Oracle Database Client 26ai on Oracle Linux 9

Open the listing on AWS Marketplace, then choose View purchase options and Subscribe. When the subscription is active, choose Launch your software. In Version, select Oracle Database Client 26ai on Oracle Linux 9.

Choose your Region, an instance type (m5.large is recommended) and your key pair. Select a security group that opens port 22 from your own networks only, then launch.

The instance is ready about two minutes after launch.

Replace <ami-id> with the AMI ID of this version in your Region, and replace the other values in angle brackets with your own. The command requires IMDSv2:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-client-26ai}]'

When the instance is running, retrieve its public address:

aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text

The SSH user for Oracle Database Client 26ai on Oracle Linux 9 is ec2-user. Connect with:

ssh -i <your-key.pem> ec2-user@<public-ip>

Check that the first-boot verification has run:

systemctl status sac-oracle-client-firstboot.service --no-pager | head -5 sudo cat /var/log/sac/oracle-client-firstboot.log

The unit shows active (exited) with status=0/SUCCESS. The log records how many files of the Oracle home were checked:

● sac-oracle-client-firstboot.service - sac: verify the Oracle Database Client home on first boot Loaded: loaded (/etc/systemd/system/sac-oracle-client-firstboot.service; enabled; preset: disabled) Active: active (exited) since Sun 2026-10-25 05:33:58 UTC; 1min 15s ago Process: 15734 ExecStart=/usr/local/sbin/sac-oracle-client-firstboot (code=exited, status=0/SUCCESS) Main PID: 15734 (code=exited, status=0/SUCCESS) 2026-10-25T05:33:55Z first boot verification started 2026-10-25T05:33:58Z verified 382 files of the Oracle home; SQL*Plus 23.26.1.0.0

If the unit failed, read /root/oracle-client-FIRSTBOOT-FAILED.txt and contact support.

Your login shell already has the Oracle environment. The code blocks in this guide also source /etc/profile.d/oracle-client.sh first, so they work the same way in a non-login shell:

. /etc/profile.d/oracle-client.sh echo "ORACLE_HOME=$ORACLE_HOME" echo "TNS_ADMIN=$TNS_ADMIN" sqlplus -V ls "$ORACLE_HOME/bin" | grep -xE 'sqlplus|sql|sqlldr|tnsping|exp|imp|expdp|impdp|adrci|orapki|mkstore|proc|wrc' | tr '\n' ' '; echo

ORACLE_HOME=/u01/app/oracle/product/23.0.0/client_1 TNS_ADMIN=/u01/app/oracle/product/23.0.0/client_1/network/admin SQL*Plus: Release 23.26.1.0.0 - Production Version 23.26.1.0.0 adrci exp expdp imp impdp mkstore orapki proc sql sqlldr sqlplus tnsping wrc

The release line shows the exact release. 23.26.1.0.0 is the 26ai base release on Oracle's installation media, with no Oracle patch applied. The Oracle home sits in Oracle's 23.0.0 version directory, so the path stays the same after you apply Release Updates.

SQLcl is Oracle's modern command line for SQL and PL/SQL (command history, tab completion, DDL and INFO commands, CSV and JSON output, Liquibase). It is sql and runs on the Java runtime inside the Oracle home:

. /etc/profile.d/oracle-client.sh sql -V

SQLcl: Release 25.4.0.0 Production Build: 25.4.0.344.0019

SQLcl keeps its command history in ~/.dbtools for the user who runs it.

The Oracle programs find the Oracle libraries through the library path that Oracle links into them, so the shell needs no LD_LIBRARY_PATH. The Pro*C/C++ precompiler is the one program that Oracle links without that path, so the profile runs proc with LD_LIBRARY_PATH set for that one command only:

. /etc/profile.d/oracle-client.sh cd /tmp && proc 2>&1 | head -3 echo "LD_LIBRARY_PATH in this shell: [${LD_LIBRARY_PATH:-}]"

Pro*C/C++: Release 23.26.1.0.0 - Production on Sun Oct 25 05:35:20 2026 Version 23.26.1.0.0 LD_LIBRARY_PATH in this shell: []

These are the key paths on the instance:

• /u01/app/oracle/product/23.0.0/client_1: ORACLE_HOME.
• /u01/app/oracle: ORACLE_BASE.
• $ORACLE_HOME/network/admin: TNS_ADMIN, which holds sqlnet.ora and tnsnames.ora.
• $ORACLE_HOME/jdbc/lib/ojdbc17.jar: JDBC driver for Java 17 and later (ojdbc11.jar for Java 11, ojdbc8.jar for Java 8).
• $ORACLE_HOME/lib/libclntsh.so.23.1: OCI client library (C, C++, Python python-oracledb thick mode, Node.js node-oracledb thick mode, Perl, PHP OCI8).
• $ORACLE_HOME/lib/libocci.so.23.1: OCCI C++ client library.
• $ORACLE_HOME/lib/libsqora.so.23.1: ODBC driver.
• /u01/app/oraInventory: Oracle central inventory.
• /usr/share/doc/sac/oracle-client-26ai/README.txt: a summary of this image.

