SecureAnyCloud
Deployment guide

Oracle DB 12.2 Standard on Linux

Overview

This guide shows you how to deploy and configure Oracle Database 12c Standard Edition (12.2.0.1) on Linux. It uses SecureAnyCloud AMIs from the AWS Marketplace.

Oracle Database 12c Release 2 Standard Edition provides core relational database functionality for departmental and workgroup applications, including the multitenant architecture.

What you get:

  • Oracle Database 12c Standard Edition 12.2.0.1 (64-bit), installed at /u01.
  • A preconfigured ORCL sample database, ready to start.
  • Oracle Listener, preconfigured on port 1521.
  • A dedicated oracle OS user with environment scripts.
  • Helper scripts for starting and stopping the database and listener.
  • Randomly generated SYSTEM user credentials.
  • An OS package update script that keeps the system current.
  • AWS CLI v2 for AWS service integration.
  • The Systems Manager Agent (SSM) for remote management.
  • The CloudWatch Agent for monitoring.
  • The latest security patches, applied at build time.
  • 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA.

Prerequisites

Before you launch this AMI, make sure that you have:

  • An active AWS account.
  • An active subscription to the Oracle Database 12.2 Standard listing on AWS Marketplace.
  • An EC2 key pair for SSH access.
  • Familiarity with EC2 instance management and SSH.

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) or larger. The minimum requirements are 1 vCPU, 1 GB RAM and 20 GB disk space, but Oracle Database benefits significantly from additional memory for production workloads.

1

Launch the AMI

  • Go to the AWS Marketplace and search for "Oracle Database 12.2 Standard SecureAnyCloud".
  • Choose Continue to Subscribe and accept the terms. Then choose Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Choose Continue to Launch.
  • Choose Launch through EC2 for full control over the instance configuration.
  • Select your instance type (m5.large is recommended).
  • Configure storage: 20 GB gp3 minimum for the root volume, plus the dedicated /u01 Oracle volume.

Configure your Security Group with the following inbound rules:

  • Port 22 (TCP), source your IP: SSH access.
  • Port 1521 (TCP), source your IP: Oracle Database Listener port.

Important: Restrict port 1521 to trusted application servers or your IP only. Do not open the Oracle Listener port to the public internet.

Select your EC2 key pair and launch the instance.

2

Connect with SSH

When your instance is running and has passed both status checks (2/2), connect with SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user, run:

sudo su -

Important: Wait for the EC2 instance to reach 2/2 successful status checks before you connect. Early connection attempts can fail with permission denied errors while the instance is still initialising.

3

Switch to the oracle user

The dedicated oracle OS user owns the Oracle software. Switch to this user to manage the database. Type the command rather than copying and pasting it:

sudo su - oracle

The home directory of the oracle user contains three scripts:

  • setEnv.sh sets the Oracle environment variables, which enables utilities such as sqlplus.
  • start_all.sh starts the ORCL sample database and its associated Oracle Listener.
  • stop_all.sh stops the ORCL sample database and its associated Oracle Listener.
4

Start the Oracle Database and listener

Run the following commands as the oracle user to start the sample database and listener:

cd $HOME . ./start_all.sh

The output is similar to the following:

LSNRCTL for Linux: Version 12.2.0.1.0 - Production Starting /u01/app/oracle/product/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 12.2.0.1.0 - Production Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ip-x-x-x-x.ec2.internal)(PORT=1521))) The command completed successfully SQL*Plus: Release 12.2.0.1.0 Production Connected to an idle instance. SQL> ORACLE instance started. Database mounted. Database opened.
5

Connect with SQL*Plus

Set the Oracle environment variables and start SQL*Plus:

cd $HOME . ./setEnv.sh sqlplus / as sysdba

A successful connection prints output like the following:

SQL*Plus: Release 12.2.0.1.0 Production Copyright (c) 1982, 2016, Oracle. All rights reserved. Connected to: Oracle Database 12c Standard Edition Release 12.2.0.1.0 - 64bit Production SQL>

Type EXIT to leave the SQL*Plus session.

