SecureAnyCloud
Deployment guide

Oracle DB 26ai Standard on Linux

Overview

This guide shows how to deploy and configure Oracle Database 26ai Standard Edition on Linux using SecureAnyCloud AMIs from the AWS Marketplace. Oracle Database 26ai is Oracle's latest AI-powered database. Standard Edition provides core relational database functionality, which suits departmental and workgroup applications that do not need the advanced features of Enterprise Edition.

What you get:

  • Oracle Database 26ai Standard Edition 23.26.1.0.0 (64-bit) installed on a dedicated EBS volume at /opt/oracle
  • A preconfigured ORCLCDB container database with the ORCLPDB1 pluggable database, ready to start
  • Oracle Listener preconfigured on port 1521
  • A dedicated oracle OS user with environment scripts
  • Helper scripts to start and stop the database and listener
  • Randomly generated SYSTEM user credentials
  • An OS package update script to keep the system current
  • AWS CLI v2 for AWS service integration
  • Systems Manager Agent (SSM) for remote management
  • CloudWatch Agent for monitoring
  • Latest security patches applied at build time
  • 24/7 SecureAnyCloud support with guaranteed 24 hour response SLA

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account
  • An active subscription to the Oracle Database 26ai Standard listing on AWS Marketplace
  • An EC2 key pair for SSH access
  • Familiarity with EC2 instance management and SSH

Supported operating systems: Oracle Linux 8/9, RHEL 8/10, AlmaLinux 8/9/10, Rocky Linux 8/9

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) or larger. The minimum requirements are 1 vCPU, 1 GB RAM and 20 GB disk space. Oracle Database performs better with additional memory, particularly for production workloads.

1

Launch the AMI

  • Open the AWS Marketplace and search for "Oracle Database 26ai Standard SecureAnyCloud".
  • Click Continue to Subscribe, accept the terms, then click Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Click Continue to Launch.
  • Choose Launch through EC2 for full control over the instance configuration.
  • Select your instance type (m5.large is recommended).
  • Configure storage. The AMI includes a root volume and a dedicated 30 GB /opt/oracle volume for Oracle software and data.
  • Configure your Security Group with these inbound rules:

Port Protocol Source Purpose

22 TCP Your IP SSH access

1521 TCP Your IP Oracle Database Listener port

Important: Restrict port 1521 to trusted application servers or your own IP address. Do not open the Oracle Listener port to the public internet.

  • Select your EC2 key pair and launch the instance.
2

Connect over SSH

When your instance is running and has passed both status checks (2/2), connect over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user, run:

sudo su -

Important: Wait for the EC2 instance to reach 2/2 successful status checks before you connect. Early connection attempts can fail with permission denied errors while the instance is still initialising.

3

Switch to the oracle user

The dedicated oracle OS user owns the Oracle software. Switch to this user to manage the database. Type this command rather than copying and pasting it:

sudo su - oracle

The oracle user's home directory contains three scripts:

  • setEnv.sh sets the Oracle environment variables, which enables utilities such as sqlplus.
  • start_all.sh starts the ORCL sample database and its Oracle Listener.
  • stop_all.sh stops the ORCL sample database and its Oracle Listener.
4

Start the Oracle Database and listener

As the oracle user, run these commands to start the sample database and listener:

cd $HOME . ./start_all.sh

Expected output:

LSNRCTL for Linux: Version 23.26.1.0.0 - Production Starting /opt/oracle/product/26ai/dbhome_1/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 23.26.1.0.0 - Production Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ip-x-x-x-x.ec2.internal)(PORT=1521))) The command completed successfully SQL*Plus: Release 23.26.1.0.0 Production Connected to an idle instance. SQL> ORACLE instance started. Database mounted. Database opened.
5

Connect with SQL*Plus

Set the Oracle environment variables and launch SQL*Plus:

cd $HOME . ./setEnv.sh sqlplus / as sysdba

Expected output:

SQL*Plus: Release 23.26.1.0.0 Production Copyright (c) 1982, 2025, Oracle. All rights reserved. Connected to: Oracle AI Database 26ai Standard Edition 2 Release 23.26.1.0.0 - Production Version 23.26.1.0.0 SQL>

Type EXIT to leave the SQL*Plus session.

