No more poodles!

I love dogs, I really do. However I'm going to say it again - no more poodles! stop this heartbleading beast who bites our good old systems. This post isn't about Oracle, but it close enough to be here.

Lets's discuss a quite inexpensive way to enforce the latest greatest  security protocols and standards for old systems.

I’m going to show you how to increase security of your system. To achieve our goals you should complete the follow:

•  Prepare system for installation
•  Install and configure 3rd party applications 
•  Install and configure OpenSSL 1.0
•  Install and configure Apache 2.4

Start point. 

To reproduce old system I’m going to use VirtualBox with trial RedHat  AS 4.8 and Oracle XE to simulate business application on it. Operating system architecture is 32 bit and there are no upgrades updates or patches.

Business application resides on the system and should be exposed to the external user with maximum protection available. Normally it uses Oracle HTTP Server 10g and uses Oracle Wallet to accept HTTPS requests. 

To simplify this document I’m going to omit all certificate configuration details and will use my own CA and prepared certificates.  There are plenty number posts around openssl and certificate requests.

Apache server from RedHat 4.8 has version 2.0б that you have SSLv2, SSLv 3 and TLSv1.0 protocols only. Frankly speaking it may be enough for your tasks and you may skip everything down to reverse proxy  configuration. However TLSv1.0 is almost the same as SSL v3.0 and may be compromised as well. 

I consider no compromises and chase perfection:  no weak chippers, no heartbleeds and no poodles!

Prepare operating system

As soon as we are going to install software from sources we need to install development packages, 

libraries and compilers. Mount file system with your RedHat installation or in my case – insert DVD 

image into virtual DVD device.

Important notice: All commands execute as root user or through sudo rights 

Install packages as below (assume that resource mounted as /media/cdrom):

# rpm -Uvh /media/cdrom/RedHat/RPMS/kernel-devel-2.6.9-67.EL.i686.rpm

# rpm -Uvh /media/cdrom/RedHat/RPMS/gcc-3.4.6-9.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-devel-2.3.4-2.39.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-kernheaders-2.4-9.1.100.EL.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-headers-2.3.4-2.39.i386.rpm

# rpm -Uvh /media/cdrom/RedHat/RPMS/gcc-c++-3.4.6-9.i386.rpm \

/media/cdrom/RedHat/RPMS/libstdc++-devel-3.4.6-9.i386.rpm

Open SSL 

As part of overall security increase you need to upgrade existing OpenSSL installation. 

# wget http://www.openssl.org/source/openssl-1.0.1k.tar.gz

--18:13:35--  http://www.openssl.org/source/openssl-1.0.1k.tar.gz

           => `openssl-1.0.1k.tar.gz'

Resolving www.openssl.org... 185.9.166.106

Connecting to www.openssl.org|185.9.166.106|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 4,434,910 (4.2M) [application/x-gzip]

100%[================================================,434,910    704.70K/s    

ETA 00:00

18:13:44 (508.59 KB/s) - `openssl-1.0.1k.tar.gz' saved [4434910/4434910]

Check MD5 sum of download. Correct value is d4f002bd22a56881340105028842ae1f

# md5sum openssl-1.0.1k.tar.gz

d4f002bd22a56881340105028842ae1f  openssl-1.0.1k.tar.gz

Unpack archive and go to OpenSSL sources

# tar zxf openssl-1.0.1k.tar.gz

# cd openssl-1.0.1k

Configure installation with default directories:

# ./config --prefix=/usr/local --openssldir=/usr/local/openssl

………………………………………

[1]: Entering directory `/root/openssl-1.0.1k/apps'

make[1]: Nothing to be done for `generate'.

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

Configured for linux-elf.

#

There is should be no error messages yet. Compile libraries (check for errors ):

# make

……………………………

make[2]: Leaving directory `/root/openssl-1.0.1k/test'

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

making all in tools...

make[1]: Entering directory `/root/openssl-1.0.1k/tools'

make[1]: Nothing to be done for `all'.

make[1]: Leaving directory `/root/openssl-1.0.1k/tools'

#

If binaries were compiled with no errors install them:

# make install

.......................................

make[1]: Entering directory `/root/openssl-1.0.1k/test'

make[1]: Nothing to be done for `install'.

