Just out of curiosity, what all goes into owning your own server(s)?
Well, in most cases you'd be probing system services to see if they can be exploited. Another common route is probing installed web scripts to see if they can be exploited.
If one gets in via a web script, they can use commands such as "exec" to run items on the OS that are sometimes owned by the apache process which are commonly in a superuser group which cann execute just about anything.
What kind of hardware would that take, what would be a good brand to go with, what OS to run on it, etc.?
Well, any hardware capable of running Linux or Windows 2000/2003 would be acceptable.
As for OS, well, Windows 2000/2003 if you want Windows, or say CentOS for a linux distribution as it's common as a webhost's OS.
Also, is it possible to set up a website on your own server and not pay for hosting? What other expenses go into a website?
Technically, however, I doubt you have the proper bandwidth to support a semi-popular site, or even a traffic surge on a standard residential connection.
Costs? Well, connection if a big one if you have a dedicated server, then the server, domain, maintenance, coding, blah blah blah...
Drak over at HostNuke
is rollling out some really good VPS' now, if you want access to the system you use for hosting to install and manage the server aspect, then a VPS is what I'd recommend (think of it, you can have the versions of software you want, vs what a webhost says they want to give you).