It is very easy to write bad crypto with PyCrypto (it is an interface on pretty much the same level as OpenSSL). As a Python developer, you have access to Keyczar, which is what you should use instead of PyCrypto. The number of questions you'd have to address about your PyCrypto cryptosystem to make that point an asset instead of a liability (to savvy readers) is too large for the page you're trying to write.
You've exposed SSH to the Internet? Your SSH endpoints have routable IP addresses? How many of them do you have? If you've deployed this on EC2, you'd be better off moving all your admin to a VPN connection, so that any server you'd SSH into has a 10-net address.
Comments
It is very easy to write bad crypto with PyCrypto (it is an interface on pretty much the same level as OpenSSL). As a Python developer, you have access to Keyczar, which is what you should use instead of PyCrypto. The number of questions you'd have to address about your PyCrypto cryptosystem to make that point an asset instead of a liability (to savvy readers) is too large for the page you're trying to write.
You've exposed SSH to the Internet? Your SSH endpoints have routable IP addresses? How many of them do you have? If you've deployed this on EC2, you'd be better off moving all your admin to a VPN connection, so that any server you'd SSH into has a 10-net address.