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

making install in tools...

make[1]: Entering directory `/root/openssl-1.0.1k/tools'

make[1]: Leaving directory `/root/openssl-1.0.1k/tools'

installing libcrypto.a

installing libssl.a

cp libcrypto.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/libcrypto.pc

cp libssl.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/libssl.pc

cp openssl.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/openssl.pc

#cd ~/

Validate installation 

# openssl version

OpenSSL 1.0.1k 8 Jan 2015

Install PCRE libraries

Apache HTTP server requires Perl Compatible Regular Expressions.

Get binaries

# wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.36.tar.gz
--19:35:56--  ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.36.tar.gz
           => `pcre-8.36.tar.gz'
Resolving ftp.csx.cam.ac.uk... 131.111.8.115
Connecting to ftp.csx.cam.ac.uk|131.111.8.115|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD /pub/software/programming/pcre ... done.
==> PASV ... done.    ==> RETR pcre-8.36.tar.gz ... done.
Length: 2,009,464 (1.9M) (unauthoritative)
100%[=======================================>] 2,009,464    482.35K/s    ETA 00:00
19:36:03 (418.19 KB/s) - `pcre-8.36.tar.gz' saved [2009464]

Extract archive

# tar zxf pcre-8.36.tar.gz
# cd pcre-8.36

Configure and install libraries

#./configure
……………………………
pcre-8.36 configuration summary:
    Install prefix .................. : /usr/local
    C preprocessor .................. : gcc -E
    C compiler ...................... : gcc
    Use JIT in pcregrep ............. : no
    Buffer size for pcregrep ........ : 20480
    Link pcregrep with libz ......... : no
    Link pcregrep with libbz2 ....... : no
    Link pcretest with libedit ...... : no
    Link pcretest with libreadline .. : no
    Valgrind support ................ : no
    Code coverage ................... : no

# make
……………………
  CXX      pcre_scanner_unittest-pcre_scanner_unittest.o
  CXXLD    pcre_scanner_unittest
  CXX      pcre_stringpiece_unittest-pcre_stringpiece_unittest.o
  CXXLD    pcre_stringpiece_unittest
make[1]: Leaving directory `/root/pcre-8.36'

# make install
…………………….
CCLD     pcregrep
  CXX      pcrecpp_unittest-pcrecpp_unittest.o
  CXXLD    pcrecpp_unittest
  CXX      pcre_scanner_unittest-pcre_scanner_unittest.o
  CXXLD    pcre_scanner_unittest
  CXX      pcre_stringpiece_unittest-pcre_stringpiece_unittest.o
  CXXLD    pcre_stringpiece_unittest
make[1]: Leaving directory `/root/pcre-8.36'

#cd ~/

Install Apache HTTP server binaries

Download latest stable version (at this time It’s 2.4.10 so adjust document accordingly with your current version).

# wget http://apache.mirrors.tds.net//httpd/httpd-2.4.10.tar.gz
--19:15:51--  http://apache.mirrors.tds.net//httpd/httpd-2.4.10.tar.gz
           => `httpd-2.4.10.tar.gz'
Resolving apache.mirrors.tds.net... 216.165.129.134
Connecting to apache.mirrors.tds.net|216.165.129.134|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6,820,719 (6.5M) [application/x-gzip]
100%[========================================>] 6,820,719      1.73M/s    ETA 00:00
19:15:56 (1.41 MB/s) - `httpd-2.4.10.tar.gz' saved [6820719/6820719]
#

Check MD5 value. Correct one is 9b5f9342f73a6b1ad4e8c4b0f3f5a159

# md5sum httpd-2.4.10.tar.gz

9b5f9342f73a6b1ad4e8c4b0f3f5a159  httpd-2.4.10.tar.gz

Download latest APR and APR-Util sources

- APR MD5 is d3538d67e6455f48cc935d8f0a50a1c3

# wget http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
--19:24:08--  http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
           => `apr-1.5.1.tar.gz'
Resolving mirror.metrocast.net... 65.175.128.102, 2606:f400:400:0:65:175:128:102
Connecting to mirror.metrocast.net|65.175.128.102|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1,020,833 (997K) [application/x-gzip]
100%[===============================================>] 1,020,833    806.48K/s
19:24:10 (804.12 KB/s) - `apr-1.5.1.tar.gz' saved [1020833/1020833]

