[chrisplough]

There are a few config files in OTM that contain OTM system passwords (including DB usernames and passwords), which should be properly secured to help maintain SOX compliance and promote the general security of the application.
The following files should be kept with permissions of 600:

Web Server:

• <otm_install_dir>/glog/config/glog.properties
• <otm_install_dir>/tomcat/bin/tomcat.conf

App Server:

• <otm_install_dir>/glog/config/glog.properties
• <otm_install_dir>/weblogic/config/gc3domain/weblogic.conf

Of course, real security depends on changing all of the default passwords in OTM (DB users, OS users, OTM users, etc) -- but you've already done that, haven't you?

Hope this helps!

--Chris