6

Connect remotely with SQL Developer

To connect to the database from an external tool such as SQL Developer, use these connection settings:

  • Database Type: Oracle
  • Authentication Type: Default
  • Username: SYSTEM
  • Password: see the credentials file in the note below
  • Connection Type: Basic
  • Hostname: your instance public IP
  • Port: 1521
  • Service Name: orcl.us.oracle.com

Note: To retrieve the SYSTEM user password, see the randomly generated credentials file at /stage/scripts/oracle-database-credentials.log.

Server Components

  • Oracle Database 12c Standard: version 12.2.0.1, installed at /u01.

Note: Component versions may be updated on first boot by the automatic OS package update script.

Filesystem Layout

Mount points:

  • / (38 GB): root filesystem.
  • /boot (2.0 GB): operating system kernel files.
  • /u01 (20 GB): Oracle software installation directory.

Key Oracle directories:

  • /u01/app/oracle: Oracle base directory.
  • /u01/app/oracle/product: Oracle software home.
  • /u01/app/oracle/product/network/admin: listener and TNS configuration files.
  • /u01/app/oracle/diag: Oracle diagnostic and alert log files.

Managing the Oracle Database

You manage the Oracle Database with the shell scripts in the home directory of the oracle user. The database does not use systemd services.

Start the database and listener:

sudo su - oracle cd $HOME . ./start_all.sh

Stop the database and listener:

sudo su - oracle cd $HOME . ./stop_all.sh

Check the listener status:

sudo su - oracle cd $HOME . ./setEnv.sh lsnrctl status

Scripts and Log Files

  • initial_boot_update.sh (/stage/scripts): updates the OS with the latest packages on first boot.
  • initial_boot_update.log (/stage/scripts): output log for the boot update script.
  • oracle-database-credentials.log (/stage/scripts): Oracle Database SYSTEM user credentials.
  • setEnv.sh (/home/oracle): sets the Oracle environment variables for sqlplus and other tools.
  • start_all.sh (/home/oracle): starts the ORCL database and Oracle Listener.
  • stop_all.sh (/home/oracle): stops the ORCL database and Oracle Listener.

On Startup

An OS package update script runs on first boot to make sure that the image is fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Cannot connect with SSH

  • Verify that the instance has reached 2/2 status checks in the EC2 console.
  • Confirm that your security group allows inbound TCP port 22 from your IP.
  • Make sure that you use the correct key pair and connect as ec2-user.

Oracle Listener fails to start

  • Switch to the oracle user: sudo su - oracle.
  • Source the environment: . ./setEnv.sh.
  • Check the listener status: lsnrctl status.
  • Review the listener log at /u01/app/oracle/diag/tnslsnr/<hostname>/listener/alert/log.xml.
  • Verify that no other process uses port 1521: netstat -tlnp | grep 1521.

Database fails to start

  • Switch to the oracle user and source the environment.
  • Connect with sqlplus: sqlplus / as sysdba.
  • Check the instance status: SELECT STATUS FROM V$INSTANCE;.
  • Try to start the database manually: STARTUP;.
  • Review the alert log at /u01/app/oracle/diag/rdbms/orcl/ORCL/trace/alert_ORCL.log.

Cannot connect remotely on port 1521

  • Verify that the Oracle Listener is running: lsnrctl status.
  • Confirm that your security group allows inbound TCP port 1521 from your IP.
  • Test connectivity: telnet <instance-ip> 1521.
  • Check that the listener.ora file references the correct hostname.

Security Recommendations

  • Restrict port access: allow port 1521 only from trusted application servers or specific IP addresses.
  • Change default passwords: update the SYSTEM and SYS user passwords immediately after your first login.
  • Use strong passwords: make sure that all database user passwords meet complexity requirements.
  • Enable auditing: configure Oracle Unified Auditing to track access and changes.
  • Encrypt connections: configure Oracle Net Services to use SSL/TLS encryption for client connections.
  • Limit OS access: restrict SSH access to authorised administrators only.
  • Review user privileges: remove unnecessary grants and follow the principle of least privilege.
  • Keep the system updated: apply Oracle Critical Patch Updates and OS security patches regularly.

Support

If you have any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7, with a guaranteed 24-hour response SLA

Deploy on AWS

Launch Oracle DB 12.2 Standard on Linux with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com