Quite easily done is moving ssh to a non standard port. Similarly force it to use public key only authentication and/or only allow specific users/groups to login. Furthermore fail2ban or similar systems help prevent brute force attacks on ssh.
You can also use something like pound, which is surprisingly easy to configure, in front of your main webserver and let is sanitise everything as it comes in.
I would recommend having a firewall which allows only the bare minimum required, ie. http(s) and ssh, anything else you can set up to port forward through ssh without too much of an issue.
hey, i'm alex i'm also in sydney, if you'd like to talk, see some cool startupy things around sydney, etc. Just send me an email at [email protected] (goes to anybody else here as well)
Hey, i'm alex, one of the cofounders of openondemand.com,
I'd just like to say that we'd all like to hear any suggestions/improvements you guys might have :)
You can also use something like pound, which is surprisingly easy to configure, in front of your main webserver and let is sanitise everything as it comes in.
I would recommend having a firewall which allows only the bare minimum required, ie. http(s) and ssh, anything else you can set up to port forward through ssh without too much of an issue.