I've read i should unset the suid sgid bits on binaries that do not need them. They gave the commands to find the files, but no information on which need the suid bit set. Here is my list, which files should have the suid removed? The machine is acting as a web server.

trimmed output of
find / -perm -4000 -ls

/sbin/unix_chkpwd
/sbin/pam_timestamp_check
/sbin/pwdb_chkpwd
/bin/su
/bin/ping
/bin/traceroute
/bin/ping6
/bin/traceroute6
/bin/mount
/bin/umount
/usr/kerberos/bin/ksu
/usr/libexec/openssh/ssh-keysign
/usr/sbin/usernetctl
/usr/sbin/userhelper
/usr/bin/sg
/usr/bin/sudo
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/crontab
/usr/bin/chsh

here for the guid
find / -perm -2000 -ls
root root 11379 Aug 13 01:10 /sbin/netreport
root postdrop 148596 Aug 12 15:07 /usr/sbin/postqueue
root lock 15372 Apr 4 2006 /usr/sbin/lockdev
root postdrop 132200 Aug 12 15:07 /usr/sbin/postdrop
root tty 10124 Aug 12 12:33 /usr/bin/write
root slocate 38548 Aug 21 2005 /usr/bin/slocate
root tty 9752 Aug 21 2005 /usr/bin/wall
root mail 14636 Feb 21 2005 /usr/bin/lockfile

This isn't quite what you asked but I think you are implying it. If you want to learn about hardening a system, I would suggest you look into the Bastille hardening program. This program steps you through various things you might want to consider (including unsetting setuid/setgid bits on some software, IIRC) to harden your system. Its objective is as much to educate the sysadmin as to actually lock down the system. That is because they view a knowledgable sysadmin as an essential part of security.

As far as the list you posted, of the programs I recognized, most of them probably need the mentioned bit set if a normal user is to able to use that program. So the question would be, which of those programs do you think you could do w/o, at least as a normal user. (Ping and traceroute strike me as possible candidates.)