Oracle DB 19c Se2

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Oracle Database. Select the SecureAnyCloud listing for Oracle Database 19c SE2 on Oracle Linux 8 and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large (2 vCPUs / 8 GiB RAM) or larger. The starter database is sized for m5.large, which is the recommended baseline. On AWS, Oracle licenses Standard Edition 2 only on instances of up to 8 vCPUs. The m5.large, m5.xlarge (4 vCPUs / 16 GiB) and m5.2xlarge (8 vCPUs / 32 GiB) types are within the SE2 limit, and larger shapes such as m5.4xlarge (16 vCPUs) are not. On a larger instance, raise the database memory as described in Step 8.

Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network only. The default security group of this listing opens port 22 only. The listener is bound to 127.0.0.1, so port 1521 does not need to be open. Step 7 covers the SSH tunnel and how to open port 1521 deliberately if you need to. Never open port 1521 to the public internet.

Leave the root volume at the default size. The image adds a second 30 GiB gp3 EBS volume at /opt/oracle automatically. The Oracle home and the ORCL datafiles live there.

Select Launch instance. First boot initialisation takes several minutes after the instance state becomes Running and the status checks pass. That is a few minutes longer than a plain database start, because the firstboot service sets and then proves every credential before the database is allowed to start. SSH can become available before first boot has finished. Step 3 shows how to tell when it is done.

This command launches an instance from the SecureAnyCloud Oracle Database 19c SE2 Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22 from your management network, as described above. Port 1521 stays closed.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":50,"VolumeType":"gp3"}},{"DeviceName":"/dev/sdb","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-db-19c-01}]'

On success, the command prints a JSON document. Note the instance ID. When the instance is running, get its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Wait for the EC2 instance to reach 2/2 status checks and for first boot to complete. Connect over SSH with the key pair you selected, using the ec2-user login name:

ssh -i <your-key.pem> ec2-user@<public-ip>

On the instance, confirm that first boot has completed. The ready marker exists only after every password has been set and proven:

sudo test -f /var/lib/sac/data/oracle-db-19c-firstboot.done && echo "first boot complete"

If the command prints nothing, first boot is still running. Follow its progress with sudo journalctl -u oracle-db-19c-firstboot.service -b -f, and see If first boot fails below if it does not finish. When it has completed, read the credentials file with sudo:

sudo cat /root/oracle-db-credentials.txt

The file contains the per-instance SYS and SYSTEM passwords, the Oracle SID (ORCL) and the listener address (127.0.0.1:1521). Sample contents:

# Oracle Database 19c Standard Edition 2 - per-instance credentials (sac)
# Generated Sun Oct 18 15:30:00 UTC 2026 on i-0123456789abcdef0. Root-only (0600). Unique to this instance. SYS_PASSWORD=<set-at-first-boot> SYSTEM_PASSWORD=<set-at-first-boot> ORACLE_SID=ORCL LISTENER=127.0.0.1:1521 (localhost only - use an SSH tunnel, or see the guide to open it deliberately with encryption) Every other database account is locked and expired with a random password. Connect:
sudo su - oracle ; . ~/setEnv.sh ; sqlplus /nolog ; then CONNECT system@//localhost:1521/ORCL

Copy these values to a secure place such as a password manager or an encrypted vault, and do not commit them to source control. Every command block in this guide that talks to Oracle begins by reading the SYSTEM password from the credentials file into a SYSPWD shell variable, so every block is self-contained.

The file uses KEY=value lines. Images released before October 2026 wrote KEY= value, with a space after the equals sign. The extraction used throughout this guide handles both forms:

SYSPWD=$(sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt) test -n "$SYSPWD" && echo "SYSTEM password read (${#SYSPWD} characters)"

Every other account is locked

Only SYS and SYSTEM can log in. Every other password account in the database, including DBSNMP and the sample schemas, has a random password that nobody knows and is locked and expired. To use one of these accounts, connect as SYSDBA, set your own password and unlock it:

ALTER USER <name> IDENTIFIED BY "<new-strong-password>" ACCOUNT UNLOCK;

If first boot fails

First boot fails closed. If it cannot complete every step, it stops the database and the listener on purpose, writes no credentials file, and leaves /root/oracle-db-FIRSTBOOT-FAILED.txt to explain what happened. Read the notice and the service journal, then reboot once to retry. First boot runs again on every boot until it succeeds:

sudo cat /root/oracle-db-FIRSTBOOT-FAILED.txt
sudo journalctl -u oracle-db-19c-firstboot.service -b sudo reboot

If it fails again, contact SecureAnyCloud support and include the journal output.

