Its not a given but it is doable, the main/basic line of defence is using a chroot jail and having nothing in that root of any interest/value. When I get chance I will do a blog post on it.