Oracle Database Client 23ai on Oracle Linux 9

Option A: Azure Portal

• Open the Oracle Database Client 23ai (23.26) on Oracle Linux 9 listing on the Azure Marketplace and choose Get it now, then Create.
• Configure the basics:
• Subscription: Select your Azure subscription.
• Resource Group: Create a new group or select an existing one.
• Virtual Machine Name: Enter a name for your VM.
• Region: Select your preferred Azure region.
• Size: Select a size for your workload.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22), ideally from your own network only.
• Click Review + Create, then click Create.

Option B: Azure CLI

The image carries a Marketplace purchase plan. Accept its terms once per subscription, then create the virtual machine. Replace <your-vm-size> with the size you chose:

az vm image terms accept --urn sac1647283583153:oracle-db-23ai-client-oel9:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-client-vm \
  --image sac1647283583153:oracle-db-23ai-client-oel9:default:latest \
  --size <your-vm-size> \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The Oracle Client makes only outbound connections, so the virtual machine needs no inbound port other than SSH. Do not open port 1521 inbound on it. Instead, check that its network security group, route table and any peering or VPN let it reach your database's listener.

On your own workstation, find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-client-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, the key your client is offering is not the key you supplied at create time.

The first-boot update

On its first boot, the image brings its operating system packages up to date. Root's crontab runs /stage/scripts/initial_boot_update.sh (dnf update -y) once, in the background, and logs to /stage/scripts/initial_boot_update.log.

On the virtual machine we checked, the update applied 841 package changes and took about twenty minutes. Check on its progress with:

tail -n 3 /stage/scripts/initial_boot_update.log

The update has finished when the log ends with:

=== dnf update exit code: 0 === === Initial boot OS update finished ... ===

After a clean run the script removes itself and its crontab entry, so it never runs again.

New SSH connections can be refused while the update runs. The update upgrades OpenSSH. Until the SSH service restarts at the end of the update, new connections fail with kex_exchange_identification: read: Connection reset by peer. On the virtual machine we checked, this lasted about eleven minutes, starting roughly five minutes after boot.

A session that is already open stays connected. If you see that message on a new virtual machine, wait a few minutes and connect again. Do not run dnf yourself until the update has finished, because the update holds the package lock.

The profile hook puts the client on every user's PATH, so azureuser can check the release straight away:

sqlplus -V

Expected output:

SQL*Plus: Release 23.26.1.0.0 - Production Version 23.26.1.0.0

The oracle user owns the Oracle home and its Oracle Net configuration. Switch to that user and load its environment:

sudo su - oracle . ./setEnv.sh env | grep -E "^(ORACLE_|TNS_)" | sort

Expected output:

ORACLE_BASE=/u01/app/oracle ORACLE_HOME=/u01/app/oracle/product/23.0.0/client_1 TNS_ADMIN=/u01/app/oracle/product/23.0.0/client_1/network/admin

setEnv.sh also sets PATH, LD_LIBRARY_PATH and NLS_LANG=AMERICAN_AMERICA.AL32UTF8.

List the main command-line tools in the Oracle home:

ls $ORACLE_HOME/bin | grep -xE "sqlplus|sqlldr|tnsping|expdp|impdp|exp|imp|rman|adrci|tkprof|mkstore|orapki"

Expected output:

adrci exp expdp imp impdp mkstore orapki rman sqlldr sqlplus tkprof tnsping

Each tool reports the same release. For example, sqlldr with no arguments and expdp help=y both print their banner first:

SQL*Loader: Release 23.26.1.0.0 - Production on ... Export: Release 23.26.1.0.0 - Production on ...

The Oracle home also carries SQLcl ($ORACLE_HOME/bin/sql). SQLcl needs Java 11 or later, and the image's Java is OpenJDK 8, so sql stops with Error: SQLcl requires Java 11 and above to run. Use SQL*Plus instead.

