Deployment guide

Oracle Database 21c Xe on Oracle Linux 8

Overview

This guide shows how to deploy and configure Oracle Database 21c Express Edition on Oracle Linux 8 on Microsoft Azure. It uses the preconfigured SecureAnyCloud virtual machine image from the Azure Marketplace. Oracle Database 21c Express Edition is the free-to-use edition of Oracle Database, suited to development, learning and small production workloads, and this image carries no licence cost.

What you get:

Oracle Database 21c Express Edition 21.3.0.0.0 (64-bit) installed at /opt/oracle
A preconfigured XE container database with the XEPDB1 pluggable database, ready to start
Oracle Listener preconfigured on port 1521
A dedicated oracle OS user with environment scripts
Helper scripts to start and stop the database and listener
Randomly generated SYSTEM user credentials
An OS package update script to keep the system current
Azure Linux Agent (waagent) for Azure integration
cloud-init for automated provisioning
Latest security patches applied at build time
24/7 SecureAnyCloud support with guaranteed 24 hour response SLA

Platform: Microsoft Azure (Gen2 Hyper-V) Default user: azureuser Database SID: XE Pluggable database: XEPDB1

Prerequisites

Before you deploy this image, make sure you have:

An active Microsoft Azure subscription
Access to the Azure Portal or Azure CLI
An SSH key pair for Linux VM access
Familiarity with Azure VM management

Recommended VM size: Standard_D2s_v3 (2 vCPU, 8 GB RAM) or larger. The minimum requirements are 2 vCPU, 2 GB RAM and 20 GB disk space. Oracle Database 21c Express Edition performs better with additional memory.

Deploy the virtual machine

Option A: Azure Portal

Open the Azure Marketplace and search for "Oracle Database 21c Express Edition Oracle Linux 8 SecureAnyCloud".
Select the image and click Create.
Configure the basics:
- Subscription: Select your Azure subscription.
- Resource Group: Create a new group or select an existing one.
- Virtual Machine Name: Enter a name for your VM.
- Region: Select your preferred Azure region.
- Size: Select Standard_D2s_v3 (recommended).
Under Administrator Account, select SSH public key and enter your key.
Under Inbound Port Rules, allow SSH (port 22).
On the Networking tab, add an inbound rule for TCP port 1521 from your trusted IP addresses.
Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oracle-db-21c-xe:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-db-21c-xe-vm \
  --image sac1647283583153:oracle-db-21c-xe:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 1521 for Oracle Listener access from your trusted IP address:

az vm open-port \
  --resource-group myResourceGroup \
  --name my-oracle-db-21c-xe-vm \
  --port 1521 \
  --priority 1010

Important: Restrict port 1521 to trusted application servers or your own IP address. Do not open the Oracle Listener port to the public internet.

Connect over SSH

When your VM is running, connect over SSH:

ssh azureuser@<public-ip-address>

To find your VM's public IP address, run:

az vm show --resource-group myResourceGroup --name my-oracle-db-21c-xe-vm --show-details --query publicIps -o tsv

Important: Wait for the VM to reach the running state before you connect. Early connection attempts can fail with permission denied errors while cloud-init completes the initial provisioning.

Switch to the oracle user

The dedicated oracle OS user owns the Oracle software. Switch to this user to manage the database. Type this command rather than copying and pasting it:

sudo su - oracle

The oracle user's home directory contains three scripts:

setEnv.sh sets the Oracle environment variables, which enables utilities such as sqlplus.
start_all.sh starts the XE database and its Oracle Listener.
stop_all.sh stops the XE database and its Oracle Listener.

Start the Oracle Database and listener

As the oracle user, run these commands to start the database and listener:

cd $HOME . ./start_all.sh

Expected output:

LSNRCTL for Linux: Version 21.0.0.0.0 - Production Starting /opt/oracle/product/21c/dbhomeXE/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 21.0.0.0.0 - Production Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=0.0.0.0)(PORT=1521))) The command completed successfully SQL*Plus: Release 21.0.0.0.0 Production Connected to an idle instance. SQL> ORACLE instance started. Database mounted. Database opened.

Connect with SQL*Plus

Set the Oracle environment variables and launch SQL*Plus:

cd $HOME . ./setEnv.sh sqlplus / as sysdba

Expected output:

SQL*Plus: Release 21.0.0.0.0 Production Copyright (c) 1982, 2021, Oracle. All rights reserved. Connected to: Oracle Database 21c Express Edition Release 21.0.0.0.0 - Production Version 21.3.0.0.0 SQL>

Check the database instance and the pluggable database:

SELECT STATUS FROM V$INSTANCE; SHOW PDBS; EXIT;

Expected output:

STATUS ------------ OPEN CON_ID CON_NAME OPEN MODE RESTRICTED ---------- ------------------------------ ---------- ---------- 2 PDB$SEED READ ONLY NO 3 XEPDB1 READ WRITE NO

Type EXIT to leave the SQL*Plus session.

