Oracle Database 19c Se2 on Windows Server 2019

Connecting to your instance

Connect with Remote Desktop as the Administrator:

Operating system variant Remote Desktop login user

Windows Server 2019 Datacenter Administrator

Launch from AWS Marketplace

• Open the listing on AWS Marketplace, choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose Oracle Database 19c SE2 on Windows Server 2019 as the software version, then choose your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended starting size. For production, use a larger instance of up to 8 vCPUs (for example m5.2xlarge or r5.2xlarge), which is the Standard Edition 2 limit on AWS. The database uses 40% of the instance's memory.
• Choose a key pair. You need its private key to get the Administrator password.
• Use a security group that allows RDP (TCP 3389) from your own address only. Do not open 1521.
• Optional but recommended: attach an IAM instance profile with the AmazonSSMManagedInstanceCore policy. It lets you reach the database from your workstation with Session Manager port forwarding, without opening any port (see Connect from your workstation).
• Launch the instance. The root volume is 100 GiB (the Oracle home plus your database), and you can choose a larger volume at launch.

First boot: the database is created on your instance

After Windows finishes its first boot, a one-time task creates the database. On a 2-vCPU, 8 GiB instance such as m5.large, Windows setup takes about 6 minutes and creating the database takes 20 to 22 minutes. Allow 35 minutes in all, and note that larger instances are faster. The Administrator password is ready after about four minutes, so you can sign in and watch. Check progress in PowerShell:

Get-Content C:\ProgramData\sac\oracle-firstboot.log -Tail 15

The database is ready when the log ends with READY and the ready marker exists:

Get-Content C:\ProgramData\sac\oracle-firstboot.done | ConvertFrom-Json | Select-Object ok, seconds, dbid, sid, pdb, version, finishedUtc

The seconds value is how long your database took to create, and dbid is your database's own ID. To follow the log live in a Remote Desktop session, run Get-Content C:\ProgramData\SecureAnyCloud\oracle-firstboot.log -Wait.

If first boot fails, the file C:\ProgramData\SecureAnyCloud\oracle-firstboot.failed explains why, the database stays stopped and no passwords are written. Restart the instance to try again. Each of up to three attempts starts from a clean slate. You can also contact SecureAnyCloud support.

Get the Administrator password

In the EC2 console, select the instance and choose Actions, Security, Get Windows password. Upload the private key of your key pair and choose Decrypt password. Alternatively, run this AWS CLI command on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password. Try again a minute later.

Connect over Remote Desktop

Use a Remote Desktop client that supports Network Level Authentication (Microsoft Remote Desktop on Windows and macOS, FreeRDP on Linux). Connect to the instance's public DNS name or IP address on port 3389 as Administrator, with the password from the previous step. Each instance generates its own Remote Desktop certificate, so your client asks you to trust it on first connection.

Read your database passwords

In the Remote Desktop session, open an elevated PowerShell (or File Explorer) and read the credentials file:

Get-Content C:\ProgramData\sac\oracle\oracle-db-credentials.txt

Key What it is

ORACLE_SID / CDB_SERVICE ORCL, the container database

PDB_SERVICE ORCLPDB1, the pluggable database for your schemas

LISTENER 127.0.0.1:1521

SYS_PASSWORD, SYSTEM_PASSWORD, PDBADMIN_PASSWORD The passwords generated on this instance

Store the passwords in your password manager. If you copy them anywhere else, change them (see Change the passwords).

Connect with SQL*Plus on the instance

The local Administrator is a member of the ORA_DBA group, so SQL*Plus on the instance can connect as SYSDBA with operating system authentication and no password. Check the database:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT name, dbid, open_mode, cdb, created FROM v`$database; SELECT con_id, name, open_mode FROM v`$pdbs; SELECT banner_full FROM v`$version; EXIT "@ | & $sqlplus -S / as sysdba

With operating system authentication, any member of the local Administrators (or ORA_DBA) group on the instance can connect as SYSDBA without a password. This is how Oracle on Windows works by design. Connections from anywhere else always need the password. The listener is loopback-only, and a client that is not a local administrator must supply the SYS password.

