Sealed Server

[jekillen]

Hello;
I am planning on setting up Cyrus on a machine
and the documentation says that it is intended'
for use on 'sealed' servers (servers for which there
are no accounts that can log into the system)
However:
If I use ssh to administer the system, I have to
set it up so I can ssh directly to root, right.
and
Since there are references to use of MySQL
and the MySQL user is set up as a normal
user with a login/pwrd,
How do I get around that? (have MySQL
running on a different machine, or something?)
Please forgive my lack of sophistication on this
issue, I am learning.
(I have also been looking at Dovecot)
I have assembled some documentation on this
but have not found a direct answer, thus the
query here.
system uses Postfix on FreeBSD 6.2
One FYI that may be of interest:
I had my own dns servers listed in
resolv.conf before the isp's dns servers
and messages sent from this machine
(FreeBSD w/Postfix) were failing to deliver
  to jekillen at prodigy.net due to dns lookup failures.
So I changed the order in resolv.conf (listing isp dns
servers first) and the messages were then delivered.
I  thought that if one server could not respond with
enough info, the next server would be tried until one
was successful (making order insignificant).
Thank you for any info;
Jeff k