Connect remotely with SQL Developer

To connect to the database from an external tool such as SQL Developer, use these connection settings:

Setting Value

Database Type Oracle

Authentication Type Default

Username SYSTEM

Password See credentials file below

Connection Type Basic

Hostname Your VM public IP

Port 1521

Service Name XEPDB1

Note: The randomly generated SYSTEM user password is in the credentials file at /stage/scripts/oracle-database-credentials.log.

Server components

Component Version Install Path

Oracle Database 21c Express Edition 21.3.0.0.0 /opt/oracle/product/21c/dbhomeXE

Oracle Linux 8 /

Oracle Listener 21.3.0.0.0 /opt/oracle/product/21c/dbhomeXE/network/admin

Note: The automatic OS package update script can update component versions on first boot.

Filesystem layout

Mount Point Size Description

/ 30 GB Root filesystem

/boot 1 GB Operating system kernel files

/opt/oracle 20 GB Oracle software and data files

Key Oracle directories:

Directory Purpose

/opt/oracle Oracle base directory

/opt/oracle/product/21c/dbhomeXE Oracle home directory

/opt/oracle/oradata/XE Oracle database data files

/opt/oracle/product/21c/dbhomeXE/network/admin Listener and TNS configuration files

/opt/oracle/diag Oracle diagnostic and alert log files

/stage/scripts SecureAnyCloud helper scripts and credentials file

Manage the Oracle Database

You manage the Oracle Database with the shell scripts in the oracle user's home directory. This image does not use systemd services for the database by default.

Start the database and listener:

sudo su - oracle cd $HOME . ./start_all.sh

Stop the database and listener:

sudo su - oracle cd $HOME . ./stop_all.sh

Check the listener status:

sudo su - oracle cd $HOME . ./setEnv.sh lsnrctl status

Scripts and log files

Script/Log Path Description

initial_boot_update.sh /stage/scripts Updates the OS with the latest packages on first boot

initial_boot_update.log /stage/scripts Output log for the boot update script

oracle-database-credentials.log /stage/scripts Oracle Database SYSTEM user credentials

setEnv.sh /home/oracle Sets Oracle environment variables for sqlplus and other tools

start_all.sh /home/oracle Starts the XE database and Oracle Listener

stop_all.sh /home/oracle Stops the XE database and Oracle Listener

On startup

An OS package update script runs on first boot to bring the image up to date. To disable it, remove the script and its crontab entry:

sudo rm -f /stage/scripts/initial_boot_update.sh
sudo crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Cannot connect over SSH

Check that the VM is in the Running state in the Azure Portal.
Check that the Network Security Group allows port 22.
Check that you are using the correct username: azureuser.
Check that your SSH key matches the one you configured during deployment.

Oracle Listener fails to start

Switch to the oracle user: sudo su - oracle.
Source the environment: . ./setEnv.sh.
Check the listener status: lsnrctl status.
Review the listener log at /opt/oracle/diag/tnslsnr/<hostname>/listener/alert/log.xml.
Check that no other process uses port 1521: netstat -tlnp | grep 1521.

Database fails to start

Switch to the oracle user and source the environment.
Connect to SQL*Plus: sqlplus / as sysdba.
Check the instance status: SELECT STATUS FROM V$INSTANCE;.
Start the database manually: STARTUP;.
Review the alert log at /opt/oracle/diag/rdbms/xe/XE/trace/alert_XE.log.

Cannot connect remotely on port 1521

Check that the Oracle Listener is running: lsnrctl status.
Check that the Network Security Group allows inbound TCP port 1521 from your IP address.
Test connectivity from your client: telnet <vm-ip> 1521.
Check that your SQL Developer connection uses the service name XEPDB1, not the old SID style.
Check that the listener.ora file binds to 0.0.0.0 on the VM.

Security Recommendations

Restrict port access: Allow port 1521 only from trusted application servers or specific IP addresses.
Change default passwords: Update the SYSTEM and SYS user passwords immediately after your first login.
Use strong passwords: Make sure all database user passwords meet complexity requirements.
Enable auditing: Configure Oracle Database auditing to track access and changes.
Encrypt connections: Configure Oracle Net Services to use SSL/TLS encryption for client connections.
Limit OS access: Restrict SSH access to authorised administrators.
Review user privileges: Remove unnecessary grants and follow the principle of least privilege.
Keep the system updated: Apply Oracle Critical Patch Updates and OS security patches regularly.

Support

If you have any issues with this product, contact SecureAnyCloud support:

Email: sales@secureanycloud.com
Website: secureanycloud.com
Product Catalogue: secureanycloud.com/products
User Guides: secureanycloud.com/guides
Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Oracle Database 21c Express Edition on Oracle Linux 8 on Azure, with 24/7 support from SecureAnyCloud.

View this image

Need help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure