gore, I should have stated that more clearly. I can "get in through a back door" by running a PHP script that lets me enter shell commands through a browser. It doesn't let me do anything without entering the proper username and password. Anyone else who wanted to use it would need the Linux credentials, too.

For extra safety I remove this script from the server when I'm not using it. Of course, someone who can get defeat FTP security can put it on the server himself if he wants to. He'll still have to get through Linux security, though.