Hardening Linux for Oracle 10g

Question

I have been working on creating a bare-bones RHEL 5 installation which will act as an Oracle 10g database server. For hardening Linux, I have restricted to a bare minimum of packages to make it more secure. This installation did not have X-Windows, Gnome/KDE and a host of other services that will not be required on Production servers. I selected only the BASE installation which was further customized to include just the following (there is scope to trim this further, so feedback is welcome):
NetworkManager
readahead
smartmontools
yum-updatesd
irqbalance
acpid
crash
cryptsetup-luks
dos2unix
dump
finger
gnugpg
ksh
libaio
logwatch
m2crypto
man-pages
mdadm
nano
numactl
openssh-clients
openssh-servers
pam_ccreds
pam_krb5
pam_passwdqc
sendmail
setuptools
stunnel
sudo
symlinks
system-config-network
tree
unix2dos
unzip
vconfig
wget
which
yum
yum-rhn-plugin
yum-security
zip
Since I do not intend to use nfs, nis, samba – associated packages were not included. Further hardening was achieved by deleting non-required services (kudzu, avahi, gpm, atd, netfs, ip6tables).
The challenge comes when I begin setting up Oracle 10g using the oracle validated rpm method. In an attempt to resolve dependencies, YUM ends up installing 70 packages that do not apparently seem to have anything to do with an RDBMS (sound libraries, Gnome, X libraries and tools etc.). For me the libraries/binaries required for linking appear to be justified but the rest appear to be installed only for the Installer.
This package addition also ends up installing gamin which provides the gam_server which has bugs in it that lead to > 90% CPU consumption.
I further tried erasing some of the packages to see if anything broke. Till now nothing is broken and the database is running fine. Till now I have removed:
gamin
gamin-python
gnome-mount
gnome-vfs2
libbonoboui
libgnome
libgnomeui
oracle-validated
yum-updatesd
esound
hicolor-icon-theme
GConf2
gnome-keyring
gtk2
libglade2
libgnomecanvas
libnotify
libwnck
notification-daemon
audiofile
cups-libs
gnome-mime-data
cairo
pango
My questions:
• How have you created a production/hardened Linux based Oracle installation?
• Can you share your experiences in hardening Linux for Oracle and deploying the Oracle 10g RDBMS without installing the scores of packages which themselves might compromise the server?
• What exactly is the dependency for the Oracle 10g RDBMS on X11, Gnome, Gamin and graphic libraries such as Cairo and Pango (to name a few)?
• Which Linux system services are really mandatory for Oracle?
• Does a non-default secure installation compromise Oracle support?
The current memory footprint for this setup (without any workload) is (figures in MB):
total used free shared buffers cached
Mem: 1010 458 552 0 19 377
-/+ buffers/cache: 61 949
Swap: 2047 0 2047
…of this 290 MB belongs to Oracle ☺
I will be working with the other route – without using the oracle-validated rpm.
Please let me have your feedback.
