Have a read: http://mako.cc/copyrighteous/google-has-most-of-my-email-bec...
As with all homebrew things, it is possible. The only caveat is the time spent hardening the server, and time is always against us, my friend.
As with all homebrew things, it is possible. The only caveat is the time spent hardening the server, and time is always against us, my friend.
Origin Shield: You don't want the raw IP of a box anywhere near the public Internet. Attackers can scan for IPs if they want an IP, but they should never have to simply ping a server and its IP is in plain sight.
Auto-update: The box should respond to the current threat landscape. There was a massive uptick in sysadmins logging into old and forgotten boxes when Heartbleed came out. You want to be able to auto-patch and very rarely (if ever) SSH into a box.
Those are just two of the things I've learned the hard way recently, and yeah; they're probably obvious low hanging fruit stuff. But the list goes on...