The image carries a self-test that repeats the first-boot checks and proves that the client works end to end without a database. It covers Oracle Net name resolution, a connection attempt that reaches the network layer, the exact listening ports, SELinux, the firewall, the accounts, a root login shell that loads only system libraries, the absence of a compiler, and every SSH setting:

sudo /usr/local/sbin/sac-oracle-client-selftest

PASS: first-boot verification marker present PASS: no first-boot failure note PASS: Oracle home matches the build manifest (382 files) PASS: login shell: sqlplus -V = 23.26.1.0.0 PASS: wrapper (empty environment): sqlplus -V = 23.26.1.0.0 PASS: tnsping: unknown alias refused (TNS-03505) PASS: sqlplus: no listener on this instance (ORA-12541) PASS: only TCP 22 listens PASS: no Oracle listener process PASS: SELinux enforcing PASS: firewalld public: dhcpv6-client ssh PASS: no account carries a password hash (locked or not) PASS: root is locked with no password hash ('!') PASS: root login shell: no LD_LIBRARY_PATH; firewall-cmd, the system XML parser and sqlplus work PASS: no compiler (gcc, cc, c++, g++, make) on the PATH PASS: fwupd-refresh masked (no LVFS firmware on EC2) PASS: sshd -T PasswordAuthentication no PASS: sshd -T KbdInteractiveAuthentication no PASS: sshd -T PermitEmptyPasswords no PASS: sshd -T PermitRootLogin no PASS: sshd -T PubkeyAuthentication yes PASS: sshd -T X11Forwarding no PASS: sshd -T AllowTcpForwarding yes PASS: sshd -T MaxAuthTries 4 PASS: sshd -T ClientAliveInterval 300 PASS: sshd -T ClientAliveCountMax 3 PASS: sshd -T LoginGraceTime 60 PASS: no core dump or crash report ORACLE_CLIENT_SELFTEST_OK

TNS-03505 and ORA-12541 are the expected results here. The self-test asks for an alias that does not exist, and it connects to port 1521 on the instance itself, where no listener runs.

sqlnet.ora resolves names through tnsnames.ora first and then EZCONNECT (host:port/service). You can connect without any configuration, or give each database a short alias. View the shipped files:

. /etc/profile.d/oracle-client.sh grep -v '^#' "$TNS_ADMIN/sqlnet.ora" cat "$TNS_ADMIN/tnsnames.ora"

NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT) SQLNET.EXPIRE_TIME = 10 SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
# sac Oracle Database Client 26ai - Oracle Net service names.
# Add one entry per database, for example:
#
# MYDB =
# (DESCRIPTION =
# (ADDRESS = (PROTOCOL = TCP)(HOST = db.example.com)(PORT = 1521))
# (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = FREEPDB1))
# )

The files belong to the oracle software owner, so edit them with sudo. To add an alias, append an entry with the host, port and service name of your database:

sudo tee -a /u01/app/oracle/product/23.0.0/client_1/network/admin/tnsnames.ora > /dev/null <<'TNS' MYDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = <db-host>)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = <service-name>)) ) TNS tnsping MYDB

tnsping resolves the alias and contacts the database listener. It ends with OK (<n> msec) when the listener answers. If it reports TNS-12535 or times out, the network path to the database (security groups, network ACLs and routes) does not allow the connection. To keep your own tnsnames.ora in another location, set TNS_ADMIN to that directory in your shell profile.

Connect with the alias, or directly with EZCONNECT. SQL*Plus and SQLcl prompt for the password, which keeps it out of your shell history and the process list:

sqlplus <db-user>@MYDB sqlplus <db-user>@//<db-host>:1521/<service-name> sql <db-user>@//<db-host>:1521/<service-name>

For Amazon RDS for Oracle, <db-host> is the DB instance endpoint shown in the RDS console and <service-name> is the database name (ORCL by default). For an Oracle Autonomous Database, download its wallet, unzip it into a directory that only your account can read, set TNS_ADMIN to that directory, and connect with one of the service names in its tnsnames.ora. When you are connected, run:

SELECT banner_full FROM v$version; SELECT sys_context('USERENV', 'SERVICE_NAME') FROM dual;

Never put a password on the command line (sqlplus user/password@db). It is visible to every user of the instance in the process list. For unattended scripts, use an Oracle wallet (a secure external password store) instead (step 8).