BR
Aniruddha

Answer 1

Hi,
I'll paste the rpm -qa of a RHEL5 server I have installed through rpm -ivh (not yum at all)
aspell-0.60.3-7.1
aspell-en-6.0-2.1
aspell-es-0.50-13.2.2
at-3.1.8-82.fc6
atk-1.12.2-1.fc6
audit-libs-1.7.13-2.el5
audit-libs-1.7.13-2.el5
audit-libs-python-1.7.13-2.el5
authconfig-5.3.21-6.el5
avahi-0.6.16-6.el5
avahi-compat-libdns_sd-0.6.16-6.el5
basesystem-8.0-5.1.1
bash-3.2-24.el5
bc-1.06-21
binutils-2.17.50.0.6-12.el5
bitmap-fonts-0.3-5.1.1
bitstream-vera-fonts-1.10-7
bzip2-1.0.3-4.el5_2
bzip2-libs-1.0.3-4.el5_2
cairo-1.2.4-5.el5
checkpolicy-1.33.1-4.el5
chkconfig-1.3.30.1-2
compat-libstdc++-33-3.2.3-61
compat-libstdc++-33-3.2.3-61
coreutils-5.97-23.el5
cpio-2.6-23.el5
cpp-4.1.2-46.el5
cracklib-2.8.9-3.3
cracklib-dicts-2.8.9-3.3
crontabs-1.10-8
cryptsetup-luks-1.0.3-5.el5
cups-1.3.7-11.el5
cups-libs-1.3.7-11.el5
cyrus-sasl-2.1.22-5.el5
cyrus-sasl-lib-2.1.22-5.el5
db4-4.3.29-10.el5
db4-4.3.29-10.el5
dbus-1.1.2-12.el5
dbus-glib-0.73-8.el5
dbus-libs-1.1.2-12.el5
dbus-python-0.70-7.el5
Deployment_Guide-en-US-5.2-11
Deployment_Guide-es-ES-5.2-11
desktop-file-utils-0.10-7
device-mapper-1.02.32-1.el5
device-mapper-1.02.32-1.el5
device-mapper-event-1.02.32-1.el5
device-mapper-multipath-0.4.7-30.el5
diffutils-2.8.1-15.2.3.el5
dmidecode-2.9-1.el5
dmraid-1.0.0.rc13-53.el5
dmraid-events-1.0.0.rc13-53.el5
e2fsprogs-1.39-23.el5
e2fsprogs-devel-1.39-23.el5
e2fsprogs-devel-1.39-23.el5
e2fsprogs-libs-1.39-23.el5
e2fsprogs-libs-1.39-23.el5
ed-0.2-39.el5_2
eject-2.1.5-4.2.el5
elfutils-0.137-3.el5
elfutils-libelf-0.137-3.el5
elfutils-libelf-devel-0.137-3.el5
elfutils-libelf-devel-static-0.137-3.el5
elfutils-libs-0.137-3.el5
ethtool-6-3.el5
expat-1.95.8-8.2.1
file-4.17-15.el5_3.1
filesystem-2.4.0-2
findutils-4.2.27-6.el5
fipscheck-1.2.0-1.el5
fipscheck-lib-1.2.0-1.el5
fontconfig-2.4.1-7.el5
freetype-2.2.1-21.el5_3
freetype-2.2.1-21.el5_3
gawk-3.1.5-14.el5
gcc-4.1.2-46.el5
gcc-c++-4.1.2-46.el5
gdbm-1.8.0-26.2.1
gettext-0.14.6-4.el5
glib2-2.12.3-4.el5_3.1
glib2-2.12.3-4.el5_3.1
glib2-devel-2.12.3-4.el5_3.1
glib2-devel-2.12.3-4.el5_3.1
glibc-2.5-42
glibc-2.5-42
glibc-common-2.5-42
glibc-devel-2.5-42
glibc-devel-2.5-42
glibc-headers-2.5-42
gnutls-1.4.1-3.el5_2.1
grep-2.5.1-55.el5
groff-1.18.1.1-11.1
grub-0.97-13.5
gtk2-2.10.4-20.el5
gzip-1.3.5-10.el5
hal-0.5.8.1-52.el5
hdparm-6.6-2