Run the security self-test

The image includes a self-test that re-proves the security state of the instance. It checks that each password in the credentials file works and the historic and default passwords are refused, that every other account is locked, that the listener is bound to 127.0.0.1 only, and that no listener started before the passwords were set:

sudo /usr/local/sbin/sac-oracle-selftest

Each check prints a PASS line and the run ends with SELFTEST_OK. Abridged sample output:

PASS: ready marker present PASS: no first-boot error notice PASS: /root/oracle-db-credentials.txt is 0600 root:root PASS: SYS@ORCL refuses a historic/default password PASS: SYS@ORCL accepts its per-instance password PASS: SYSTEM@ORCL refuses a historic/default password PASS: SYSTEM@ORCL accepts its per-instance password PASS: every other password account is locked PASS: listener.ora binds 127.0.0.1 only PASS: no database socket on a non-loopback address PASS: oracle-db.service gated on the ready marker PASS: memory fits m5.large: sga_target 2304M, pga_aggregate_target 768M ... SELFTEST_OK

The self-test checks the instance as delivered. If you rotate a password, open port 1521 or raise the database memory as this guide describes, the matching checks report FAIL by design.

Oracle's TNS listener is the network endpoint for all client connections. Confirm that it is up and serving the ORCL service:

sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib lsnrctl status "

The expected response confirms that the listener is bound to the loopback address 127.0.0.1 on TCP port 1521 and that the ORCL service has registered with it:

LSNRCTL for Linux: Version 19.0.0.0.0 - Production on 28-MAY-2026 15:30:00 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521))) STATUS of the LISTENER ------------------------ Alias LISTENER Version TNSLSNR for Linux: Version 19.0.0.0.0 - Production Listening Endpoints Summary... (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521))) (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521))) Services Summary... Service "ORCL" has 1 instance(s). Instance "ORCL", status READY, has 1 handler(s) for this service... The command completed successfully

To confirm at kernel level that port 1521 listens on the loopback address only, print the local address of every socket listening on port 1521:

sudo ss -Hltn 'sport = :1521' | awk '{print $4}'

The command returns:

127.0.0.1:1521

The simplest way to reach the database from the instance is the SQL*Plus client that ships with the Oracle Database installation. Read the SYSTEM password from the credentials file, then connect to the ORCL service over the listener:

SYSPWD=$(sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt)
sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib cat > /tmp/version-query.sql <<EOF SELECT banner FROM v\\\$version WHERE banner LIKE 'Oracle%'; EXIT; EOF sqlplus -S system/${SYSPWD}@localhost:1521/ORCL @/tmp/version-query.sql rm /tmp/version-query.sql "

The expected response confirms the installed Oracle Database release, with the applied DBRU patch level:

BANNER -------------------------------------------------------------------------------- Oracle Database 19c Standard Edition 2 Release 19.0.0.0.0 - Production

You can also connect interactively. Switch to the oracle OS user and run sqlplus in that shell:

sudo su - oracle export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=$ORACLE_HOME/bin:$PATH export LD_LIBRARY_PATH=$ORACLE_HOME/lib sqlplus / as sysdba

In an interactive session, type EXIT; to leave SQL*Plus.

Create a small table, insert two rows, read them back and drop the table. This exercise confirms that the database is writable and that the SYSTEM user has the standard DDL grants:

SYSPWD=$(sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt)
sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib cat > /tmp/demo.sql <<EOF CREATE TABLE demo_users (id NUMBER, name VARCHAR2(50), created_at DATE); INSERT INTO demo_users VALUES (1, 'Alice', SYSDATE); INSERT INTO demo_users VALUES (2, 'Bob', SYSDATE); COMMIT; SELECT id, name, TO_CHAR(created_at,'YYYY-MM-DD') AS created_at FROM demo_users; DROP TABLE demo_users; EXIT; EOF sqlplus -S system/${SYSPWD}@localhost:1521/ORCL @/tmp/demo.sql rm /tmp/demo.sql "

Expected response:

Table created. 1 row created. 1 row created. Commit complete. ID NAME CREATED_AT ---------- -------------------------------------------------- ---------- 1 Alice 2026-05-28 2 Bob 2026-05-28 Table dropped.

The listener is bound to 127.0.0.1, and the default security group opens port 22 only, so the database is not reachable from the network. The recommended way to connect a client on your workstation is an SSH tunnel. The tunnel carries the Oracle traffic inside your existing SSH connection and needs no change to the instance or the security group.

