Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you when purchasing a VPS.
I've seen flawless server setups fall to their knees because people have broken into the admin panel, and then fired up a local KVM shell.
My question for you, is the following: Is it possible to limit command line access to SSH sessions only? E.g. Disabling all Local + KVM logins.
I'd much rather the only access to be via key-based SSH logons.