/334/1