# md5sum apr-1.5.1.tar.gz
d3538d67e6455f48cc935d8f0a50a1c3  apr-1.5.1.tar.gz

APR-Util MD5 is  866825c04da827c6e5f53daff5569f42

# wget http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
--19:24:08--  http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
           => `apr-1.5.1.tar.gz'
Resolving mirror.metrocast.net... 65.175.128.102, 2606:f400:400:0:65:175:128:102
Connecting to mirror.metrocast.net|65.175.128.102|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1,020,833 (997K) [application/x-gzip]
100%[=====================================================>] 1,020,833    806.48K/s

19:24:10 (804.12 KB/s) - `apr-1.5.1.tar.gz' saved [1020833/1020833]
[root@rhas48 ~]# md5sum apr-1.5.1.tar.gz
d3538d67e6455f48cc935d8f0a50a1c3  apr-1.5.1.tar.gz

Extract and prepare sources

# tar zxf httpd-2.4.10.tar.gz
# tar zxf apr-1.5.1.tar.gz
# tar zxf apr-util-1.5.4.tar.gz
# mv apr-1.5.1 httpd-2.4.10/srclib/apr
# mv apr-util-1.5.4 httpd-2.4.10/srclib/apr-util
# cd httpd-2.4.10

Configure installation

#./configure –prefix=/usr/local/apache2 –enable-ssl
………………………
config.status: creating support/log_server_status
config.status: creating support/logresolve.pl
config.status: creating support/phf_abuse_log.cgi
config.status: creating support/split-logfile
config.status: creating build/rules.mk
config.status: creating build/pkg/pkginfo
config.status: creating build/config_vars.sh
config.status: creating include/ap_config_auto.h
config.status: executing default commands
#

Make binaries

# make
……………………………………………
/root/httpd-2.4.10/srclib/apr/libtool --silent --mode=link gcc -std=gnu99  -g -O2 -pthread -o mod_rewrite.la -rpath /usr/local/apache2/modules -module -avoid-version  mod_rewrite.lo
make[4]: Leaving directory `/root/httpd-2.4.10/modules/mappers'
make[3]: Leaving directory `/root/httpd-2.4.10/modules/mappers'
make[2]: Leaving directory `/root/httpd-2.4.10/modules'
make[2]: Entering directory `/root/httpd-2.4.10/support'
make[2]: Leaving directory `/root/httpd-2.4.10/support'
make[1]: Leaving directory `/root/httpd-2.4.10'
#

Install new server binaries

#make install
…………………………
mkdir /usr/local/apache2/conf
mkdir /usr/local/apache2/conf/extra
mkdir /usr/local/apache2/conf/original
mkdir /usr/local/apache2/conf/original/extra
Installing HTML documents
mkdir /usr/local/apache2/htdocs
Installing error documents
mkdir /usr/local/apache2/error
Installing icons
mkdir /usr/local/apache2/icons
mkdir /usr/local/apache2/logs
Installing CGIs
mkdir /usr/local/apache2/cgi-bin
Installing header files
Installing build system files
Installing man pages and online manual
mkdir /usr/local/apache2/man
mkdir /usr/local/apache2/man/man1
mkdir /usr/local/apache2/man/man8
mkdir /usr/local/apache2/manual
make[1]: Leaving directory `/root/httpd-2.4.10'
#

All binaries are in place and we are ready to complete system configuration.

Here is System and Apache configuration.

OAM 11.1.2.2.0 Custom Login Form

Good afternoon to everyone,

Today I share fresh finding and hope it'd help you t save time and keep your mind (I've almost lost mine). 

It costs me couple days of hard harvesting and log analysis, I had  to create a simple application to check session status. 

After successful Oracle OAM and Tivoli Access Manager (TAM) integration (I'm going to post it sometimes) developement team faced next challenge. Due security reasons we have no access to TAM server so federation works only for external clients.  To provide access for both teams I used new OAM 11.1.2.2.0 feature - Advanced Authentication Policy Rules.  We decided to separate authentication schemes by browser type.  So if user's accessing protected resource with Google Chrome browser OAM uses local form-based authentication scheme otherwise request will be redirected to federation plug (TAM SSO). 

Screenshot below shows advanced rule edit form. 

Simple but effective way to build two factor or more sophisticated resource protection schemes. Detailed description and samples could be found in OAM documentation here.
So far so good,identity federation works, advanced rules works like a charm, custom forms appears and works as expected but result is very well known to everyone who deals with OAM/Webgates.

