My attack surface on that particular machine is sufficiently low (everything off except keyed SSH and nginx) and the machine's duties so minor that I don't bother.