You're missing some basics. For example, I can find out easily what version of Apache/OpenSSH etc you are running (Apache/2.2.11 (Ubuntu) mod_ssl/2.2.11 OpenSSL/0.9.8g mod_wsgi/2.3 Python/2.6.2, OpenSSH 5.1p1). Please turn off the banners that advertise these things. Also, don't run your SSH server off of your Apache box. And use public keys instead of passwords.
You can consult this hardening guide written by the NSA for Red Hat: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf. Even though you're using Ubuntu, the same general principles apply. Follow that guide to the letter and you will be secure enough until you can afford to higher professional pen testers.
Note that the NSA guide doesn't cover web application security, so you'll need to take other steps to ensure that part of your business is secure.
Comments
You're missing some basics. For example, I can find out easily what version of Apache/OpenSSH etc you are running (Apache/2.2.11 (Ubuntu) mod_ssl/2.2.11 OpenSSL/0.9.8g mod_wsgi/2.3 Python/2.6.2, OpenSSH 5.1p1). Please turn off the banners that advertise these things. Also, don't run your SSH server off of your Apache box. And use public keys instead of passwords.
You can consult this hardening guide written by the NSA for Red Hat: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf. Even though you're using Ubuntu, the same general principles apply. Follow that guide to the letter and you will be secure enough until you can afford to higher professional pen testers.
Note that the NSA guide doesn't cover web application security, so you'll need to take other steps to ensure that part of your business is secure.