Oracle Database 19c EE on Windows Server 2019

Connecting to your instance

Connect with Remote Desktop as the Administrator:

Operating system variant Remote Desktop login user

Windows Server 2019 Datacenter Administrator

Launch from AWS Marketplace

• Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose Oracle Database 19c EE on Windows Server 2019 as the software version, then choose your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended starting size. Use a larger instance for production. The database uses 40% of the instance's memory.
• Choose a key pair. You need its private key to get the Administrator password.
• Use a security group that allows RDP (TCP 3389) from your own address only. Do not open 1521.
• Optional but recommended: attach an IAM instance profile with the AmazonSSMManagedInstanceCore policy. With it, you can reach the database from your workstation through Session Manager port forwarding (see Connect from your workstation) without opening any port.
• Launch the instance. The root volume is 100 GiB (the Oracle home plus your database). You can choose a larger volume at launch.

First boot: the database is created on your instance

After Windows finishes its first boot, a one-time task creates the database. On an m5.large, Windows setup takes about 6 to 8 minutes and creating the database takes 26 to 35 minutes. Allow 45 minutes in all. Larger instances are faster.

The Administrator password is ready after about four minutes, so you can sign in and watch. Check progress in PowerShell:

Get-Content C:\ProgramData\sac\oracle-firstboot.log -Tail 15

The database is ready when the log ends with READY and the ready marker exists:

Get-Content C:\ProgramData\sac\oracle-firstboot.done | ConvertFrom-Json | Select-Object ok, seconds, dbid, sid, pdb, version, finishedUtc

seconds is how long your database took to create. dbid is your database's own ID. To follow the log live in a Remote Desktop session, run Get-Content C:\ProgramData\SecureAnyCloud\oracle-firstboot.log -Wait.

If first boot fails, the file C:\ProgramData\SecureAnyCloud\oracle-firstboot.failed says why. The database stays stopped and no passwords are written. Restart the instance to try again (up to three attempts, each starting from a clean slate), or contact SecureAnyCloud support.

Get the Administrator password

In the EC2 console, select the instance and choose Actions, Security, Get Windows password. Upload the private key of your key pair and choose Decrypt password. Or use the AWS CLI on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password yet. Try again a minute later.

Connect over Remote Desktop

Connect to the instance's public DNS name or IP address on port 3389. Use a Remote Desktop client that supports Network Level Authentication (Microsoft Remote Desktop on Windows and macOS, FreeRDP on Linux). Sign in as Administrator with the password from the previous step.

Each instance generates its own Remote Desktop certificate, so your client asks you to trust it on first connection.

Read your database passwords

In the Remote Desktop session, open an elevated PowerShell (or File Explorer) and read the credentials file:

Get-Content C:\ProgramData\sac\oracle\oracle-db-credentials.txt

Key What it is

ORACLE_SID / CDB_SERVICE ORCL, the container database

PDB_SERVICE ORCLPDB1, the pluggable database for your schemas

LISTENER 127.0.0.1:1521

SYS_PASSWORD, SYSTEM_PASSWORD, PDBADMIN_PASSWORD The passwords generated on this instance

Store the passwords in your password manager. If you copy them anywhere else, change them (see Change the passwords).

Connect with SQL*Plus on the instance

The local Administrator is a member of the ORA_DBA group, so SQL*Plus on the instance can connect as SYSDBA with operating system authentication (no password). Check the database:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT name, dbid, open_mode, cdb, created FROM v`$database; SELECT con_id, name, open_mode FROM v`$pdbs; SELECT banner_full FROM v`$version; EXIT "@ | & $sqlplus -S / as sysdba

With operating system authentication, any member of the local Administrators (or ORA_DBA) group on the instance can connect as SYSDBA without a password. This is how Oracle on Windows works by design. Connections from anywhere else always need the password. The listener is loopback-only, and a client that is not a local administrator must give the SYS password.

