Oracle Database Client 21c on Oracle Linux 8

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Oracle Database Client 21c Oracle Linux 8 SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
• Subscription: Select your Azure subscription.
• Resource Group: Create a new group or select an existing one.
• Virtual Machine Name: Enter a name for your VM.
• Region: Select your preferred Azure region.
• Size: Select Standard_B2s (recommended).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) from your trusted IP only.
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oracle-db-21c-client-oel8:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-client-21c-vm \
  --image sac1647283583153:oracle-db-21c-client-oel8:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Important: The Oracle Client makes outbound connections to remote databases on port 1521. You do not need to open port 1521 inbound on this VM. Check your Network Security Group and route table to confirm that the VM can reach your target Oracle Database server on the listener port.

When your VM is running, connect over SSH:

ssh azureuser@<public-ip-address>

To find your VM's public IP address, run:

az vm show --resource-group myResourceGroup --name my-oracle-client-21c-vm --show-details --query publicIps -o tsv

To switch to the root user, run:

sudo su -

Important: Wait for the VM to reach a running state before you connect. Early connection attempts can produce permission denied errors while cloud-init completes the initial provisioning.

The Oracle Client software is owned by the dedicated oracle OS user. Switch to this user and source the environment. Type the command rather than copying and pasting it:

sudo su - oracle cd $HOME . ./setEnv.sh

The setEnv.sh script sets the Oracle environment variables required for utilities such as sqlplus:

ORACLE_BASE=/u01/app/oracle ORACLE_HOME=/u01/app/oracle/product/21c/client_1 TNS_ADMIN=$ORACLE_HOME/network/admin PATH=$ORACLE_HOME/bin:$PATH LD_LIBRARY_PATH=$ORACLE_HOME/lib:$LD_LIBRARY_PATH NLS_LANG=AMERICAN_AMERICA.AL32UTF8

A system-wide hook is also installed at /etc/profile.d/oracle-client.sh. Any future Linux user on the VM picks up the same environment automatically at login.

Before you connect to a remote Oracle Database, add an entry for it to tnsnames.ora. Run the following commands as the oracle user, and replace the example values with your target database details:

cd $HOME . ./setEnv.sh cat >> "$ORACLE_HOME/network/admin/tnsnames.ora" << 'TNS' MY_DATABASE = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = YOUR_DB_HOSTNAME)(PORT = 1521)) ) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = YOUR_SERVICE_NAME) ) ) TNS

Replace the following values:

• YOUR_DB_HOSTNAME with the IP address or DNS name of your Oracle Database server
• 1521 with the port number, if it differs from the default
• YOUR_SERVICE_NAME with the service name of the target database

Verify that Oracle Net can resolve the alias:

tnsping MY_DATABASE

Expected output (common prefix):

TNS Ping Utility for Linux: Version 21.0.0.0.0 - Production Used parameter files: /u01/app/oracle/product/21c/client_1/network/admin/sqlnet.ora Used TNSNAMES adapter to resolve the alias Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = YOUR_DB_HOSTNAME)(PORT = 1521))) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = YOUR_SERVICE_NAME)))

The output continues with one of the following:

• OK (n msec) if YOUR_DB_HOSTNAME resolves and the remote listener accepts the connection. This is what you want to see.
• TNS-12545: Connect failed because target host or object does not exist if YOUR_DB_HOSTNAME is still the example value or cannot otherwise be resolved. This proves that the TNS layer is loading correctly. Replace the example host with a real Oracle database server that you can reach.
• TNS-12541: TNS:no listener if the hostname resolves but nothing is listening on port 1521 at that address. Check that the target database listener is up and reachable from this VM.

Any of the three results means that tnsping is wired correctly. Only the first result means that the full round trip to your target database works.

With the environment sourced and tnsnames.ora populated, connect to your remote database. The simplest form uses the TNS alias you just created:

cd $HOME . ./setEnv.sh sqlplus system/your_password@MY_DATABASE

You can also use the EZCONNECT syntax, which does not require any edit to tnsnames.ora:

sqlplus 'system/your_password@//your-db-host:1521/your-service-name'

Expected output:

SQL*Plus: Release 21.0.0.0.0 Production Copyright (c) 1982, 2021, Oracle. All rights reserved. Connected to: Oracle Database ... SQL>

Type EXIT to leave the SQL*Plus session.

Open the listing on AWS Marketplace, choose View purchase options, and select Subscribe. When the subscription is active, choose Launch your software, then in Version pick Oracle Database Client 21c on Oracle Linux 8.

Choose your Region, an instance type (m5.large is recommended), your key pair, and a security group that opens port 22 from your own networks only. Then launch the instance.

