secure host or firewall

[Neil Ratzlaff <Neil.Ratzlaff () ucop edu>]

We have a machine that is used as a public web server, mail server, and a
few more things.  Am I better off securing the host by only listening to
the desired ports, or using a firewall to allow only those ports through to
the host?  I know the obvious answer is both, but what are the pros and
cons of one versus the other if I can do only one?

Thanks for any advice