hesiod-3.1.0-8
hicolor-icon-theme-0.9-2.1
hmaccalc-0.9.6-1.el5
htmlview-4.0.0-2.el5
hwdata-0.213.16-1.el5
info-4.8-14.el5
initscripts-8.45.30-2.el5
iproute-2.6.18-10.el5
iptables-1.3.5-5.3.el5
iptables-ipv6-1.3.5-5.3.el5
iputils-20020927-46.el5
kbd-1.12-21.el5
kernel-2.6.18-164.el5
kernel-headers-2.6.18-164.el5
keyutils-libs-1.2-1.el5
kpartx-0.4.7-30.el5
krb5-libs-1.6.1-36.el5
ksh-20080202-2.el5
kudzu-1.2.57.1.21-1
less-394-6.el5
libacl-2.2.39-3.el5
libaio-0.3.106-3.2
libaio-0.3.106-3.2
libaio-devel-0.3.106-3.2
libattr-2.4.32-1.1
libcap-1.10-26
libdaemon-0.10-5.el5
libdmx-1.0.2-3.1
libdrm-2.0.2-1.1
libgcc-4.1.2-46.el5
libgcc-4.1.2-46.el5
libgcrypt-1.4.4-5.el5
libgomp-4.4.0-6.el5
libgomp-4.4.0-6.el5
libgpg-error-1.4-2
libhugetlbfs-1.3-3.el5
libhugetlbfs-1.3-3.el5
libICE-1.0.1-2.1
libICE-1.0.1-2.1
libjpeg-6b-37
libpng-1.2.10-7.1.el5_3.2
libselinux-1.33.4-5.5.el5
libselinux-1.33.4-5.5.el5
libselinux-python-1.33.4-5.5.el5
libselinux-utils-1.33.4-5.5.el5
libsemanage-1.9.1-4.4.el5
libsepol-1.15.2-2.el5
libsepol-1.15.2-2.el5
libSM-1.0.1-3.1
libSM-1.0.1-3.1
libstdc++-4.1.2-46.el5
libstdc++-4.1.2-46.el5
libstdc++-devel-4.1.2-46.el5
libstdc++-devel-4.1.2-46.el5
libsysfs-2.0.0-6
libtermcap-2.0.8-46.1
libtermcap-2.0.8-46.1
libtiff-3.8.2-7.el5_3.4
libusb-0.1.12-5.1
libuser-0.54.7-2.el5.5
libvolume_id-095-14.21.el5
libvolume_id-095-14.21.el5
libX11-1.0.3-11.el5
libX11-1.0.3-11.el5
libXau-1.0.1-3.1
libXau-1.0.1-3.1
libXau-devel-1.0.1-3.1
libXaw-1.0.2-8.1
libXcursor-1.1.7-1.1
libXdmcp-1.0.1-2.1
libXdmcp-1.0.1-2.1
libXext-1.0.1-2.1
libXext-1.0.1-2.1
libXfixes-4.0.1-2.1
libXft-2.1.10-1.1
libXi-1.0.1-3.1
libXinerama-1.0.1-2.1
libxml2-2.6.26-2.1.2.8
libxml2-python-2.6.26-2.1.2.8
libXmu-1.0.2-5
libXp-1.0.0-8.1.el5
libXp-1.0.0-8.1.el5
libXp-devel-1.0.0-8.1.el5
libXpm-3.5.5-3
libXrandr-1.1.1-3.1
libXrender-0.9.1-3.1
libXt-1.0.2-3.1.fc6
libXt-1.0.2-3.1.fc6
libXtst-1.0.1-3.1
libXtst-1.0.1-3.1
libXv-1.0.1-4.1
libXxf86dga-1.0.1-3.1
libXxf86misc-1.0.1-3.1
libXxf86vm-1.0.1-3.1
lm_sensors-2.10.7-4.el5
logrotate-3.7.4-9
lsscsi-0.17-3.el5
lvm2-2.02.46-8.el5
m4-1.4.5-3.el5.1
mailx-8.1.1-44.2.2
make-3.81-3.el5
MAKEDEV-3.23-1.2
man-1.6d-1.1
man-pages-es-1.28-10.1.1
mcstrans-0.2.11-3.el5
mesa-libGL-6.5.1-7.7.el5
microcode_ctl-1.17-1.48.el5
mingetty-1.07-5.2.2
mkinitrd-5.1.19.6-54
mkinitrd-5.1.19.6-54
mktemp-1.5-23.2.2