Connect through an SSH tunnel

On your workstation, open a tunnel that forwards local port 1521 to the listener on the instance, and leave it running while you work:

ssh -i <your-key.pem> -N -L 1521:127.0.0.1:1521 ec2-user@<public-ip>

While the tunnel is open, localhost:1521 on your workstation reaches the database. From a host with sqlplus installed (the Oracle Instant Client tarball contains it), connect with Oracle's "Easy Connect" syntax and enter the SYSTEM password from /root/oracle-db-credentials.txt:

sqlplus system@localhost:1521/ORCL

SQL*Plus prompts for the password, so the password stays out of your shell history. The connection string localhost:1521/ORCL is equivalent to this TNS descriptor, which an application that reads a tnsnames.ora file would use:

ORCL = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = ORCL) ) )

For JDBC, use the URL jdbc:oracle:thin:@//localhost:1521/ORCL.

Or use SQL Developer

Oracle SQL Developer is a free graphical client published by Oracle. With the SSH tunnel open, launch SQL Developer locally and create a new connection with these values:

Setting Value

Connection Name sac-oracle-19c (or any name you choose)

Authentication Default

Username SYSTEM

Password Value of SYSTEM_PASSWORD from /root/oracle-db-credentials.txt

Connection Type Basic

Role default

Hostname localhost (through the SSH tunnel)

Port 1521

Service Name ORCL

Click Test. While the SSH tunnel is running, the status bar reports Success. Click Connect to open a SQL Worksheet.

Opening port 1521 deliberately

If your applications must connect directly rather than through a tunnel, open the listener deliberately, in three steps, and only to your own network. Run these commands yourself. The SSH tunnel does not need any of them.

1. Require Oracle native network encryption and integrity. As the oracle user, append the following to $ORACLE_HOME/network/admin/sqlnet.ora:

sudo su - oracle export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 cat >> $ORACLE_HOME/network/admin/sqlnet.ora <<'EOF' SQLNET.ENCRYPTION_SERVER = required SQLNET.ENCRYPTION_TYPES_SERVER = (AES256) SQLNET.CRYPTO_CHECKSUM_SERVER = required SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256) EOF

Alternatively, configure TCPS (TLS) with an Oracle wallet. See "Configuring Transport Layer Security Authentication" in the Oracle Database 19c Security Guide at https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-transport-layer-security-authentication.html.

2. Bind the listener to all interfaces. In $ORACLE_HOME/network/admin/listener.ora, change (HOST = 127.0.0.1) to (HOST = 0.0.0.0), then restart the listener as the oracle user. The database registers with the restarted listener within a minute:

sudo su - oracle export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export PATH=$ORACLE_HOME/bin:$PATH sed -i 's/(HOST = 127.0.0.1)/(HOST = 0.0.0.0)/' $ORACLE_HOME/network/admin/listener.ora lsnrctl stop lsnrctl start

3. Allow TCP 1521 from your own network only. Add a security group rule for your management or application CIDR, and never use 0.0.0.0/0:

aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port 1521 --cidr <your-mgmt-cidr>

Clients then connect to <public-ip>:1521/ORCL (or the private IP from inside the VPC) and must also use encryption. The JDBC thin driver, and therefore SQL Developer, negotiates encryption automatically when the server requires it. Other Oracle clients do the same with their default sqlnet.ora settings.

Instances launched from earlier images

On instances launched from images released before October 2026, the listener binds 0.0.0.0 and the old default security group opened port 1521 to the internet. To bring such an instance in line with the current image, remove that security group rule. Then set the listener back to 127.0.0.1 in the same listener.ora file and restart it:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 1521 --cidr 0.0.0.0/0
sudo su - oracle export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export PATH=$ORACLE_HOME/bin:$PATH sed -i 's/(HOST = 0.0.0.0)/(HOST = 127.0.0.1)/' $ORACLE_HOME/network/admin/listener.ora lsnrctl stop lsnrctl start

Check that the HOST entry in listener.ora now reads 127.0.0.1, then connect through the SSH tunnel described above. If you need direct access instead, follow Opening port 1521 deliberately.

The systemd unit oracle-db.service starts the database on boot and delegates to Oracle's dbstart script in $ORACLE_HOME/bin. Manage the service with the standard systemctl commands:

sudo systemctl status oracle-db.service --no-pager

The command returns:

oracle-db.service - Oracle Database 19c Standard Edition 2 (sac) - starts only after first boot has set per-instance credentials Loaded: loaded (/etc/systemd/system/oracle-db.service; enabled; vendor preset: disabled) Active: active (running) Process: 14909 ExecStart=/opt/oracle/product/19.0.0/dbhome_1/bin/dbstart /opt/oracle/product/19.0.0/dbhome_1 (code=exited, status=0/SUCCESS) CGroup: /system.slice/oracle-db.service ├─ ora_pmon_ORCL ├─ ora_psp0_ORCL ├─ ora_vktm_ORCL ...

