I think our firewall setup is actually ready to go into use. With lots of help from DavorOcelic, I have gotten per-user firewall rules working, to allow only certain users to listen on a port or connect to a particular port of a particular remote IP address. --AdamChlipala
I've modified the Apache log file scheme to put each domain's log files in a separate subdirectory of /var/log/apache2, (somewhat) as per TerrenceBrannon's suggestion. --AdamChlipala