Question: I'm running a server using OpenVZ for a few websites. Nothing in HN except for sshd. A VM for Varnish, a VM for MySQL and a few VMs each for one website (running Apache/PHP). Now I'd like to secure this server, mostly from network attack (I think).

What I should do? I see that I should not install Selinux in HN. Installation of CSF seems complicated (needs a few iptables rule fine-tunes).

Thanks,

Answer: 
Keeping your HN's system up to date and correctly configuring its firewalling rules should suffice. I recommend using Shorewall instead of bare iptables because it's so much easier to read (and hence easier to keep well configured). There's [specific documentation](http://www.shorewall.net/OpenVZ.html) for configuring Shorewall when OpenVZ is present.

Also remember to configure sshd in order to authenticate only through private keys and not with passwords. If you must use passwords, it'd better be good. If you have iLO or similar, tighten it up too.
If using the standard venet automatic ip assigment of OpenVZ distributions (as proxmox) you need separate CSF / firewalls on host and virtual machines. This is, depending on your hosting or network config your venet IPs assigned to VMs are not necesarilly be protected.
We use Proxmox PVE and install separate CSF on host and each VM with a public IP.