The instance is ready about two minutes after launch.

Replace <ami-id> with the AMI ID of this version in your Region, and replace the other bracketed values with your own. The command requires IMDSv2:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-client-21c}]'

Once the instance is running, retrieve its public address:

aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text

Version SSH user

Oracle Database Client 21c on Oracle Linux 8 ec2-user

ssh -i <your-key.pem> ec2-user@<public-ip>

Check that the first-boot verification has run:

systemctl status sac-oracle-client-firstboot.service --no-pager | head -5 sudo cat /var/log/sac/oracle-client-firstboot.log

The unit is active (exited) with status=0/SUCCESS. The log records how many files of the Oracle home were checked:

● sac-oracle-client-firstboot.service - sac: verify the Oracle Database Client home on first boot Loaded: loaded (/etc/systemd/system/sac-oracle-client-firstboot.service; enabled; vendor preset: disabled) Active: active (exited) since Sat 2026-10-24 21:04:12 EDT; 7min ago Process: 658 ExecStart=/usr/local/sbin/sac-oracle-client-firstboot (code=exited, status=0/SUCCESS) Main PID: 658 (code=exited, status=0/SUCCESS) 2026-10-25T01:03:11Z first boot verification started 2026-10-25T01:04:12Z verified 485 files of the Oracle home; SQL*Plus 21.3.0.0.0

If the unit failed, read /root/oracle-client-FIRSTBOOT-FAILED.txt and contact support.

Your login shell already has the Oracle environment. The command blocks in this guide also source /etc/profile.d/oracle-client.sh first, so they work the same way in a non-login shell:

. /etc/profile.d/oracle-client.sh echo "ORACLE_HOME=$ORACLE_HOME" echo "TNS_ADMIN=$TNS_ADMIN" sqlplus -V ls "$ORACLE_HOME/bin" | grep -xE 'sqlplus|sqlldr|tnsping|exp|imp|expdp|impdp|adrci|orapki|mkstore' | tr '\n' ' '; echo

ORACLE_HOME=/u01/app/oracle/product/21.3.0/client_1 TNS_ADMIN=/u01/app/oracle/product/21.3.0/client_1/network/admin SQL*Plus: Release 21.0.0.0.0 - Production Version 21.3.0.0.0 adrci exp expdp imp impdp mkstore orapki sqlldr sqlplus tnsping

Oracle names every 21c release "Release 21.0.0.0.0". The Version line shows the exact release, here the 21.3.0.0.0 base release.

Path Purpose

/u01/app/oracle/product/21.3.0/client_1 ORACLE_HOME

/u01/app/oracle ORACLE_BASE

$ORACLE_HOME/network/admin TNS_ADMIN: sqlnet.ora and tnsnames.ora

$ORACLE_HOME/jdbc/lib/ojdbc8.jar JDBC Thin driver for Java 8 and later

$ORACLE_HOME/jdbc/lib/ojdbc11.jar JDBC Thin driver for Java 11 and later

$ORACLE_HOME/lib/libclntsh.so OCI client library (C, C++, Python python-oracledb thick mode, Perl, PHP OCI8)

$ORACLE_HOME/lib/libocci.so OCCI C++ client library

$ORACLE_HOME/lib/libsqora.so.21.1 ODBC driver

/u01/app/oraInventory Oracle central inventory

/usr/share/doc/sac/oracle-client-21c/README.txt A summary of this image

The image carries a self-test that repeats the first-boot checks and proves that the client works end to end without a database. It checks Oracle Net name resolution, a connection attempt that reaches the network layer, the exact listening ports, SELinux, every SSH setting, a root login shell that keeps the system libraries, the accounts, and the absence of a compiler:

sudo /usr/local/sbin/sac-oracle-client-selftest

PASS: first-boot verification marker present PASS: no first-boot failure note PASS: Oracle home matches the build manifest (485 files) PASS: login shell: sqlplus -V = 21.3.0.0.0 PASS: wrapper (non-login): sqlplus -V = 21.3.0.0.0 PASS: tnsping: unknown alias refused (TNS-03505) PASS: sqlplus: no listener on this instance (ORA-12541) PASS: only TCP 22 listens PASS: no Oracle listener process PASS: SELinux enforcing PASS: sshd -T passwordauthentication no PASS: sshd -T permitrootlogin no PASS: sshd -T pubkeyauthentication yes PASS: sshd -T x11forwarding no PASS: sshd -T kbdinteractiveauthentication no PASS: sshd -T challengeresponseauthentication no PASS: sshd -T permitemptypasswords no PASS: sshd -T allowtcpforwarding yes PASS: sshd -T maxauthtries 4 PASS: sshd -T clientaliveinterval 300 PASS: sshd -T clientalivecountmax 3 PASS: sshd -T logingracetime 60 PASS: root login shell: no LD_LIBRARY_PATH, system libraries not shadowed (python XML parser loads) PASS: no account carries a password hash, locked or not PASS: no compiler (gcc, cc, c++, g++, make) on the PATH PASS: no core dump or crash report ORACLE_CLIENT_SELFTEST_OK

