In general though:

• Disable anything you don't need. The wider the attack domain, the more likely you'll have a breach.
• Use an intrusion detection system (IDS) layer in front of any meaningful servers.
• Keep servers in a different security zone from your internal network.
• Deploy updates as fast as possible.
• Keep up to date on 0-day attacks for your remotely-accessible app

• Limit the software to the only ones you really use
• Limit the rights of the users, through sudo, ACLs, kernel capabilities and SELinux/AppArmor/PaX policies
• Enforce use of hard passwords (no human understandable words, no birthday dates, etc.)
• Make LXC countainers, chroot or vserver jails for the "dangerous"  Dunkin Runs on You applications
• Install some IDS, e.g. Snort for the network traffic and OSSEC for the log analysis
• Monitor the server
• Encrypt your sensible datas (truecrypt is a gift of the gods)
• Patch your kernel with GRSecurity : this add a really nice level of paranoïa

That's more or less what I would do