To stop the database and listener cleanly:

sudo systemctl stop oracle-db.service

To start them again:

sudo systemctl start oracle-db.service

A separate one-shot unit, oracle-db-19c-firstboot.service, sets the per-instance credentials on the very first boot. It runs before oracle-db.service, which does not start until the ready marker /var/lib/sac/data/oracle-db-19c-firstboot.done exists. Once the marker is present, the first boot unit exits immediately on every later boot.

Database memory and instance size

The starter database is sized for the recommended m5.large (8 GiB). It uses automatic shared memory management with 3072 MB in total, which gives an sga_target of about 2.3 GiB and a pga_aggregate_target of about 768 MiB, leaving room for the operating system. On m5.xlarge or a larger instance for production, raise the database memory as SYSDBA, for example:

ALTER SYSTEM SET sga_max_size=6G SCOPE=SPFILE; ALTER SYSTEM SET sga_target=6G SCOPE=SPFILE; ALTER SYSTEM SET pga_aggregate_target=2G SCOPE=BOTH;

Restart the database so that the new SGA size takes effect:

sudo systemctl restart oracle-db.service

Choose values that leave at least 2 GiB of the instance memory for the operating system.

The Oracle home and the ORCL database files live on the dedicated 30 GiB gp3 EBS volume mounted at /opt/oracle. This separation is intentional. You can resize the database tier independently of the operating system disk, and you can snapshot it on its own for backup.

df -h /opt/oracle

The command returns:

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 30G 16G 13G 56% /opt/oracle

The image exposes these main directories:

• /opt/oracle/product/19.0.0/dbhome_1: the Oracle Database 19c home, owned by the oracle user
• /opt/oracle/product/19.0.0/dbhome_1/bin: Oracle binaries, including sqlplus, lsnrctl, dbstart, dbshut
• /opt/oracle/product/19.0.0/dbhome_1/network/admin: listener configuration (listener.ora) and TNS naming (tnsnames.ora)
• /opt/oracle/oradata/ORCL: datafiles, control file and online redo logs for the ORCL database
• /opt/oracle/diag: Automatic Diagnostic Repository, with the alert log under /opt/oracle/diag/rdbms/orcl/ORCL/trace/alert_ORCL.log
• /opt/oracle/oraInventory: the Oracle Universal Installer inventory
• /root/oracle-db-credentials.txt: per-instance SYS and SYSTEM passwords, mode 0600, root only
• /usr/local/sbin/sac-oracle-selftest: the security self-test described in Step 3

To list the datafile directory, run:

sudo ls -la /opt/oracle/oradata/ORCL/

The command returns, for example:

-rw-r----- 1 oracle oinstall 9748480 May 28 15:30 control01.ctl -rw-r----- 1 oracle oinstall 52429312 May 28 15:30 redo01.log -rw-r----- 1 oracle oinstall 52429312 May 28 15:30 redo02.log -rw-r----- 1 oracle oinstall 52429312 May 28 15:30 redo03.log -rw-r----- 1 oracle oinstall 765411328 May 28 15:30 sysaux01.dbf -rw-r----- 1 oracle oinstall 943718400 May 28 15:30 system01.dbf -rw-r----- 1 oracle oinstall 62914560 May 28 15:30 temp01.dbf -rw-r----- 1 oracle oinstall 78651392 May 28 15:30 undotbs01.dbf -rw-r----- 1 oracle oinstall 5251072 May 28 15:30 users01.dbf

Component Version Source

Oracle Database 19c Long Term Support, Standard Edition 2 (patched to current DBRU) Oracle 19c installation media + p36233263 DBRU

Oracle Linux 8 SecureAnyCloud golden base image

SQL*Plus 19c bundled in $ORACLE_HOME/bin

systemd unit oracle-db.service baked into the image

Firstboot unit oracle-db-19c-firstboot.service baked into the image

This image ships with the current Oracle Database Release Update applied to the binaries at build time with OPatch. Confirm the applied patches with the Oracle OPatch utility:

sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 \$ORACLE_HOME/OPatch/opatch lsinventory -bugs_fixed | head -20 "

The sqlplus banner reports the patched release:

SYSPWD=$(sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt)
sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib cat > /tmp/vfull.sql <<EOF SET HEADING OFF FEEDBACK OFF PAGESIZE 0 SELECT VERSION_FULL FROM V\\\$INSTANCE; EXIT; EOF sqlplus -S / as sysdba @/tmp/vfull.sql rm /tmp/vfull.sql "

The command returns the patched release identifier, for example 19.22.0.0.0 for the DBRU applied at this image's build time.

