How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
As Steve and Avi have asked, you are either referring to passwords for users of a website/web application or passwords for the system. Typical protection for the two options:
Passwords for web application / web site:
Stored in a database which is separated from the web DMZ by a firewall, not on the web server (which is in the web DMZ.) Access control is both on the firewall, and in encrypting the database or hashing the passwords in the database
Passwords hashed in /etc/passwd or /etc/shadow or SAM file or equivalent, and password file has access controls limiting access to root or system accounts only.
There are other options, but these are by far the most common.