After log analyze and brainstorming I realized authentication doesn't match with authentication request. It means there is something wrong with login application. It's somewhat confused because the very same application works with OAM 11gR1. 

I'd skip logs mining, documentation sift and JSP analyze descriptions so   there is a gem:
For previous OAM versions  was quite enough to send request id with username and password. OAM 11.1.2.2.0 requires authentication token. Unfortunately our login page send request_id only and code below show how it has to be (additional lines in red).

 <!-- skipped JSP & HTML header -->  
 <%  
 String reqId = null;  
 String reqToken = null;  
 if( reqId == null && request.getAttribute( GenericConstants.REQUEST_ID ) != null )  
      {  
           reqId = ( String )request.getAttribute( GenericConstants.REQUEST_ID );  
      }  
      reqId = CSSUtil.escapeHtmlFull( reqId );  
     reqToken = request.getParameter(GenericConstants.AM_REQUEST_TOKEN_IDENTIFIER);  
 %>  
 <form id="loginData" action="/oam/server/auth_cred_submit" method="post" name="loginData" >  
 <!-- Skipped form declaration and decoration -->  
   <input name="<%=GenericConstants.REQUEST_ID%>" value="<%=reqId%>" type="hidden"/>  
   <input type="hidden" name="<%=GenericConstants.AM_REQUEST_TOKEN_IDENTIFIER%>" value="<%=reqToken%>" type="hidden"/>  
 </form>  
 <!-- skipped JSP & HTML footers -->  

Now it works  and if your have login form with token already you will never face this issue.
If not read my post and save time for upcoming l-o-o-o-ong beautiful weekend.

Enjoy and take care.

Gather session Information.

Hi there,

I will not be original, not share inventions or hot insider information. But this trinket could save your time.
There is a very simple yet nice looking servlet to show you full HTTP session state. Believe me, sometime  it's not easy when developer tools in Chrome or *Fox will not tell you truth show you encoded data only.
Personally, I use that for debug and troubleshoot identity management configurations.
It would be useful for any Single Sign-On protected resources.  Right now I'm using it to validate identity federation authentications.

There is a screenshot:

OAM headers visible only from inside session.

I hardly name this minimalist JSP page with couple standard java classes an application but there is a source code.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<%@ page contentType="text/html;charset=windows-1252"%>
<%@ page import="javax.servlet.http.Cookie" %>
<%@ page import="java.util.Map" %>
<%@ page import="java.util.Enumeration" %>

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"/>
    <title>index</title>
    <style type="text/css" >
        #thdr {
            background-color: rgb(32,48,255);font-weight: 600;
            color: white;
            font-family: sans-serif;
        }
        #content {
            width: 70%;
            margin: 0 auto;
            background-color: rgb(236,236,236);
        }
        th {
            text-align: left;
            font-size: small;
            font-family: sans-serif;
            background-color: Silver;
            word-wrap:break-word
        }
        td {font-size: small; word-wrap:break-word}
        table {
             border-spacing: 0px;
             border-width: 0px;
             width: 99.5%;
             table-layout: fixed;
        }
        body {
            background-color: rgb(158,158,158);
        }
    </style>
  </head>
  <body>
    <div align="center" id="content">
      <h2><strong>Session information </strong></h2>
    <hr/>
    <h4>Session Cookies</h4>
    <% Cookie[] ccs = request.getCookies(); %>
    <table id="CookieTbl" cellspacing="2" cellpadding="3" border="1" width="100%">
      <tr ><th width="268" id="thdr">Name</th><th width="872" id="thdr">Value</th></tr>
     <% for (int i=0;i<ccs.length;i++) {%>
      <tr><th width="268"><%= ccs[i].getName()%></th><td width="872"><%=ccs[i].getValue()%></td></tr>
     <% }%>
    </table>
    <p/>
    <h4>Request Headers</h4>
    <% Enumeration hdrs = request.getHeaderNames(); %>
    <table id="RequestHdr" cellspacing="2" cellpadding="3" border="1" width="100%">
      <tr id="thdr"><th width="268" id="thdr">Name</th><th width="872" id="thdr">Value</th></tr>
      <% String hdr=null;
         while(hdrs.hasMoreElements()){ hdr=hdrs.nextElement().toString();%>
          <tr>
              <th width="268"><%=hdr%></th>
              <td width="872"><%= request.getHeader(hdr)%></td>
          </tr>
      <%}%>
    </table>
    <p/>
    <h4>Request Parameters</h4>
    <% Map<String,String[]> params = request.getParameterMap(); %>
    <table id="RequestPrm" cellspacing="2" cellpadding="3" border="1"
           width="100%">
      <tr id="thdr"><th width="268" id="thdr" height="26">Name</th><th width="872" id="thdr"
                                                                       height="26">Value</th></tr>
      <% for (Map.Entry<String,String[]> param : params.entrySet()){ %>
      <tr><th width="268" rowspan="<%=param.getValue().length%>">
          <%= param.getKey()%></th>
          <td width="872"><%= param.getValue()[0]%></td></tr>
          <% for (int i=1;i<param.getValue().length;i++) {%>
              <tr><td width="872"><%=param.getValue()[i]%></td></tr>
          <%}%>
      <%} %>
    </table>
    <hr/>
    </div>
  </body>
</html>