TNS-03505 and ORA-12541 are the expected answers here. The self-test asks for an alias that does not exist and connects to port 1521 on the instance itself, where no listener runs.

sqlnet.ora resolves names through tnsnames.ora first and then EZCONNECT (host:port/service). You can therefore connect without any configuration, or give each database a short alias. Look at the shipped files:

. /etc/profile.d/oracle-client.sh grep -v '^#' "$TNS_ADMIN/sqlnet.ora" cat "$TNS_ADMIN/tnsnames.ora"

NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT) SQLNET.EXPIRE_TIME = 10 SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
# sac Oracle Database Client 21c - Oracle Net service names.
# Add one entry per database, for example:
#
# MYDB =
# (DESCRIPTION =
# (ADDRESS = (PROTOCOL = TCP)(HOST = db.example.com)(PORT = 1521))
# (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = ORCLPDB1))
# )

The files belong to the oracle software owner, so edit them with sudo. To add an alias, append an entry with your database's host, port and service name:

sudo tee -a /u01/app/oracle/product/21.3.0/client_1/network/admin/tnsnames.ora > /dev/null <<'TNS' MYDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = <db-host>)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = <service-name>)) ) TNS tnsping MYDB

tnsping resolves the alias and contacts the database listener; it ends with OK (<n> msec) when the listener answers. If it reports TNS-12535 or times out, the network path to the database (security groups, network ACLs, routes) does not allow the connection.

To keep your own tnsnames.ora elsewhere, set TNS_ADMIN to that directory in your shell profile.

Connect with the alias, or directly with EZCONNECT. SQL*Plus prompts for the password, which keeps the password out of your shell history and the process list:

sqlplus <db-user>@MYDB sqlplus <db-user>@//<db-host>:1521/<service-name>

For Amazon RDS for Oracle, <db-host> is the DB instance endpoint shown in the RDS console and <service-name> is the database name (ORCL by default). Once connected, run:

SELECT banner_full FROM v$version; SELECT sys_context('USERENV', 'SERVICE_NAME') FROM dual;

Never put a password on the command line (sqlplus user/password@db). Every user of the instance can see it in the process list.

For unattended scripts, use an Oracle wallet (a secure external password store) instead. Create it with mkstore in a directory that only your account can read, add WALLET_LOCATION and SQLNET.WALLET_OVERRIDE = TRUE to your own sqlnet.ora, and connect with sqlplus /@MYDB. The image ships no wallet, and every wallet you create belongs to your instance alone.

Oracle Net traffic is not encrypted unless the client and the server agree to encrypt it. sqlnet.ora carries commented settings for both methods:

• Oracle Native Network Encryption. Uncomment the SQLNET.ENCRYPTION_CLIENT and SQLNET.CRYPTO_CHECKSUM_CLIENT lines (REQUIRED, AES256 and SHA256) to refuse any unencrypted session. The database must accept encryption. Amazon RDS for Oracle enables it with the NATIVE_NETWORK_ENCRYPTION option.
• TLS (TCPS). Create a wallet that holds your database's CA certificate with orapki, point WALLET_LOCATION at the wallet, and use (PROTOCOL = TCPS) and the database's TLS port in the alias. Amazon RDS for Oracle provides TLS with its SSL option and publishes its CA certificates.

. /etc/profile.d/oracle-client.sh grep -n 'ENCRYPTION\|CRYPTO\|WALLET' "$TNS_ADMIN/sqlnet.ora"

9:# SQLNET.ENCRYPTION_CLIENT = REQUIRED 10:# SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256) 11:# SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED 12:# SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256) 14:# WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /path/to/your/wallet)))

Edit sqlnet.ora with sudo, as in step 6. If the database is reachable only through a bastion, an SSH tunnel also works: ssh -N -L 1521:<db-host>:1521 ec2-user@<bastion> and connect to //localhost:1521/<service-name>.

