PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into their firewalling solutions, and also because they've been indoctrinated to believe in their necessity.
However, I'm looking for answers from people who are experts in security. I believe that this is an important question, and the answer will benefit more than just myself and the company I work for. I've been running our server network for several years without a compromise, without any firewalling at all. None of the security compromises that we have had could have been prevented with a firewall.
Edited to add: I guess I've been working here too long, because when I say "servers", I always mean "services offered to the public" not "secret internal billing databases". As such, any rules we would have in any firewalls would have to allow access to the whole internet. Also, our public-access servers are all in a dedicated datacenter separate from our office.
Someone else asked a similar question, and my answer was voted into negative numbers. This leads me to believe that either the people voting it down didn't really understand my answer, or I don't understand security enough to be doing what I'm currently doing.
This is my approach to server security:
Follow my operating system's security guidelines before connecting my server to the internet.
Use TCP wrappers to restrict access to SSH (and other management services) to a small number of IP addresses.
Monitor the state of this server with Munin. And fix the egregious security problems inherent to Munin-node in its default configuration.
Nmap my new server (also before connecting my server to the internet). If I were to firewall this server, this should be the exact set of ports incoming connections should be restricted to.
Install the server in the server room and give it a public IP address.
Keep the system secure by using my operating system's security updates feature.
My philosophy (and the basis of the question) is that strong host-based security removes the necessity of a firewall. Overall security philosophy says that strong host-based security is still required even if you have a firewall (see security guidelines). The reason for this is that a firewall that forwards public services to a server enables an attacker just as much as no firewall at all. It is the service itself that is vulnerable, and since offering that service to the entire internet is a requirement of its operation, restricting access to it is not the point.
If there are ports available on the server that do not need to be accessed by the whole internet, then that software needed to be shut down in step 1, and was verified by step 4. Should an attacker successfully break into the server through vulnerable software and open a port themselves, the attacker can (and do) just as easily defeat any firewall by making an outbound connection on a random port instead. The point of security isn't to defend yourself after a successful attack - that's already proven to be impossible - it's to keep the attackers out in the first place.
It's been suggested that there are other security considerations besides open ports - but to me that just sounds like defending one's faith. Any operating system/TCP stack vulnerabilities should be equally vulnerable whether or not a firewall exists - based on the fact that ports are being forwarded directly to that operating system/TCP stack. Likewise, running your firewall on the server itself as opposed to having it on the router (or worse, in both places) seems to be adding unnecessary layers of complexity. I understand the philosophy "security comes in layers" but there comes a point where it's like building a roof by stacking X number of layers of plywood on top of each other and then drilling a hole through all of them. Another layer of plywood isn't going to stop the leaks through that hole you're making on purpose.
To be honest, the only way I see a firewall being any use for servers is if it has dynamic rules preventing all connections to all servers from known attackers - like the RBLs for spam (which coincidentally, is pretty much what our mail server does). Unfortunately, I can't find any firewalls that do that. The next best thing is an IDS server, but that assumes that the attacker doesn't attack your real servers first, and that attackers bother to probe your entire network before attacking. Besides, these have been known to produce large numbers of false positives.