Ideally, that machine would have no network connection (as it would be a prime break-in target), and be reported to via null-modem serial cable only.

CNN: Analysis: Linux security