6

Connect remotely with SQL Developer

To connect to the database from an external tool such as SQL Developer, use these connection settings:

Setting Value

Database Type Oracle

Authentication Type Default

Username SYSTEM

Password See credentials file below

Connection Type Basic

Hostname Your instance public IP

Port 1521

Service Name ORCLPDB1

Note: The randomly generated SYSTEM user password is in the credentials file at /stage/scripts/oracle-database-credentials.log.

Server components

Component Version Install Path

Oracle Database 26ai Standard 23.26.1.0.0 /opt/oracle

Note: The automatic OS package update script can update component versions on first boot.

Filesystem layout

Mount Point Size Description

/ 38 GB Root filesystem

/boot 2.0 GB Operating system kernel files

/opt/oracle 30 GB Oracle software and database files (dedicated EBS volume)

Key Oracle directories:

Directory Purpose

/opt/oracle Oracle base directory

/opt/oracle/product/26ai/dbhome_1 Oracle software home

/opt/oracle/product/26ai/dbhome_1/network/admin Listener and TNS configuration files

/opt/oracle/diag Oracle diagnostic and alert log files

Manage the Oracle Database

You manage the Oracle Database with the shell scripts in the oracle user's home directory. The database does not use systemd services.

Start the database and listener:

sudo su - oracle cd $HOME . ./start_all.sh

Stop the database and listener:

sudo su - oracle cd $HOME . ./stop_all.sh

Check the listener status:

sudo su - oracle cd $HOME . ./setEnv.sh lsnrctl status

Scripts and log files

Script/Log Path Description

initial_boot_update.sh /stage/scripts Updates the OS with the latest packages on first boot

initial_boot_update.log /stage/scripts Output log for the boot update script

oracle-database-credentials.log /stage/scripts Oracle Database SYSTEM user credentials

setEnv.sh /home/oracle Sets Oracle environment variables for sqlplus and other tools

start_all.sh /home/oracle Starts the ORCL database and Oracle Listener

stop_all.sh /home/oracle Stops the ORCL database and Oracle Listener

On startup

An OS package update script runs on first boot to bring the image fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Cannot connect over SSH

  • Check that the instance has reached 2/2 status checks in the EC2 console.
  • Check that your security group allows inbound TCP port 22 from your IP address.
  • Check that you are using the correct key pair and connecting as ec2-user.

Oracle Listener fails to start

  • Switch to the oracle user: sudo su - oracle.
  • Source the environment: . ./setEnv.sh.
  • Check the listener status: lsnrctl status.
  • Review the listener log at /opt/oracle/diag/tnslsnr/<hostname>/listener/alert/log.xml.
  • Check that no other process uses port 1521: netstat -tlnp | grep 1521.

Database fails to start

  • Switch to the oracle user and source the environment.
  • Connect to SQL*Plus: sqlplus / as sysdba.
  • Check the instance status: SELECT STATUS FROM V\$INSTANCE;.
  • Start the database manually: STARTUP;.
  • Review the alert log at /opt/oracle/diag/rdbms/orclcdb/ORCLCDB/trace/alert_ORCLCDB.log.

Cannot connect remotely on port 1521

  • Check that the Oracle Listener is running: lsnrctl status.
  • Check that your security group allows inbound TCP port 1521 from your IP address.
  • Test connectivity: telnet <instance-ip> 1521.
  • Check that the listener.ora file references the correct hostname.

Security Recommendations

  • Restrict port access: Allow port 1521 only from trusted application servers or specific IP addresses.
  • Change default passwords: Update the SYSTEM and SYS user passwords immediately after your first login.
  • Use strong passwords: Make sure all database user passwords meet complexity requirements.
  • Enable auditing: Configure Oracle Database auditing to track access and changes.
  • Encrypt connections: Configure Oracle Net Services to use SSL/TLS encryption for client connections.
  • Limit OS access: Restrict SSH access to authorised administrators.
  • Review user privileges: Remove unnecessary grants and follow the principle of least privilege.
  • Keep the system updated: Apply Oracle Critical Patch Updates and OS security patches regularly.

Support

If you have any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on AWS

Launch Oracle Database 26ai Standard, with 24/7 support from SecureAnyCloud.

View on Marketplace

Need help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS

Launch Oracle DB 26ai Standard on Linux, with 24/7 support from SecureAnyCloud.

View this image

Need help?

Our support team is available 24/7.

sales@secureanycloud.com