Oracle Database Client 19c on Windows Server 2019

Connecting to your instance

Connect with Remote Desktop as the Administrator. The login user for Windows Server 2019 Datacenter is Administrator.

Launch from AWS Marketplace

• Open the listing on AWS Marketplace, choose View purchase options, then choose Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose Oracle Database Client 19c on Windows Server 2019 as the software version, then choose your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended size. The listing offers instance types of up to 8 vCPUs.
• Choose a key pair. You need its private key to get the Administrator password.
• Choose the VPC and subnet from which the instance can reach your database's listener port (1521 by default).
• Use a security group that allows RDP (TCP 3389) from your own address only. The client needs no inbound port. It only makes outbound connections to your databases.
• Launch the instance. The root volume is 75 GiB, and you can choose a larger volume at launch.

There is no first-boot setup. The instance is ready as soon as Windows finishes starting and the Administrator password is available, usually within five minutes.

Get the Administrator password

In the EC2 console, select the instance and choose Actions, Security, Get Windows password. Upload the private key of your key pair and choose Decrypt password. Alternatively, use the AWS CLI on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password. Try again a minute later.

Connect over Remote Desktop

Use a Remote Desktop client that supports Network Level Authentication (Microsoft Remote Desktop on Windows and macOS, FreeRDP on Linux). Connect to the instance's public DNS name or IP address on port 3389 as Administrator, with the password from the previous step.

Each instance generates its own Remote Desktop certificate, so your client asks you to trust it on your first connection.

Check the client

Open PowerShell in the Remote Desktop session. The client's bin folder is on the machine PATH, so the tools run from any new Command Prompt or PowerShell window. Run:

Get-Command sqlplus, sqlldr, tnsping, expdp, impdp, exp, imp, rman | Select-Object Name, Source sqlplus -V

sqlplus -V prints Version 19.3.0.0.0. Windows also has the Oracle home registered. Check it:

Get-ChildItem HKLM:\SOFTWARE\ORACLE | Where-Object { $_.PSChildName -like 'KEY_*' } | ForEach-Object { Get-ItemProperty $_.PSPath } | Select-Object ORACLE_HOME_NAME, ORACLE_HOME

Connect to a database

First check that the instance can reach the database's listener. Replace the host and port with your own:

Test-NetConnection your-db-host -Port 1521

TcpTestSucceeded : True means the network path is open. If it is False, allow this instance (or its security group) inbound on the database side, and check the route between the two networks.

Connect with Easy Connect, which needs no configuration file. SQL*Plus asks for the password, so the password never appears on the command line or in your PowerShell history:

sqlplus your_user@//your-db-host:1521/your_service

To use short names instead, add an entry to tnsnames.ora in C:\app\oracle\product\19.0.0\client_1\network\admin. The file includes a commented example:

Add-Content C:\app\oracle\product\19.0.0\client_1\network\admin\tnsnames.ora ` 'MYDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = your-db-host)(PORT = 1521)) (CONNECT_DATA = (SERVICE_NAME = your_service)))' tnsping MYDB sqlplus your_user@MYDB

For Amazon RDS for Oracle, the host is the DB instance's endpoint and the service is its database name (for example ORCL).

The database versions of this listing keep their listener on 127.0.0.1. To reach one, follow that version's guide to use Session Manager port forwarding, or to open the listener to your network first.

Load and move data

SQL*Loader loads a text file into a table, driven by a control file you write:

sqlldr your_user@//your-db-host:1521/your_service control=C:\data\load.ctl log=C:\data\load.log

Data Pump (expdp, impdp) runs the export or import on the database server. It writes the dump file to a directory object on the server (for example DATA_PUMP_DIR), not to this instance:

expdp your_user@//your-db-host:1521/your_service schemas=YOUR_SCHEMA directory=DATA_PUMP_DIR dumpfile=your_schema.dmp logfile=your_schema_exp.log

The original exp and imp tools write their dump file on this instance. The RMAN client connects to a target database to run its backups.

Libraries for your applications

The libraries that applications use to reach Oracle are in the Oracle home:

• OCI (C, and the drivers built on it): C:\app\oracle\product\19.0.0\client_1\bin\oci.dll
• ODBC: C:\app\oracle\product\19.0.0\client_1\bin\sqora32.dll
• ODP.NET (unmanaged and managed): C:\app\oracle\product\19.0.0\client_1\ODP.NET\
• JDBC (Java 8 and later): C:\app\oracle\product\19.0.0\client_1\jdbc\lib\ojdbc8.jar

To confirm that the files are present, run:

$oh = 'C:\app\oracle\product\19.0.0\client_1' 'bin\oci.dll', 'bin\sqora32.dll', 'ODP.NET\managed\common\Oracle.ManagedDataAccess.dll', 'jdbc\lib\ojdbc8.jar' | ForEach-Object { '{0,-55} {1}' -f $_, (Test-Path (Join-Path $oh $_)) }

No Oracle service

A client home runs no Oracle service and opens no port. If the installer registered a service, SecureAnyCloud sets it to Disabled. The only service the client can register is the Oracle MTS Recovery Service, which is used only with Microsoft Transaction Server and COM+. List any Oracle services:

Get-CimInstance Win32_Service | Where-Object { $_.Name -like 'Oracle*' } | Select-Object Name, State, StartMode

If you use Microsoft Transaction Server with Oracle, set that service to Automatic and start it yourself.