To work in the pluggable database as SYSTEM or PDBADMIN, connect through the listener. SQL*Plus prompts for the password, so it never appears on the command line:

sqlplus system@//127.0.0.1:1521/ORCLPDB1 sqlplus pdbadmin@//127.0.0.1:1521/ORCLPDB1 sqlplus sys@//127.0.0.1:1521/ORCL as sysdba

Only SYS, SYSTEM and PDBADMIN are open accounts. Oracle's other built-in accounts stay locked. List the open accounts:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT con_id, username, account_status FROM cdb_users WHERE account_status = 'OPEN' ORDER BY con_id, username; EXIT "@ | & $sqlplus -S / as sysdba

Services and the listener

Two Windows services run the database, and both start automatically. Check them:

Get-Service OracleServiceORCL, OracleOraDB19Home1TNSListener | Select-Object Name, Status, StartType Get-CimInstance Win32_Service -Filter "Name='OracleServiceORCL'" | Select-Object Name, StartName

The listener answers on the loopback address only. Confirm it:

Get-NetTCPConnection -State Listen -LocalPort 1521 | Select-Object LocalAddress, LocalPort, OwningProcess & 'C:\app\oracle\product\19.0.0\dbhome_1\bin\lsnrctl.exe' status | Select-String 'Connecting to|DESCRIPTION|Service "'

To stop and start the database cleanly, use the services. Stop the database before the listener:

Stop-Service OracleServiceORCL Start-Service OracleServiceORCL

Connect from your workstation

The listener is loopback-only, so the safest way to use a client on your workstation (SQL Developer, SQLcl, an application) is AWS Systems Manager Session Manager port forwarding. It needs no inbound port at all. Use the instance profile from the launch step, and install the Session Manager plugin on your workstation. Then run:

aws ssm start-session --region <region> --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters portNumber=1521,localPortNumber=1521

Leave the session running and connect your client to localhost:1521, service ORCLPDB1.

Accept direct client connections

If your applications must connect directly, encrypt the connections first. Then open the port to your own networks only:

• Require Oracle native network encryption. Add these lines to C:\app\oracle\product\19.0.0\dbhome_1\network\admin\sqlnet.ora:

text SQLNET.ENCRYPTION_SERVER = REQUIRED SQLNET.ENCRYPTION_TYPES_SERVER = (AES256) SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

Alternatively, configure TLS (TCPS) with a wallet as Oracle's Database Security Guide describes. 2. Bind the listener to the instance's private address as well. In listener.ora (same folder), add (ADDRESS = (PROTOCOL = TCP)(HOST = <private-ip>)(PORT = 1521)) next to the 127.0.0.1 address. Then restart the listener service (Restart-Service OracleOraDB19Home1TNSListener) and run ALTER SYSTEM SET LOCAL_LISTENER='(ADDRESS=(PROTOCOL=TCP)(HOST=<private-ip>)(PORT=1521))' SCOPE=BOTH; as SYSDBA. 3. Allow port 1521 in the Windows Firewall from your application network only:

powershell New-NetFirewallRule -DisplayName 'Oracle 1521 from app subnet' -Direction Inbound -Protocol TCP -LocalPort 1521 -RemoteAddress 10.0.0.0/16 -Action Allow

• Add the same source range for TCP 1521 to the instance's security group. Never open 1521 to 0.0.0.0/0.

Change the passwords

Connect as SYSDBA (sqlplus / as sysdba on the instance) and change a password with ALTER USER system IDENTIFIED BY "<new password>";. Or use the SQL*Plus PASSWORD command, which prompts without echoing.

The server accepts only Oracle 12c password verifiers (SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12a), so use an Oracle 12.1.0.2 or newer client. After a change, update or delete oracle-db-credentials.txt.

Metadata service block

Outbound Windows Firewall rules block every Oracle program from the instance metadata service. List the rules:

Get-NetFirewallRule -Group 'sac metadata block' | Select-Object DisplayName, Enabled, Direction, Action | Sort-Object DisplayName

The rules apply to the Oracle programs only. Windows, EC2Launch v2 and the SSM agent keep their metadata access. They all use IMDSv2, which refuses a request without a session token.

