freeBSD 6.2 is quite good and stable now.
but freeBSD 7 will be new milestone for freeBSD as this release made many changes nowadays. Hope the time release i can use it to setup a production server.

I see many companies using Solaris. Many jobs in Solaris. Thinking of getting experience is Solaris just in case I need a Solaris job. Is Solaris very stable for a server?
Is Solaris server the way to go? Anyone here have a solaris server?

Solaris is a good server as well, although with presently less hardware support (for non-Sun hardware). I think the trend that's happening now is servers migrating from Solaris to Linux though, and migrations from Sun's hardware to more generic Intel-types.

Solaris, Linux, *BSD....they're all good. They're also quite similar, so whatever you end up choosing, you will end up with a lot of skills that transfer over nicely to any of these OSes.

Use apache webserver with mod_dosevasive and mod_security

Keep phpBB and all other apps updated continually. watch your logs.

If the provider prevents you from doing any blocking at kernel level, that limits you terribly, as you aren't going to realize a problem until it is too late.

Have provider block all ports but 22 25 80 110 and drop all invalid packets (probably already done).

I'd recommend finding a hosting provider that allows you to use kernel level firewall tools, and also will add rules to the gateway router.

From what I've seen, a fresh machine on a new domain has about 200 distinct IP addresses trying every script in google against it.

Make sure it is configured as well as it can be and dump all non-used services, and keep up to date with PHP updates. There has been an exploit discovered and patched between the time you made your post and this post.

One note on RKhunter... It should not be directly installed on the system. A read-only file system like a CD is best.

You might also want this: http://www.chkrootkit.org/

dont use phpBB cause too many bugs..

If you do go with Linux, this is worth looking at also: http://www.bastille-linux.org/

I take it that you mean a self-made-buggy version of Ubuntu (because those I've installed have seemed to me very stable). Debian being more stable than anything else is a too much grown legend, there are others that are as good or even better. If I was to pick up a Debian-based server, it wouldn't necessarily be Debian itself; I'd rather not pick up such a geeky test distribution at all, though, but something that really works.

Firestarter is a graphical front-end to controlling iptables. If you're an admin you should be ok with command line and scripts, and that way more comfortable with iptables (the command-line tool). It's just as real-time as Firestarter is (type in an iptables command and it's effective from the moment you press ENTER), but doesn't waste space from your screen like GUI programs do. I consider Firestarter a newbie tool, just like webmin. No offence, they're both useful if you like them, but they hardly ease up the life of a person who knows the things.

My first advice of securing a server is to prevent access to it, except what is vital. That means locking it up someplace where there's no access without boulder traps, molten lava and some poisoned spears, for a start. Second step is to make sure you have a reliable backup system working, and that you test the backups every once in a while. Backups are a measure of security people forget when they're hunting rootkits and mean russian crackers; more probably than them you'll get a lightning strike that burns the house down to ground, and without backups you've got problems. So back up the important data (at least), have several backups (from the past few days, from last week and last month for example, so if you find out some of the latest backups are corrupt or have backed up compromised system files, you'll have older working copies too) and store them away from the server itself.

Did I already mention to test the backups? If you only have a DVD+-RW disc that you overwrite every day, you might find it's not working when it should. You might have a dozen tapes with backups and live happy, get your server burnt to death and find out that for some odd reason the backups don't work.. A good habit is to have a test-environment to which you drop the backups and see if the process goes all right. Do that often enough to make sure at least part of your backups actually work. In my work I see too much people who boast having a million-dollar backup system and three admins taking care of it, but never test the media; a few months ago one server caused major trouble being trashed, after the "admins" found out their seven backup tapes were just garbage (not to mention the server that was recently replaced; it had happily "made backups" for two years, luckily without a single accident, before somebody found out there had been a permissions problem and all the tapes were actually empty).