Debian + ISP + Apache

[Francisco Javier Fabra Caro <jfabra@unizar.es>]

Hi all,

I've installed recently Debian Sarge in a machine for ISP purposes.
Now, my question is:
     - What should I manage using packages and what should I manage
     using source code?

Concretely, I have installed the mail service using packages, but now
I have to install the FTP service using proftpd + mysql and the httpd
using Apache. Do you know any how-to or guidelines to install a
VERY-SECURE http service? I mean, making that users can't access to
the filesystem using a php script, for example..

Thanx in advance.

Cheers!

  fabRiX