How do you handle server security/intrusion monitoring?
jhancock: 1 - use a minimal server base install.  start with a linux/bsd install that has as little running as possible for your needs.  I've found both ubuntu-server and FreeBSD work for me.2 - Install things that you understand.  I don't install large meta-packages.  I also install most things from source: nginx, ruby, gems, postgresql.  All these things make/install without much effort.  When compiling, only include options you need.3 - Lock down SSH. Login only with SSH keys, protocol 2.  Also, change your sshd port to something less likely to be scanned.  This way, your SSH log files won't have too much garbage in them and you actually can check them with little effort.  You can find lots of tutorials on locking down ssh.4 - Document _everything_.  If all else fails, your docs enable you to recreate your server environment within a few hours.If you do all this correct, when you upgrade your server, e.g.: apt-get upgrade, you will only be upgrading basic distro stuff, mostly security updates.oh yeah, _little_things_ like making sure your ruby/blub app processes are connecting to your db with an "app" id instead of an "admin" one is a choice decision ;).