I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). I'm pretty broke so I can't afford a managed server.
I downloaded Ubuntu Lucid Server and have it running in a VirtualBox, to help me learn and to act as a close approximation to the eventual production server. I'm committed to learning, but I'm pretty afraid I'm going to miss something dumb and get compromised. As such, I'd like to know of any good guides/books explaining the main points of securing a LAMP server.
I've worked through the basic stuff in Linode and Slicehost's respective tutorials, but I want to be as prepared as possible. The site isn't written yet, and I'm likely to deploy to a shared host first as a trial run, so I do have time to learn at least the basics.
I know to keep everything up to date, configure iptables to only allow the holes I need (which appears to just TCP ports 22, for ssh/scp/sftp - I'll change it from the default port for the (very minor) security through obscurity bonus - and 80 for http) - though I am confused by some tutorials which say to block ICMP since I don't why I wouldn't want to respond to ping - and to only install software I need/remove software I don't need.