And if you use JDeveloper there is ready to project.

Save time for life and have a good weekend,

Shared resource for demo SOA 11g Cluster

If you are going to build cluster configuration for Oracle SOA Suite 11g, you should provide shared disk drive for JMS persistence and other common resources. Official documentation recommends to use NFS resources. I can't explain why, but in our case access to NFS share was very unstable and totally unpredictable. Operating
system on cluster nodes eventually hangs and hadn't released resources. So we had to create test cluster without NFS shares and any NAS/SAN appliances.
We have three virtual machines, one is a Web tier with load balancer functionality and  the other two are SOA 11g cluster nodes.  Roles and links between servers you may see on the diagram below.

Let's assume that servers have follow names:

• Web Tier - web
• Cluster nodes - node1 and node2

Prepare block device

We should start from preparing block device to publish as iSCSI target. Unfortunately we haven't any free block devices on this server and there are no ways to add new drive or recreate partitions on existing system, so let's create block device from a regular file on an existing file system of web server.

1. Create an empty file with neccessary size
   # dd if=/dev/zero of=/usr/shared-image bs=1M count=2048

At this  point we a ready to publish our device as shared storage.

Configure iSCSI target
For our cluster we use Oracle Enterprise Linux 5 Update 5 64. All services for our system was already installed, if you are going to use another linux distributive, you shoul check existence of services and packages. For example for RHEL 4U8 you have to install  OCFS22 packages and probably iscsi-target service.

1. Enable iscsi-target service
   # chkconfig iscsi-target on
2. Start service for the first time
   # service iscsi-target start
3. Stop service
   # service iscsi-target stop
4.  Edit file /etc/ietd.conf to add new device as follow
   # Example iscsi target configuration#
   # Everything until the first target definition belongs
   # to the global configuration.Target iqn.2011-08.demo.soa11:storage.soa.share.ocfs2       
   # Users, who can access this target. The same rules as for discovery       
   # users apply here.       
   # Leave them alone if you don't want to use authentication.       
   #Incoming User joe secret       
   #Outgoing User jim 12charpasswd       
   # Logical Unit definition       
   # You must define one logical unit at least.# Block devices, regular files, LVM, and RAID can be offered      
   # to the initiators as a block device.       
   Lun 0 Path=/usr/shared-image,Type=fileio       
   # Alias name for this target       
   Alias WlsShare       
   # various iSCSI parameters       
   # (not all are used right now, see also iSCSI spec for details)       
   #MaxConnections         1       
   #InitialR2T             Yes       
   #ImmediateData          No       
   #MaxRecvDataSegmentLength 8192       
   #MaxXmitDataSegmentLength 8192       
   #MaxBurstLength         262144       
   #FirstBurstLength       65536       
   #DefaultTime2Wait       2       
   #DefaultTime2Retain     20       
   #MaxOutstandingR2T      8       
   #DataPDUInOrder         Yes       
   #DataSequenceInOrder    Yes       
   #ErrorRecoveryLevel     0       
   #HeaderDigest           CRC32C,None       
   #DataDigest             CRC32C,None       
   # various target parameters       
   #Wthreads               8
5. Start service again and publish our device to clients
   # service iscsi-target start