To work in the pluggable database as SYSTEM or PDBADMIN, connect through the listener. SQL*Plus prompts for the password, so it never appears on the command line:

sqlplus system@//127.0.0.1:1521/ORCLPDB1 sqlplus pdbadmin@//127.0.0.1:1521/ORCLPDB1 sqlplus sys@//127.0.0.1:1521/ORCL as sysdba

Only SYS, SYSTEM and PDBADMIN are open accounts. Oracle's other built-in accounts stay locked. List the open accounts:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT con_id, username, account_status FROM cdb_users WHERE account_status = 'OPEN' ORDER BY con_id, username; EXIT "@ | & $sqlplus -S / as sysdba

Services and the listener

Two Windows services run the database, and both start automatically:

Get-Service OracleServiceORCL, OracleOraDB19Home1TNSListener | Select-Object Name, Status, StartType Get-CimInstance Win32_Service -Filter "Name='OracleServiceORCL'" | Select-Object Name, StartName

The listener answers on the loopback address only:

Get-NetTCPConnection -State Listen -LocalPort 1521 | Select-Object LocalAddress, LocalPort, OwningProcess & 'C:\app\oracle\product\19.0.0\dbhome_1\bin\lsnrctl.exe' status | Select-String 'Connecting to|DESCRIPTION|Service "'

To stop and start the database cleanly, use the services, and stop the database before the listener:

Stop-Service OracleServiceORCL Start-Service OracleServiceORCL

Connect from your workstation

The listener is loopback-only, so the safest way to use a client on your workstation (SQL Developer, SQLcl, an application) is AWS Systems Manager Session Manager port forwarding, which needs no inbound port at all. Use the instance profile from the launch step, and install the Session Manager plugin on your workstation. Then run:

aws ssm start-session --region <region> --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters portNumber=1521,localPortNumber=1521

Leave the session running and connect your client to localhost:1521, service ORCLPDB1.

Accept direct client connections

If your applications must connect directly, encrypt the connections first, then open the port to your own networks only.

• Require Oracle native network encryption. Add these lines to C:\app\oracle\product\19.0.0\dbhome_1\network\admin\sqlnet.ora:

text SQLNET.ENCRYPTION_SERVER = REQUIRED SQLNET.ENCRYPTION_TYPES_SERVER = (AES256) SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

Alternatively, configure TLS (TCPS) with a wallet, as Oracle's Database Security Guide describes. Then continue with steps 2 and 3.

2. Bind the listener to the instance's private address as well. In listener.ora (same folder), add (ADDRESS = (PROTOCOL = TCP)(HOST = <private-ip>)(PORT = 1521)) next to the 127.0.0.1 address. Restart the listener service (Restart-Service OracleOraDB19Home1TNSListener), then run ALTER SYSTEM SET LOCAL_LISTENER='(ADDRESS=(PROTOCOL=TCP)(HOST=<private-ip>)(PORT=1521))' SCOPE=BOTH; as SYSDBA.

3. Allow 1521 in the Windows Firewall from your application network only:

powershell New-NetFirewallRule -DisplayName 'Oracle 1521 from app subnet' -Direction Inbound -Protocol TCP -LocalPort 1521 -RemoteAddress 10.0.0.0/16 -Action Allow

• Add the same source range for TCP 1521 to the instance's security group. Never open 1521 to 0.0.0.0/0.

Change the passwords

Connect as SYSDBA (sqlplus / as sysdba on the instance) and change a password with ALTER USER system IDENTIFIED BY "<new password>";, or use the SQL*Plus PASSWORD command, which prompts without echoing. The server accepts only Oracle 12c password verifiers (SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12a), so use an Oracle 12.1.0.2 or newer client. After you change a password, update or delete oracle-db-credentials.txt.

Metadata service block

Outbound Windows Firewall rules block every Oracle program from the instance metadata service. List the rules:

Get-NetFirewallRule -Group 'sac metadata block' | Select-Object DisplayName, Enabled, Direction, Action | Sort-Object DisplayName

The rules apply to the Oracle programs only. Windows, EC2Launch v2 and the SSM agent keep their metadata access, and they all use IMDSv2, which refuses a request without a session token.

View the baseline report

The build writes everything it measured to C:\ProgramData\SecureAnyCloud\baseline\. The folder contains:

File What it is

baseline-report.html Every rule audited, its result and the recommended value; waived rules marked

hardeningkitty-report.csv The raw HardeningKitty audit

baseline-summary.json Rules audited, waived, scored and passed, the pass rate and threshold

waivers.txt / waivers.json The waived rules and why

tool-versions.json The baseline, LGPO, HardeningKitty and Oracle media versions and SHA-256 values

Get-Content C:\ProgramData\sac\baseline\baseline-summary.json | ConvertFrom-Json | Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