Oracle Net traffic is not encrypted unless the client and the server agree to encrypt it. sqlnet.ora carries commented settings for both methods:

• Oracle Native Network Encryption. Uncomment the SQLNET.ENCRYPTION_CLIENT and SQLNET.CRYPTO_CHECKSUM_CLIENT lines (REQUIRED, AES256 and SHA256) to refuse any unencrypted session. The database must accept encryption. Amazon RDS for Oracle enables it with the NATIVE_NETWORK_ENCRYPTION option.
• TLS (TCPS). Use orapki to create a wallet that holds the CA certificate of your database, point WALLET_LOCATION at it, and use (PROTOCOL = TCPS) and the TLS port of the database (often 2484) in the alias. Amazon RDS for Oracle provides TLS with its SSL option and publishes its CA certificates.

. /etc/profile.d/oracle-client.sh grep -n 'ENCRYPTION\|CRYPTO\|WALLET' "$TNS_ADMIN/sqlnet.ora"

9:# SQLNET.ENCRYPTION_CLIENT = REQUIRED 10:# SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256) 11:# SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED 12:# SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256) 14:# WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /path/to/your/wallet)))

Edit sqlnet.ora with sudo, as in step 6. The following commands create a TLS wallet for an RDS CA bundle in a directory of your own. They prompt for the wallet password:

mkdir -m 700 ~/wallet orapki wallet create -wallet ~/wallet -auto_login_only orapki wallet add -wallet ~/wallet -trusted_cert -cert <rds-ca-bundle.pem> -auto_login_only

For unattended scripts, store the database password in a wallet as a secure external password store. Create the wallet with mkstore -wrl <wallet-dir> -create in a directory that only your account can read. Add the credential with mkstore -wrl <wallet-dir> -createCredential MYDB <db-user>, which prompts for the password.

Then add WALLET_LOCATION and SQLNET.WALLET_OVERRIDE = TRUE to the sqlnet.ora that your script uses, and connect with sqlplus /@MYDB. The image ships no wallet. Every wallet you create belongs to your own instance.

If the database is reachable only through a bastion, an SSH tunnel also works. Run ssh -N -L 1521:<db-host>:1521 ec2-user@<bastion> and connect to //localhost:1521/<service-name>.

A login shell has the environment from /etc/profile.d/oracle-client.sh. Scripts and cron jobs do not read it, so sqlplus, sqlldr, tnsping and proc are also installed as wrappers in /usr/local/bin. The wrappers set the environment, including LD_LIBRARY_PATH, for that one command:

cat /usr/local/bin/sqlplus env -i PATH=/usr/local/bin:/usr/bin:/bin sqlplus -V

#!/bin/bash
# sac Oracle Database Client 26ai wrapper: sqlplus from any shell (scripts, cron), environment scoped to this call export ORACLE_BASE=/u01/app/oracle export ORACLE_HOME=/u01/app/oracle/product/23.0.0/client_1 export TNS_ADMIN=${TNS_ADMIN:-/u01/app/oracle/product/23.0.0/client_1/network/admin} export NLS_LANG=${NLS_LANG:-AMERICAN_AMERICA.AL32UTF8} export LD_LIBRARY_PATH=/u01/app/oracle/product/23.0.0/client_1/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}} exec /u01/app/oracle/product/23.0.0/client_1/bin/sqlplus "$@" SQL*Plus: Release 23.26.1.0.0 - Production Version 23.26.1.0.0

For other Oracle tools in a script (SQLcl, Data Pump, exp and imp), source the profile first (. /etc/profile.d/oracle-client.sh).