Connect iSCSI clients

A this point we are going to enable iSCSI services and attach published device. We shoud do this set of commands on both cluster nodes

1. Add service iscsi to sartup sequence
   # chkconfig iscsi on
2. Start service for the first time
   # service iscsi start
3. Discover and attach published resouce on the web server (i.e. IP address  - 192.168.1.10)
   # iscsiadm -m discovery -t sendtargets -p 192.168.1.10
4. Restart service to attach new device
   # service iscsi restart
5. Check new drive availability
   # fdisk -l

Disk /dev/sda: 146.1 GB, 146163105792 bytes

255 heads, 63 sectors/track, 17769 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *           1          25      200781   83  Linux

/dev/sda2              26        2636    20972857+  83  Linux

/dev/sda3            2637        4725    16779892+  82  Linux swap / Solaris

/dev/sda4            4726       17769   104775930    5  Extended

/dev/sda5            4726       17769   104775898+  83  Linux

Disk /dev/sdb: 1073 MB, 1073741824 bytes

34 heads, 61 sectors/track, 1011 cylinders

Units = cylinders of 2074 * 512 = 1061888 bytes

We ca see new disk device on nodes without any partitions and file systems. 

Let's create new cluster file system. This operations we will do only on one server  (the second one should see file system)

1. Connect to disk
   # fdisk /dev/sdb
   Command (m for help):n
     e   extended
     p   primary partition (1-4) p
   Partition number (1-4):1
2. Make new partition from the first (1) sector to the last one and save the changes.
3. Create file system on new partition
   # mkfs –t ocfs2 /dev/sdb1

When new filesystem will be created we can do next step and configure Oracle Cluster File System.

Configure OCFS2 cluster 
We are going to create new  OCFS2 cluster on servers node1 and node2.
We can edit ocfs2  configuration files in /etc/ directory, or we can use utility  ocfs2console.
Let's decide which servers have to have access to new shared resource. OCFS cluster is not related to any other clusters - SOA, Weblogic, RAC and any others. In general, OCFS Cluster is named list of hosts to share disk resource (-s) to create a new cluster let's use standard GUI tool - ocfs2console.

Form main menu select Cluster  then Configure Nodes. Add all participant nodes to  cluster members list. Save changes and select Cluster -> Propagate Configuration …If you have trusted relations between nodes OCFS configuraion will be copied to all members.
I use to set volume labels. It allows me to be device name agnostic (and Linux loves to change device names for some secret reasons). Use ocfs2console select menu Tools/Change Label … assign  partition label (SOA).
Now we are ready to mount our device on all nodes and enables OS auto mount during startup. You should repeat this steps on all OCFS cluster participants.

1. Enable OCFS service :
   #/etc/init.d/o2cb enable
2. Create mount point (obviously should be same on all resources)
   # mkdir /u01/share
3. Add entry to file system list   /etc/fstab:
   LABEL=SOA               /u01/share              ocfs2   defaults        1 2
4. Mount all devices by default:
   #mount  -a
   #mount
   /dev/sda2 on / type ext3 (rw)
   proc on /proc type proc (rw)
   sysfs on /sys type sysfs (rw)
   devpts on /dev/pts type devpts (rw,gid=5,mode=620)
   /dev/sda5 on /u01 type ext3 (rw)
   /dev/sda1 on /boot type ext3 (rw)
   tmpfs on /dev/shm type tmpfs (rw)
   none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
   sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
   none on /var/lib/xenstored type tmpfs (rw)
   configfs on /sys/kernel/config type configfs (rw)
   ocfs2_dlmfs on /dlm type ocfs2_dlmfs (rw)
   /dev/sdb1 on /u01/share type ocfs2 (rw,_netdev,heartbeat=local)

Regarding the last entry we have iSCSI drive mounted and accessible. Grant access to device for user oracle and group dba:
#chown –R oracle:dba /u01/share.
Now you have your simple shared disk system and could continue with SOA configuration.

Conclusion
Usng this approach you can create shared storage resources quick and simple with no additional costs. By the way I do not recommend to use this configuration outside POC systems or demo stands when you have to use 2 laptops to demonstrate SOA Suite in action.
In nova days I'd prefer to create several virtual boxes (ie under VMWare Server) and shared virtual drive with clustered file system (the same OCFS would work for you for free) 

This document was created several years ago in Russian so any comments, corrections are most welcome.