Tri - SELinux in enforcing mode is the default. Take a look at post #7.

If users want files to be saved permanently, they should not be saving them in /var/tmp. We do recreate /var/tmp as a soft link under /tmp. This prevents users from creating hard links under /var.

Thanks!

Thanks Dimitar!

Thanks - If only I could find the time to post more - the job that pays the bills has been getting in the way of late.

Mudgen, CIS used to post two scripts: do-backup.sh and do.restore.sh. The intention of the first was to backup any configuration files that might change in the hardening process and the other was obviously to restore them should things not go as expected. The stepwise scripts were never supplied by CIS but simply listed in their Adobe document. I simply cut and pasted them into scripts (resolving the end-line character issues that method creates). So yes, these scripts are right from CIS. The stepwise scripts make the hardening changes and then perform a diff between the updated file and the backup created by do-backup.sh so you can more easily see what the script did. One of the first things I noticed as I started the process was that the do-backup.sh script had errors: missing spaces between file names and missing files. I think this is why they no longer post it on the CIS website. The do-back.sh that I post in Step 3 of this series has those errors corrected. So yes, this is the CIS script but corrected so it works as CIS intended. Finally, I am working through this stepwise as well in what little spare time I have and I have not completed the process. Therefore, there may be errors in do-backup.sh that I have yet to uncover as I am only about half way through as of this writing. My last post was on Chapter 5 from the CIS document (System Network Parameter Tuning). My next post will be starting at Chapter 6 (Logging).

Thanks Tom - let's call it even as we'll be sure to use this going forward.

Tom, We have not found a way around the loss of .apachectl -configtest and in fact are no longer even using Oracle on the middle tier for our latest gig. On the downside, we're using WebSphere, on the upside, we jettisoned the IBM HTTP Server (IHS) in favor of compiling our own Apache 2.2 and we then use the F5 Local Traffic Manager for load balancing both the web and app tiers. This let us also eliminate the rather cheesy WebSphere plug-in that IBM uses to load balance the app tier. However, there may be Oracle Exalogic in our future so we'll find ourselves back in the same boat as you. Removing the macros might not be so bad as long as the Oracle patches are not freaking out about it. You might have to keep the macro versions around just for patching which starts to become a real pain.

I can walk you through that but I have a few clarifying questions? Is this Oracle 10.2.0.4 or 10.2.0.5? Is the platform x86, x86-64 or SPARC 64-bit? Since you are asking about a minimal install, I assume you do not want any of the advanced features like RAC, Data Guard, etc., correct?

This is a great idea Brian. Then we can just pass the http-server start-parameters within opmn.conf such as the following: data id="command-line" value="-DRUNPROXY -DTESTENV -DINTRANET"/