Enterprise Security in Oracle

Thought I could set up enterprise security... Got some things to work, some not, some only after great problems. One of the problems, I realized along the line, was that I documented nothing. So... Idecided to throw away the lot - my 10g database, 10g Infrastucture Server, and Internet Directory, and Signing Authority. And start over again.
OK - some details about the machine: it's an MSI KT4V based system, running an AMD 1800+, with 2 Western Digital WD1200JB's connected to the FastTrak 133 Lite Raid controller, partially in a software stripe (RAID0) configuration:
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/hdf1 2063504 330860 1627824 17% /
/dev/hde1 77750 14125 59611 20% /boot
none 513736 0 513736 0% /dev/shm
/dev/hdf3 1035692 138524 844556 15% /tmp
/dev/hde3 3020172 1357036 1509716 48% /usr
/dev/md0 222415788 17839508 193277800 9% /o

I have 1GB of memory installed, and 2GB of swap space. The OS is WhiteBox Linux Enterprise 3, and the machine is connected to my (100MBit) LAN via an onboard 1GB network interface.

After creating the obligatory groups and users, start off with installing the 10g Release 1 database:

The network assistant, I usually leave for what it is, and let it perform a default configuration. As the details about the database are often not known in this stadium, it's a safe option:
After that, the Database Creation Assistant will pop up. I always want control, so I always choose "Custom". Global database names with me are not just SID.domain - they are SID.server.domain:
As I will be configuring OEM later, I will not install it right now:
One more thing to watch out for: 10240k for redolog files is a tad small (10MB): increase to at least 100M, I say - all three of them. As a last step, I never create the database from here, but I save the scripts:

That concludes the graphical part of installation for now - I like to check the scripts and run them, using SSH (Secure Shell) with a nice emulator, based on TeraTerm: TeraTerm Professional with SSH. It even supports IPv6, and UTF8. And -not unimportant for Dutchies- it's free! Check it out - autocopy to clipboard is my favourite!
OK - check specific Oracle changes:
[root@csdb01 root]# cat /etc/sysctl.conf
# Oracle specific requirements...
kernel.shmmax=2147483648
kernel.sem=250 32000 100 128
fs.file-max=65536
net.ipv4.ip_local_port_range=1024 65000

and, for the oracle10 user tail .bash_profile:
# Oracle 10G Specifics...
export ORACLE_BASE=/o/oracle10
export ORACLE_HOME=$ORACLE_BASE/10gR1
export ORACLE_SID=o10gR1
export LD_ASSUME_KERNEL=2.4.1
export PATH=$ORACLE_HOME/bin:$PATH:.:/sbin:

[oracle10@csdb01 oracle10]$ more /o/oracle10/admin/o10gR1/scripts/o10gR1.sh
#!/bin/sh

mkdir -p /o/oracle10/10gR1/dbs
mkdir -p /o/oracle10/10gR1/oradata
mkdir -p /o/oracle10/admin/o10gR1/bdump
mkdir -p /o/oracle10/admin/o10gR1/cdump
mkdir -p /o/oracle10/admin/o10gR1/create
mkdir -p /o/oracle10/admin/o10gR1/pfile
mkdir -p /o/oracle10/admin/o10gR1/udump
mkdir -p /o/oracle10/flash_recovery_area
mkdir -p /o/oracle10/oradata/o10gR1
ORACLE_SID=o10gR1; export ORACLE_SID
echo Add this entry in the oratab: o10gR1:/o/oracle10/10gR1:Y
/o/oracle10/10gR1/bin/sqlplus /nolog @/o/oracle10/admin/o10gR1/scripts/o10gR1.sql

May oh, may - it looks like the Oracle folk found the -p option on mkdir... Goody! About time, though. For all of you none *ni* type of people: mkdir -p will create all parent directories, if any does not exist. And the .bash_profile is adapted, too, it has the ORACLE_SID entry. Very, ferry good! Now just scan the CreateDB.sql and CreateDBFiles.sql for maxsize unlimited, and I can kick off the script, and go for a cuppa' .
Oops! Hold on, let's apply the 10.1.0.4 patch first... Stop the listener, and ocssd - that seems harder than expected, but this does the trick (as root!):
/etc/rc.d/init.d/init.cssd stop
And there's nothing more to it, expect commenting out the last line in /etc/inittab, to prevent the service from starting at boot time.
Time to get some tea!