I refer you to the answer to this question, and will copy relevant parts below. I've also added a section or two at the end.
Choosing a strong passphrase
Yes, we've all heard it time and time again, but there is probably no easier way to improve your security. If you're a fan of passwords, make sure to choose something that contains enough entropy to be reasonably secure, while still being easy to memorize. A random series of letters and numbers is great, but you probably won't be able to memorize a very long string of them. Anything that includes personal information should also be avoided. Mixing your name with your birthdate is not secure, no matter how long and random it might look.
Personally, I'm a fan of pass phrases. Pick a few random words from a dictionary (I choose somewhere between 5 and 10 depending on the required ammount of entropy), and you've probably generated enough entropy to keep an attacker guessing for much longer than will be practical (see the XKCD on the topic for a laugh).
Other people prefer to use pass-sentences. While these may be longer than your typical passphrase, they may or may not be anymore secure.
For more information on passphrases and passentences see, `Linguistic properties of multi-word passphrases' by Bonneau and Shutova of the University of Cambridge [PDF], or their blog post on Light Blue Touch Paper.
Install security related updates
Actually, if you're running anything make sure you've got the latest security updates. Simply turning on Automatic Updating in Windows, or making sure to run updates often in Linux can go a long way towards keeping you safe.
If you're using SSH to access your computer remotely, make sure to turn it off for the root account, and always use public key authentication. Other things you can do include disabling protocol 1, allowing only certain users to login remotely, and disabling X-forwarding (depending on your requirements). For more info, see this article on the CentOS wiki.
If you've setup a website that you'll be logging into (admin interface in a CMS for instance), always login over SSL (eg. make sure your browser says ``https://"). It's possible to buy a certificate for a reasonable price (I like Rapid SSL) or you can generate a self signed certificate and use that.
Just to rehash my comment on the original post, social engineering is always possible. Never assume that you won't be vulnerable. Chances are you won't fall for the obvious stuff (an email from your colo provider asking for the root password to your machine, etc.), but even something as trivial as where your machine is hosted (maybe you give your address out on a form for something completely unrelated to some guy you randomly met in a coffee shop) can be very useful to an attacker.
Logging in remotely via a wireless access point? Make sure it's using WPA2. WEP and plaintext connections are a no. If it's your own access point (maybe even on the same network as your server, though I'd hope not) make sure to choose a strong password (see above).
Security through obscurity is not security
As someone else pointed out, security by obscurity should never be seen as a security measure. The second of Kerckhoffs' six design principles for military ciphers states:
It [the algorithm] must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience
This is applicable to much more than encryption algorithms, however, and should be taken as a general rule in any form of security engineering.
This principle is also known as Shannon's maxim after it was rephrased more simply by Claude Shannon as, "The enemy knows the system."