Metadata service block

Every program in the Oracle home has an outbound Windows Firewall rule that blocks the instance metadata service (169.254.169.254) and 168.63.129.16. EC2Launch, the SSM agent and your own tools keep their access. Check the rules:

$rules = @(Get-NetFirewallRule -Group 'sac metadata block') "{0} outbound rules block the instance metadata service for programs in the Oracle home" -f $rules.Count $rules | Select-Object -First 5 DisplayName, Direction, Action, Enabled

If you later add programs to the Oracle home (for example, when you apply a Release Update), add the same rule for them.

View the baseline report

Everything the build measured is in C:\ProgramData\SecureAnyCloud\baseline\:

• baseline-report.html: every rule audited, its result and the recommended value, with waived rules marked
• hardeningkitty-report.csv: the raw HardeningKitty audit
• baseline-summary.json: the rules audited, waived, scored and passed, plus the pass rate and threshold
• waivers.txt / waivers.json: the waived rules and the reason for each
• tool-versions.json: the baseline, LGPO, HardeningKitty and Oracle media versions and SHA-256 values

To read the summary, run:

Get-Content C:\ProgramData\sac\baseline\baseline-summary.json | ConvertFrom-Json | Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

HardeningKitty includes no Microsoft finding list for Windows Server 2019. The list used here, finding_list_sac_msft_ws2019_member_machine.csv, is built from the rules file that Microsoft publishes inside the Windows Server 2019 baseline (MSFT-WS2019-MemberServer-FINAL.PolicyRules). Each rule is therefore scored against Microsoft's own value for Windows Server 2019.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image. Run it in an elevated PowerShell. It only reads settings and takes a minute or two:

$hk = 'C:\ProgramData\sac\tools\HardeningKitty-0.9.4' Import-Module "$hk\HardeningKitty.psm1" -Force $list = "$hk\lists\finding_list_sac_msft_ws2019_member_machine.csv" $csv = Join-Path $env:TEMP 'hardeningkitty-now.csv' Remove-Item $csv -ErrorAction SilentlyContinue $null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1 $waived = (Get-Content -Raw C:\ProgramData\sac\baseline\waivers.json | ConvertFrom-Json).waivers.id $scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID }) $pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count "{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count) $scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules are set differently on purpose. Each one is listed in waivers.txt with its reason:

• 10311, Deny access to this computer from the network (set to Guests). The baseline denies network logon to local administrators. Remote Desktop with Network Level Authentication first checks the Administrator's password with a network logon, so the EC2 Administrator could not sign in.
• 10312, Deny log on through Remote Desktop Services (set to Guests). The baseline denies Remote Desktop to every local account. On a stand-alone EC2 instance, the local Administrator is the only way in.
• 10672-10677, Device Guard: Virtualization Based Security and Credential Guard, 6 rules (set to Not configured). Credential Guard needs UEFI Secure Boot. This image boots in legacy BIOS mode on EC2, so the policy could not run and a "pass" would be misleading.

Windows Firewall

Every firewall profile is on, with inbound traffic blocked unless a rule allows it. The only enabled inbound rules are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP). Verify them:

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Outbound connections (to your databases) are allowed.

Patching

Windows is fully patched when the image is built. To check for newer updates, run:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher() $searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

Install any updates from Settings, Windows Update (or sconfig option 6).

Oracle Database Client is the 19.3.0.0.0 base release. Oracle's Release Updates are available only to customers with Oracle support, so SecureAnyCloud does not apply them. Apply the current 19c Release Update with your own My Oracle Support entitlement, following the Release Update's readme (OPatch from the Oracle home). Close every program that uses the client first. Check the version with sqlplus -V.

Licensing

This image includes no Oracle license. Oracle does not charge for the Oracle Database Client itself, which you use under Oracle's license terms. You must license every Oracle Database you connect to. For a database version of this listing, that means Oracle Database Standard Edition 2 licenses, on instances of up to 8 vCPUs. The Windows Server license is included in the EC2 charge.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat, 365 days a year, with a 24-hour response SLA. Contact sales@secureanycloud.com. Send licensing questions to Oracle.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Microsoft and Windows Server are trademarks of the Microsoft group of companies. SecureAnyCloud is not affiliated with or endorsed by Oracle or Microsoft.

Deploy on AWS

Launch Oracle Database Client 19c on Windows Server 2019 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com