Applications use the libraries in the Oracle home directly:

• Java: add $ORACLE_HOME/jdbc/lib/ojdbc17.jar to the classpath (Java 17 and later; use ojdbc11.jar for Java 11 or ojdbc8.jar for Java 8). Connect with jdbc:oracle:thin:@//<db-host>:1521/<service-name>, or with jdbc:oracle:thin:@MYDB and -Doracle.net.tns_admin=$TNS_ADMIN.
• OCI and OCCI (C, C++, Pro*C, python-oracledb and node-oracledb thick mode, PHP OCI8, Perl DBD::Oracle): set ORACLE_HOME and LD_LIBRARY_PATH=$ORACLE_HOME/lib for the application, as the wrappers do, rather than adding the directory to the system library path. With python-oracledb, call oracledb.init_oracle_client(lib_dir="/u01/app/oracle/product/23.0.0/client_1/lib") to use thick mode.
• ODBC: the unixODBC driver manager is installed. Register the Oracle driver in /etc/odbcinst.ini, for example with a section [Oracle 26ai ODBC driver] and Driver = /u01/app/oracle/product/23.0.0/client_1/lib/libsqora.so.23.1. Then define your data sources in /etc/odbc.ini or ~/.odbc.ini. To check the driver manager, run:

odbcinst -j | head -3

unixODBC 2.3.12 DRIVERS............: /etc/odbcinst.ini SYSTEM DATA SOURCES: /etc/odbc.ini

This image ships the 23.26.1.0.0 base release. Oracle AI Database 26ai is a Long Term Support Release. Under Oracle's Lifetime Support Policy (Oracle Technology Products, effective 2 October 2026), it is in Premier Support until December 2031, and Oracle releases quarterly Release Updates for it that carry its security fixes.

SecureAnyCloud does not apply or redistribute Oracle patches. Release Updates are available through My Oracle Support to customers with an Oracle support contract. Apply the current client Release Update with your own Oracle support entitlement before you run the client in production. These resources help:

• Oracle's Critical Patch Update advisories, which list the security fixes in each quarterly update: https://www.oracle.com/security-alerts/
• Patching an Oracle home with AutoUpgrade and OPatch, from the Oracle AI Database 26ai documentation: https://docs.oracle.com/en/database/oracle/oracle-database/26/upgrd/autoupgrade-patching.html

Run OPatch as the oracle software owner, because OPatch refuses to run as root. For example, run sudo -iu oracle $ORACLE_HOME/OPatch/opatch lspatches.

Oracle's relink, which patches run, needs the C and C++ compilers and make, which the image does not ship. Install them first with sudo dnf install gcc gcc-c++ make from the Oracle Linux 9 repositories. With them, the link and relink all run cleanly on this image. Afterwards, you can remove them with sudo dnf remove gcc gcc-c++ make.

The Oracle home includes Oracle's own Java runtime (Java 11.0.30) and Perl 5.38 ($ORACLE_HOME/jdk and $ORACLE_HOME/perl), which SQLcl, the installer and other Oracle tools use. Oracle's patches update them, not dnf. Use your own current Java runtime for your applications rather than the one in the Oracle home.

The Oracle Linux packages update themselves. dnf-automatic applies Oracle Linux security errata every day. To check it, run:

grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer

upgrade_type = security apply_updates = yes enabled

To apply every available update now, run sudo dnf upgrade and reboot if the update installed a new kernel.

Run these commands to check the security defaults:

sudo ss -tlnp sudo firewall-cmd --list-services getenforce
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|x11forwarding|pubkeyauthentication) '

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=672,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=672,fd=8)) dhcpv6-client ssh Enforcing permitrootlogin no pubkeyauthentication yes passwordauthentication no x11forwarding no

• Only SSH listens. The image never needs an inbound port beyond 22, so keep port 1521 closed on this instance. The image carries no database and no credentials file.
• The SSH settings live in /etc/ssh/sshd_config.d/00-sac.conf, which sshd_config reads first, ahead of the distribution's own drop-ins. Your EC2 key pair is the only way in. Root login and passwords are refused.
• SELinux is enforcing, and the host firewall (firewalld) allows SSH only, alongside your security group.
• The instance metadata service accepts IMDSv2 requests only (the AMI requires a session token).
• The image changes these kernel parameters for Oracle Net, as Oracle's client prerequisites ask (/etc/sysctl.d/97-oracle-client.conf): fs.aio-max-nr = 1048576, net.core.rmem_default = 262144, net.core.rmem_max = 4194304, net.core.wmem_default = 262144 and net.core.wmem_max = 1048576.
• The fwupd-refresh timer is masked, because EC2 instances have no firmware that the Linux Vendor Firmware Service can update.
• No compiler ships, and no account has a password. Root is locked with no password hash at all, and SSH refuses root logins. A root login shell (sudo -i) gets no Oracle LD_LIBRARY_PATH, so dnf, firewall-cmd and Python always use the patched system libraries.