module-init-tools-3.3-0.pre3.1.54.el5
nano-1.3.12-1.1
nash-5.1.19.6-54
ncurses-5.5-24.20060715
net-tools-1.60-78.el5
newt-0.52.2-12.el5
nspr-4.7.4-1.el5_3.1
nspr-4.7.4-1.el5_3.1
nss-3.12.3.99.3-1.el5_3.2
nss-3.12.3.99.3-1.el5_3.2
ntp-4.2.2p1-9.el5_3.2
ocfs2-2.6.18-164.el5-1.4.2-1.el5
ocfs2console-1.4.2-1.el5
ocfs2-tools-1.4.2-1.el5
ocfs2-tools-devel-1.4.2-1.el5
openldap-2.3.43-3.el5
openssh-4.3p2-36.el5
openssh-clients-4.3p2-36.el5
openssh-server-4.3p2-36.el5
openssl-0.9.8e-12.el5
oracleasm-2.6.18-164.el5-2.0.5-1.el5
oracleasmlib-2.0.4-1.el5
oracleasm-support-2.1.3-1.el5
pam-0.99.6.2-6.el5
pango-1.14.9-6.el5
paps-0.6.6-18.el5
passwd-0.73-1
patch-2.5.4-29.2.3.el5
pax-3.4-1.2.2
pciutils-2.2.3-7.el5
pcre-6.6-2.el5_1.7
perl-5.8.8-27.el5
pkgconfig-0.21-2.el5
pm-utils-0.99.3-10.el5
policycoreutils-1.33.12-14.6.el5
popt-1.10.2.3-18.el5
prelink-0.4.0-2.el5
procmail-3.22-17.1
procps-3.2.7-11.1.el5
psmisc-22.2-7
pycairo-1.2.0-1.1
pygobject2-2.12.1-5.el5
pygtk2-2.10.1-12.el5
python-2.4.3-27.el5
python-numeric-23.7-2.2.2
readline-5.1-3.el5
readline-5.1-3.el5
redhat-logos-4.9.16-1
redhat-lsb-3.1-12.3.EL
redhat-menus-6.7.8-3.el5
redhat-release-5Server-5.4.0.3
redhat-release-notes-5Server-29
rhpl-0.194.1-1
rootfiles-8.1-1.1.1
rpm-4.4.2.3-18.el5
rpm-libs-4.4.2.3-18.el5
rsh-0.17-38.el5
rsync-2.6.8-3.1
sed-4.1.5-5.fc6
selinux-policy-2.4.6-255.el5
selinux-policy-targeted-2.4.6-255.el5
sendmail-8.13.8-2.el5
setools-3.0-3.el5
setserial-2.17-19.2.2
setup-2.5.58-7.el5
sgpio-1.2.0_10-2.el5
shadow-utils-4.0.17-14.el5
slang-2.0.6-4.el5
smartmontools-5.38-2.el5
sqlite-3.3.6-5
sysfsutils-2.0.0-6
sysklogd-1.4.1-44.el5
sysstat-7.0.2-3.el5
system-config-securitylevel-tui-1.6.29.1-2.1.el5
SysVinit-2.86-15.el5
tar-1.15.1-23.0.1.el5
tcl-8.4.13-4.el5
tcl-8.4.13-4.el5
tcp_wrappers-7.6-40.7.el5
tcp_wrappers-7.6-40.7.el5
telnet-0.17-39.el5
termcap-5.5-1.20060701.1
time-1.7-27.2.2
tmpwatch-2.9.7-1.1.el5.2
tzdata-2009k-1.el5
udev-095-14.21.el5
udftools-1.0.0b3-0.1.el5
unzip-5.52-3.el5
usermode-1.88-3.el5.2
util-linux-2.13-0.52.el5
vim-common-7.0.109-6.el5
vim-minimal-7.0.109-6.el5
vixie-cron-4.1-76.el5
vte-0.14.0-2.el5
which-2.16-7
wireless-tools-28-2.el5
xorg-x11-filesystem-7.1-2.fc6
xorg-x11-utils-7.1-2.fc6
xorg-x11-xauth-1.0.1-2.1
zabbix-agent-1.4.6-1.el5
zip-2.31-2.el5
zlib-1.2.3-3
Hope to help,
Mario Alcaide