Security issues...

... I am building a box for a firm that wants IMAP, POP3, Apache, SQwebmail, VPN. I am working on the documentation and setting up the components. Are there any hints and ideas you gurus may have that may point me in a good direction so that I may build this correctly. Security is a big concern. I would like to shut down everything that is not needed, and maybe use a piece of software to make the rules for which ports are allowed and whatnot. I am a newbie to this and have learned quite a bit up until now, but am entering unfamiliar territory. Any help is greatly appreciated.