View the baseline report

Everything the build measured ships in C:\ProgramData\SecureAnyCloud\baseline\. The folder contains:

File What it is

baseline-report.html Every rule audited, its result and the recommended value; waived rules marked

hardeningkitty-report.csv The raw HardeningKitty audit

baseline-summary.json Rules audited, waived, scored and passed, the pass rate and threshold

waivers.txt / waivers.json The waived rules and why

tool-versions.json The baseline, LGPO, HardeningKitty and Oracle media versions and SHA-256 values

Get-Content C:\ProgramData\sac\baseline\baseline-summary.json | ConvertFrom-Json | Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

HardeningKitty ships no Microsoft finding list for Windows Server 2019. The list used here, finding_list_sac_msft_ws2019_member_machine.csv, is generated from the rules file that Microsoft publishes inside the Windows Server 2019 baseline (MSFT-WS2019-MemberServer-FINAL.PolicyRules). Each rule is therefore scored against Microsoft's own value for Windows Server 2019.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image. Run it in an elevated PowerShell. It only reads settings and takes a minute or two:

$hk = 'C:\ProgramData\sac\tools\HardeningKitty-0.9.4' Import-Module "$hk\HardeningKitty.psm1" -Force $list = "$hk\lists\finding_list_sac_msft_ws2019_member_machine.csv" $csv = Join-Path $env:TEMP 'hardeningkitty-now.csv' Remove-Item $csv -ErrorAction SilentlyContinue $null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1 $waived = (Get-Content -Raw C:\ProgramData\sac\baseline\waivers.json | ConvertFrom-Json).waivers.id $scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID }) $pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count "{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count) $scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules are set differently on purpose. Each one is listed in waivers.txt with its reason:

ID Rule Set to Why

10311 Deny access to this computer from the network Guests The baseline denies network logon to local administrators. Remote Desktop with Network Level Authentication checks the Administrator's password with a network logon first, so the EC2 Administrator could not sign in.

10312 Deny log on through Remote Desktop Services Guests The baseline denies Remote Desktop to every local account. On a stand-alone EC2 instance the local Administrator is the only way in.

10672-10677 Device Guard: Virtualization Based Security and Credential Guard (6 rules) Not configured Credential Guard needs UEFI Secure Boot. This image boots in legacy BIOS mode on EC2, so the policy could not run and a "pass" would be misleading.

Windows Firewall

Every firewall profile is on, with inbound traffic blocked unless a rule allows it. The only inbound rules enabled are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP). Check the rules:

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Patching

Windows is fully patched when the image is built. Check for newer updates with:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher() $searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

Install any updates from Settings, Windows Update (or sconfig option 6). Stop OracleServiceORCL before a restart that Windows asks for.

Oracle Database is the 19.3.0.0.0 base release. Oracle's Release Updates are available only to customers with Oracle support, so SecureAnyCloud does not apply them. Apply the current Release Update with your own My Oracle Support entitlement. Follow Oracle's Database Installation Guide for Microsoft Windows and the Release Update's readme (OPatch from the Oracle home, then datapatch in each container). Check the patch level with:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT version_full FROM v`$instance; EXIT "@ | & $sqlplus -S / as sysdba

Backups

Take database-consistent backups with RMAN (Recovery Manager). Write them to the fast recovery area C:\app\oracle\fast_recovery_area (10 GiB, sized for a starting database) or to another volume, then copy them off the instance, for example to Amazon S3.

EBS snapshots of a running database are crash-consistent only. ARCHIVELOG mode is off by default. Turn it on before you rely on point-in-time recovery.

Oracle VSS Writer

The Oracle VSS Writer service (OracleVssWriterORCL, for Windows Volume Shadow Copy backups of the database) is installed but disabled. It needs the Back up files and directories right. The Microsoft Security Baseline grants that right to Administrators only, so SecureAnyCloud keeps the baseline.

If you use a VSS-based backup product, grant the right to NT SERVICE\OracleVssWriterORCL (Local Security Policy, User Rights Assignment), set the service to Automatic and start it. This deviates from the baseline: HardeningKitty rule 10305 then reports it, and the local policy refresh can take the right back unless you also change the local Group Policy.

Licensing

This image includes no Oracle license. You must hold Oracle Database Enterprise Edition licenses that cover the instance under Oracle's Licensing Oracle Software in the Cloud Computing Environment policy. On AWS, two vCPUs count as one processor license when hyper-threading is enabled.

Database options and management packs (Partitioning, Advanced Security, the Diagnostics and Tuning Packs and others) need their own Oracle licenses. Do not use them without one. The Windows Server license is included in the EC2 charge.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com. Send Oracle licensing questions to Oracle, and Windows Server licensing questions to AWS and Microsoft.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Microsoft and Windows Server are trademarks of the Microsoft group of companies. SecureAnyCloud is not affiliated with or endorsed by Oracle or Microsoft.

Deploy on AWS

Launch Oracle Database 19c EE on Windows Server 2019 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com