For a production deployment, rotate the SYSTEM and SYS passwords that the first boot service generated. Connect as SYSDBA with operating system authentication and run ALTER USER:

sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib sqlplus -S / as sysdba <<EOF ALTER USER SYSTEM IDENTIFIED BY \"<new-system-password>\"; ALTER USER SYS IDENTIFIED BY \"<new-sys-password>\"; EXIT; EOF "

Store the new values in your secrets manager immediately. The file /root/oracle-db-credentials.txt is the per-instance bootstrap record. After the first rotation, it is no longer your source of truth.

The starter ORCL database has the standard Oracle tablespace layout: SYSTEM, SYSAUX, UNDOTBS1, USERS and TEMP. The datafiles live under /opt/oracle/oradata/ORCL, on the dedicated 30 GiB gp3 EBS volume. As your workload grows, create application-specific tablespaces on the same volume and grow the volume in place.

SYSPWD=$(sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt)
sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib cat > /tmp/tspaces.sql <<EOF SET PAGESIZE 100 LINESIZE 200 COLUMN tablespace_name FORMAT A20 COLUMN file_name FORMAT A55 SELECT tablespace_name, ROUND(bytes/1024/1024) AS mb, file_name FROM dba_data_files ORDER BY tablespace_name; EXIT; EOF sqlplus -S system/${SYSPWD}@localhost:1521/ORCL @/tmp/tspaces.sql rm /tmp/tspaces.sql "

To add a new application tablespace with autoextend:

sudo -u oracle bash -c " export ORACLE_HOME=/opt/oracle/product/19.0.0/dbhome_1 export ORACLE_SID=ORCL export PATH=\$ORACLE_HOME/bin:\$PATH export LD_LIBRARY_PATH=\$ORACLE_HOME/lib sqlplus -S / as sysdba <<EOF CREATE TABLESPACE app_data DATAFILE '/opt/oracle/oradata/ORCL/app_data01.dbf' SIZE 1G AUTOEXTEND ON NEXT 256M MAXSIZE 16G; EXIT; EOF "

Oracle Database 19c supports a range of backup strategies. For a single-instance image like this one, the two pragmatic options are a filesystem snapshot of the EBS data volume and Oracle's own Recovery Manager (RMAN).

For a quick consistent backup, stop the database cleanly, snapshot the /opt/oracle EBS volume from the AWS Console or CLI, and start the database again:

sudo systemctl stop oracle-db.service aws ec2 create-snapshot --volume-id <volume-id-of-/opt/oracle> \
  --description "oracle-db-19c $(date +%F)" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=oracle-data}]'
sudo systemctl start oracle-db.service

For a hot, point-in-time backup, configure RMAN to back up to an attached EBS volume or to S3 through an S3-compatible RMAN channel. RMAN integrates with Oracle's archive log mode and supports incremental backups. The full RMAN documentation is in the Oracle Database 19c Backup and Recovery User's Guide.

Oracle Database 19c is the Long Term Support release covered by Oracle Extended Support through April 2027. Apply these recommendations to a production deployment:

• Keep port 1521 closed. The listener is bound to 127.0.0.1, and the default security group opens port 22 only. Connect through an SSH tunnel. If you must open the port, follow Opening port 1521 deliberately in Step 7: require network encryption and allow only your own network. Never open the listener to the public internet.
• Leave unused accounts locked. Every account other than SYS and SYSTEM is locked and expired with a random password. Unlock only the accounts you need, and give them a new strong password.
• Rotate the SYSTEM and SYS passwords using the rotation step above, and store the new values in your secrets manager.
• Create per-application schema users with only the grants the application needs, instead of using SYSTEM for application traffic.
• Apply the next Oracle Database Release Update when Oracle publishes it. Download the DBRU bundle from My Oracle Support and apply it with OPatch and datapatch. This image ships with the current DBRU at build time, but Oracle publishes a new DBRU every quarter.
• Enable Oracle auditing if your compliance regime requires it: run ALTER SYSTEM SET audit_trail=DB SCOPE=SPFILE;, restart the database, then add AUDIT statements as needed.
• Require Oracle Native Network Encryption in sqlnet.ora (or TCPS) whenever the listener is reachable from the network, as shown in Step 7. The Oracle Database Net Services Reference documents the full set of encryption settings.
• Apply OS security patches by running sudo dnf update -y on a regular maintenance schedule. Reboot the instance after a kernel update.
• Take regular EBS snapshots of the /opt/oracle volume and store them in a separate account or Region.
• Limit SSH access to a small management CIDR. Do not leave port 22 open to 0.0.0.0/0 in production.