[CentOS] securing a remotely hosted machine

Hi,

I'm looking to put together a doc for the wiki.c.o on howto secure a 
remotely hosted machine. Its a situation that many of us find ourselves 
in, wherein we either lease or colo a server ( or many ) and there is 
always the issue of remote hands, other facility users etc being able to 
get physical access of the machines. So what are the usual steps that 
people take in order to secure their remote-hosted-servers.

A short list of things that I tend to always do is :

- disable all getty's

- make grub boot imediately with no user interrupt possible

- put sensitive data on a locally encrypted disk

- plumb in a bios password

- have all console redirected to a iLo / drac / ipmi2 device; if there 
is one of those - if not then redirect the output to a non-existing 
ttySX port ( isnt ideal! )

- disable all telnet and http/https access to the ilo / drac interfaces, 
ensure impi is secured.

What other, reasonable, steps should one consider ?

the end result, ofcourse, is to still have the option of handing 
passwords etc to the DC ops should there be a need to actually work on 
the machine remotely. so removing the keyb and display interfaces might 
not be desirable.

- KB