HardeningKitty ships no Microsoft finding list for Windows Server 2019. The list used here, finding_list_sac_msft_ws2019_member_machine.csv, is generated from the rules file that Microsoft publishes inside the Windows Server 2019 baseline (MSFT-WS2019-MemberServer-FINAL.PolicyRules). Each rule is therefore scored against Microsoft's own value for Windows Server 2019.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image. Run it in an elevated PowerShell. It only reads settings and takes a minute or two:

$hk = 'C:\ProgramData\sac\tools\HardeningKitty-0.9.4' Import-Module "$hk\HardeningKitty.psm1" -Force $list = "$hk\lists\finding_list_sac_msft_ws2019_member_machine.csv" $csv = Join-Path $env:TEMP 'hardeningkitty-now.csv' Remove-Item $csv -ErrorAction SilentlyContinue $null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1 $waived = (Get-Content -Raw C:\ProgramData\sac\baseline\waivers.json | ConvertFrom-Json).waivers.id $scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID }) $pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count "{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count) $scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules are set differently on purpose. waivers.txt lists each one with its reason:

ID Rule Set to Why

10311 Deny access to this computer from the network Guests The baseline denies network logon to local administrators. Remote Desktop with Network Level Authentication checks the Administrator's password with a network logon first, so the EC2 Administrator could not sign in.

10312 Deny log on through Remote Desktop Services Guests The baseline denies Remote Desktop to every local account. On a stand-alone EC2 instance the local Administrator is the only way in.

10672-10677 Device Guard: Virtualization Based Security and Credential Guard (6 rules) Not configured Credential Guard needs UEFI Secure Boot. This image boots in legacy BIOS mode on EC2, so the policy could not run and a "pass" would be misleading.

Windows Firewall

Every firewall profile is on, and inbound traffic is blocked unless a rule allows it. The only enabled inbound rules are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP):

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Patching

Windows is fully patched when the image is built. Check for newer updates with:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher() $searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

Install any updates from Settings, Windows Update (or sconfig option 6). Stop OracleServiceORCL before a restart that Windows requests.

Oracle Database is the 19.3.0.0.0 base release. Oracle's Release Updates are available only to customers with Oracle support, so SecureAnyCloud does not apply them. Apply the current Release Update with your own My Oracle Support entitlement. Follow Oracle's Database Installation Guide for Microsoft Windows and the Release Update's readme (OPatch from the Oracle home, then datapatch in each container). Check the patch level with:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe' @" SET PAGESIZE 50 LINESIZE 150 SELECT version_full FROM v`$instance; EXIT "@ | & $sqlplus -S / as sysdba

Backups

Take database-consistent backups with RMAN (Recovery Manager) to the fast recovery area C:\app\oracle\fast_recovery_area (10 GiB, sized for a starting database) or to another volume. Copy the backups off the instance, for example to Amazon S3. EBS snapshots of a running database are crash-consistent only. ARCHIVELOG mode is off by default, so turn it on before you rely on point-in-time recovery.

Oracle VSS Writer

The Oracle VSS Writer service (OracleVssWriterORCL, for Windows Volume Shadow Copy backups of the database) is installed but disabled. It needs the Back up files and directories right, which the Microsoft Security Baseline grants to Administrators only, so SecureAnyCloud keeps the baseline. If you use a VSS-based backup product, grant the right to NT SERVICE\OracleVssWriterORCL (Local Security Policy, User Rights Assignment), set the service to Automatic and start it. This deviates from the baseline. HardeningKitty rule 10305 then reports it, and the local policy refresh can take the right back unless you also change the local Group Policy.

Licensing

This image includes no Oracle licence. You must hold Oracle Database Standard Edition 2 licences that cover the instance under Oracle's Licensing Oracle Software in the Cloud Computing Environment policy. On AWS, Standard Edition 2 may run only on instances of up to 8 vCPUs, and every 4 vCPUs count as one socket, so this listing offers instance types of up to 8 vCPUs only. Standard Edition 2 does not include the Enterprise Edition options and management packs (Partitioning, Advanced Security, the Diagnostics and Tuning Packs and others), and a Standard Edition 2 container database holds up to three pluggable databases. The Windows Server licence is included in the EC2 charge.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com. Oracle licensing questions go to Oracle; Windows Server licensing questions go to AWS and Microsoft.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Microsoft and Windows Server are trademarks of the Microsoft group of companies. SecureAnyCloud is not affiliated with or endorsed by Oracle or Microsoft.

Deploy on AWS

Launch Oracle Database 19c SE2 on Windows Server 2019 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com