A login shell has the environment from /etc/profile.d/oracle-client.sh. Scripts and cron jobs do not read it. For that reason, sqlplus, sqlldr and tnsping are also installed as wrappers in /usr/local/bin that set the environment for that one command:

cat /usr/local/bin/sqlplus env -i PATH=/usr/local/bin:/usr/bin:/bin sqlplus -V

#!/bin/bash
# sac Oracle Database Client 21c wrapper: sqlplus from any shell (scripts, cron), environment scoped to this call export ORACLE_BASE=/u01/app/oracle export ORACLE_HOME=/u01/app/oracle/product/21.3.0/client_1 export TNS_ADMIN=${TNS_ADMIN:-/u01/app/oracle/product/21.3.0/client_1/network/admin} export NLS_LANG=${NLS_LANG:-AMERICAN_AMERICA.AL32UTF8} export LD_LIBRARY_PATH=/u01/app/oracle/product/21.3.0/client_1/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}} exec /u01/app/oracle/product/21.3.0/client_1/bin/sqlplus "$@" SQL*Plus: Release 21.0.0.0.0 - Production Version 21.3.0.0.0

For other Oracle tools in a script, source the profile first (. /etc/profile.d/oracle-client.sh). Applications use the libraries directly:

• Java: add $ORACLE_HOME/jdbc/lib/ojdbc11.jar (Java 11 and later) or ojdbc8.jar (Java 8) to the classpath and connect with jdbc:oracle:thin:@//<db-host>:1521/<service-name> or jdbc:oracle:thin:@MYDB with -Doracle.net.tns_admin=$TNS_ADMIN.
• OCI and OCCI (C, C++, python-oracledb thick mode, PHP OCI8, Perl DBD::Oracle): set ORACLE_HOME and LD_LIBRARY_PATH=$ORACLE_HOME/lib for the application, as the wrappers do, rather than adding the directory to the system library path.
• ODBC: register $ORACLE_HOME/lib/libsqora.so.21.1 as the driver in your unixODBC odbcinst.ini (install unixODBC with sudo dnf install unixODBC).

This image ships the 21.3.0.0.0 base release. Oracle Database 21c is an Innovation Release. Under Oracle's Lifetime Support Policy (Oracle Technology Products, effective 2 October 2026), Premier Support for 21c runs until July 2027 and Extended Support is not available for it. After July 2027, 21c is in Sustaining Support only, with no new Oracle patches.

Until then, Oracle releases patches for 21c, including the quarterly Release Updates that carry its security fixes, so the base release is well behind the current client patch level. SecureAnyCloud does not apply or redistribute Oracle patches. Customers with an Oracle support contract can download them through My Oracle Support. Apply the current client patches with your own Oracle support entitlement before you run the client in production. These resources help:

• Oracle's Critical Patch Update advisories, which list the security fixes in each quarterly update: https://www.oracle.com/security-alerts/
• The Oracle Database 21c documentation, including patching and upgrading: https://docs.oracle.com/en/database/oracle/oracle-database/21/

Oracle's relink, which Oracle patches run, needs the C and C++ compilers and make, which the image does not ship. Install them first with sudo dnf install gcc gcc-c++ make, from the Oracle Linux 8 repositories. With the compilers present, the install-time link ran cleanly when SecureAnyCloud built this release on Oracle Linux 8. Afterwards, you can remove the compilers with sudo dnf remove gcc gcc-c++ make.

The Oracle home includes Oracle's own Java runtime (Java 8 update 291, from the 21c media) and Perl 5.32 ($ORACLE_HOME/jdk and $ORACLE_HOME/perl), which the Oracle installer and tools use. Oracle's patches update them, not dnf. Use your own current Java runtime for your applications rather than the one in the Oracle home.

The Oracle Linux packages update themselves. dnf-automatic applies Oracle Linux security errata every day. Check it and the pending updates with:

grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer

upgrade_type = security apply_updates = yes enabled

To apply every available update now, run sudo dnf upgrade. Reboot if it installed a new kernel.

sudo ss -tlnp sudo firewall-cmd --list-services getenforce
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|x11forwarding|pubkeyauthentication) '

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1066,fd=3)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1066,fd=4)) dhcpv6-client ssh Enforcing permitrootlogin no pubkeyauthentication yes passwordauthentication no x11forwarding no

• Only SSH listens. The image never needs an inbound port beyond 22, so keep port 1521 closed on this instance.
• The SSH settings live in /etc/ssh/sshd_config.d/00-sac.conf, which sshd_config reads first. Your EC2 key pair is the only way in. Root login and passwords are refused.
• SELinux is enforcing and the host firewall (firewalld) allows SSH only, alongside your security group.
• The instance metadata service accepts IMDSv2 requests only (the AMI requires a session token).