Theoretically if you keep your system up to date with all the latest security patches daily, and you expose the minimal ports necessary to the internet and you use encryption and good passwords you should be pretty safe but still *anything* connected to a network can potentially be cracked. You just have to make it as difficult as possible by minimizing the risk.
You have done one of many pieces of the security puzzle. You have reduced the number of services you have running to a minimum. Although important, I believe it to be slightly less important than having a good firewall that reduces the number of open listening ports to the internet. The best number to have would be "0". Have someone nmap your external address and see what ports are exposed. For instance if you nmap me you will see that my port 80 is exposed (voidmain.is-a-geek.net/Apache) and you might also see that port 22 is in the "filtered" state. Nothing else should be open.
That means no matter how many services I have running on any of my machines behind that firewall, if someone were to break in from the internet they would have to do it through Apache. They could also try and spoof an IP address to the one that I allow in on ssh but it would be highly unlikely that they would be able to figure out which source IP address(s) I allow to come through my firewall. Even if they were to figure out which address(es) I allow in via ssh, successfully doing anything over a spoofed address would be extremely unlikely.
Now, since Apache is the most exposed service, I put the machine that it is running on in a separate network called a "DMZ" which is connected to a 3rd Ethernet inface on my firewall. The reason I put it into a (DMZ) is so if someone were to actually break into that machine via an Apache exploit or misconfiguration, they will still not get to the rest of the machines behind my firewall in my private network. It's almost like having multiple firewalls. Having it in the DMZ also allows me to expose more services on the machine that can only be used from my other machines on my private network. Usually the access level logic for a 3 interface firewall go something like this:
Internet -> Private network - No Access
Internet -> DMZ - Minimal Access
DMZ -> Private network - No Access
DMZ -> Internet - Minimal Access
Private Network -> DMZ - Anywhere from Minimal to Full Access (various reasons)
Private Network -> Internet - Anywhere from Minimal to Full access (various reasons)
Obviously, the closer you can come to "No Access" in all of the above areas without it being too painful then your security increases.
As far as your question about gaining root. There are several ways of becoming root on a machine, but if your services are all up to date with the latest security patches (no known holes) *and* you have them properly configured, and you use good password security for any service that you have exposed that allow logins then there shouldn't be much of a chance of gaining root remotely. Of course if they can gain local user access their chances of gaining root increases because they could try and gain root via a local exploit (again keep your system up to date). And lastly, if they have physical access to the machine then getting administrative access on any machine regardless of OS is fairly trivial.
The third/fourth big pieces of the security puzzle that work from the other end is good logging and intrusion detection. The best logging is to have a separate log server where all of your machines log to remotely. This prevents a cracker from wiping out the logs on the machine they gained access to and makes it easier to hunt them down. Intrusion detection can detect unusual network events and alert you that someone is trying to do something fishy like trying to hack into your system (see "snort" and "acid").
But when it comes down to it, I am convinced that every program on every operating system is vulnerable. Hopefully the good guys find the vulnerability before the bad guys and you can fix it before the bad guys can exploit it. You'll know what needs to be done if you think like that (paranoia is under rated).
I know you were looking for a short answer, but that question didn't have a short answer. I guess if you asked the question "Is my Red Hat 9 box fully secure?" and wanted a short answer I would have to say "no". But that is the answer I would give to anyone that asked that question about any computer running any operating system and any software. And it would be the correct answer.
Now, if you do all of the things I mention above, you will be more secure than 99% of the rest of the internet. 90% of the internet can be exploited trivially. If you don't believe me see:
http://voidmain.is-a-geek.net/spam/
http://voidmain.is-a-geek.net/codered/
Odds are, if they can't break into your system easily, they will move on to another system that *is* easy to break in to. There are plenty of them out there. But then if someone wants to target you directly they may spend more time trying. That's where the intrusion detection system comes in handy.
Hope this helps in some way...