Oracle Net reads its configuration from $TNS_ADMIN. The image's sqlnet.ora looks up names in tnsnames.ora first, then accepts Easy Connect strings:

cat $TNS_ADMIN/sqlnet.ora

Expected output:

NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT) SQLNET.EXPIRE_TIME = 10 SQLNET.INBOUND_CONNECT_TIMEOUT = 60 SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60

tnsnames.ora holds only a commented example. As the oracle user, add an entry for your database. Replace YOUR_DB_HOSTNAME, the port if it is not 1521, and YOUR_SERVICE_NAME:

cat >> "$TNS_ADMIN/tnsnames.ora" << 'TNS' MY_DATABASE = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = YOUR_DB_HOSTNAME)(PORT = 1521)) ) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = YOUR_SERVICE_NAME) ) ) TNS

Then test the alias with tnsping:

tnsping MY_DATABASE

You can expect one of these results:

• OK (n msec): the host resolves and the listener answered. This is what you want to see.
• TNS-12545: Connect failed because target host or object does not exist: the host name does not resolve. The unedited example value YOUR_DB_HOSTNAME gives this result. Oracle Net itself is working, so fix the host.
• TNS-12541 or TNS-00511: No listener: the host resolves but nothing listens on that port. Check the listener and the port.
• TNS-03505: Failed to resolve name: the alias is not in tnsnames.ora. Check its spelling.

Connect with the alias you added. SQL*Plus prompts for the password, so the password never appears in your shell history:

sqlplus your_user@MY_DATABASE

Or skip tnsnames.ora and use an Easy Connect string in the form //host:port/service_name:

sqlplus your_user@//YOUR_DB_HOSTNAME:1521/YOUR_SERVICE_NAME

When the connection succeeds, SQL*Plus prints Connected to: and the database's banner, then the SQL> prompt. Type EXIT to leave.

If the host name in an Easy Connect string does not resolve, SQL*Plus says so plainly:

ERROR: ORA-12262: Cannot connect to database. Could not resolve hostname YOUR_DB_HOSTNAME in Easy Connect connection string //YOUR_DB_HOSTNAME:1521/YOUR_SERVICE_NAME

Data Pump, SQL*Loader and Recovery Manager take the same connect identifiers, for example expdp your_user@MY_DATABASE schemas=your_schema directory=DATA_PUMP_DIR dumpfile=your_schema.dmp. Data Pump writes its dump files on the database server, in the directory object that you name.

Applications on the virtual machine can use the client's libraries directly. List the drivers and libraries:

ls $ORACLE_HOME/jdbc/lib/ojdbc*.jar
ls $ORACLE_HOME/lib/libclntsh.so* $ORACLE_HOME/lib/libocci.so

• JDBC: ojdbc8.jar (Java 8), ojdbc11.jar (Java 11 and later) and ojdbc17.jar (Java 17 and later)
• OCI and OCCI: libclntsh.so and libocci.so, with libclntsh.so.23.1 and compatibility links for earlier client releases. LD_LIBRARY_PATH from setEnv.sh points at them.

The Oracle home's jdk directory is a link to the system OpenJDK 8, which dnf keeps up to date:

readlink -f $ORACLE_HOME/jdk $ORACLE_HOME/jdk/bin/java -version

Nothing on the virtual machine listens for database traffic. Check the listeners and the host firewall:

sudo ss -tlnp sudo firewall-cmd --list-all

sshd listens on port 22 and rpcbind listens on port 111. firewalld is active, and its public zone allows only the ssh, cockpit and dhcpv6-client services, so port 111 is not reachable from the network. The Cockpit packages are installed, but the cockpit.socket unit is not active, so nothing answers on its port.

SSH accepts keys only. Confirm it:

sudo sshd -T | grep -E "^(pubkeyauthentication|passwordauthentication) "

pubkeyauthentication yes passwordauthentication no

SELinux runs in permissive mode (getenforce prints Permissive).

To keep credentials out of scripts, store them in an Oracle Wallet with mkstore and orapki. Both tools are in $ORACLE_HOME/bin.