Oracle Instant Client 23.26 on Oracle Linux 9

Open the listing on AWS Marketplace, choose View purchase options and then Subscribe. When the subscription is active, choose Launch your software. In Version, pick Oracle Instant Client 23.26 on Oracle Linux 9.

Choose your Region, an instance type (m5.large is recommended), your key pair and a security group that opens port 22 from your own networks only. Then launch the instance. The instance is ready about two minutes after launch.

Replace <ami-id> with the AMI ID of this version in your Region, and replace the other bracketed values with your own. The command requires IMDSv2:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-instant-client-23-26}]'

When the instance is running, get its public address:

aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text

Version SSH user

Oracle Instant Client 23.26 on Oracle Linux 9 ec2-user

ssh -i <your-key.pem> ec2-user@<public-ip>

Check that the first boot verification has run.

systemctl status sac-oracle-client-firstboot.service --no-pager | head -5 sudo cat /var/log/sac/oracle-client-firstboot.log

The unit is active (exited) with status=0/SUCCESS. The log records how many Instant Client files were checked.

● sac-oracle-client-firstboot.service - sac: verify Oracle Instant Client on first boot Loaded: loaded (/etc/systemd/system/sac-oracle-client-firstboot.service; enabled; preset: disabled) Active: active (exited) since Sun 2026-10-25 03:40:27 UTC; 3min 50s ago Process: 572 ExecStart=/usr/local/sbin/sac-oracle-client-firstboot (code=exited, status=0/SUCCESS) Main PID: 572 (code=exited, status=0/SUCCESS) 2026-10-25T03:39:44Z first boot verification started 2026-10-25T03:40:27Z verified 26 Instant Client files (rpm -V clean); SQL*Plus 23.26.4.0.0

If the unit failed, read /root/oracle-client-FIRSTBOOT-FAILED.txt and contact support.

sqlplus -V rpm -q oracle-instantclient-basic oracle-instantclient-sqlplus oracle-instantclient-tools ls /usr/lib/oracle/23/client64/bin | tr '\n' ' '; echo

SQL*Plus: Release 23.26.4.0.0 - Production Version 23.26.4.0.0 oracle-instantclient-basic-23.26.4.0.0-1.el9.x86_64 oracle-instantclient-sqlplus-23.26.4.0.0-1.el9.x86_64 oracle-instantclient-tools-23.26.4.0.0-1.el9.x86_64 adrci exp expdp genezi imp impdp sqlldr sqlplus wrc

The release line shows the exact Instant Client release, 23.26.4.0.0, as Oracle built it.

Path Purpose

/usr/lib/oracle/23/client64/bin The Instant Client tools

/usr/lib/oracle/23/client64/lib The OCI, OCCI and JDBC-OCI libraries (libclntsh.so, libocci.so, libocijdbc23.so), in the system library path

/usr/lib/oracle/23/client64/lib/network/admin Instant Client's default Oracle Net directory: sqlnet.ora and tnsnames.ora

/usr/share/oracle/23/client64/doc Oracle's license and readme files for each package

/etc/profile.d/oracle-instantclient.sh PATH and NLS_LANG for login shells

/usr/share/doc/sac/oracle-instantclient-23-26/README.txt A summary of this image

The image carries a self-test that repeats the first boot checks. It proves the client works end to end without a database. It covers Oracle Net name resolution, a connection attempt that reaches the network layer, the tools from a login shell and from an empty environment, the exact listening ports, SELinux, the locked root account, a root login shell that still uses the system libraries, and every SSH setting.

sudo /usr/local/sbin/sac-oracle-client-selftest

PASS: first-boot verification marker present PASS: no first-boot failure note PASS: rpm -V clean for oracle-instantclient-basic oracle-instantclient-sqlplus oracle-instantclient-tools PASS: Instant Client matches the build manifest (26 files) PASS: login shell: sqlplus -V = 23.26.4.0.0 PASS: empty environment: sqlplus -V = 23.26.4.0.0 PASS: login shell: SQL*Loader 23.26.4.0.0 PASS: empty environment: Data Pump expdp 23.26.4.0.0 PASS: sqlplus: unknown alias refused by name resolution (ORA-12154) PASS: sqlplus: no listener on this instance (ORA-12541) PASS: only TCP 22 listens PASS: no Oracle listener process PASS: SELinux enforcing PASS: firewalld public: dhcpv6-client ssh PASS: no account carries a password hash, locked or not PASS: root is locked with no password hash ('!') PASS: root login shell: no LD_LIBRARY_PATH; firewall-cmd, the system XML parser and sqlplus work PASS: sshd -T PasswordAuthentication no PASS: sshd -T KbdInteractiveAuthentication no PASS: sshd -T PermitEmptyPasswords no PASS: sshd -T PermitRootLogin no PASS: sshd -T PubkeyAuthentication yes PASS: sshd -T X11Forwarding no PASS: sshd -T AllowTcpForwarding yes PASS: sshd -T MaxAuthTries 4 PASS: sshd -T ClientAliveInterval 300 PASS: sshd -T ClientAliveCountMax 3 PASS: sshd -T LoginGraceTime 60 PASS: no compiler (gcc, cc, c++, g++, make) on the PATH PASS: no core dump or crash report ORACLE_CLIENT_SELFTEST_OK

ORA-12154 and ORA-12541 are the expected answers here. The self-test asks for an alias that does not exist and connects to port 1521 on the instance itself, where no listener runs. The self-test checks for the release this image shipped. After you install a newer Instant Client (step 10), its release checks report the new release as a failure.

sqlnet.ora resolves names through tnsnames.ora first and then EZCONNECT (host:port/service). You can connect without any configuration, or give each database a short alias. Look at the shipped files.

grep -v '^#' /usr/lib/oracle/23/client64/lib/network/admin/sqlnet.ora cat /usr/lib/oracle/23/client64/lib/network/admin/tnsnames.ora

NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT) SQLNET.EXPIRE_TIME = 10 SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
# sac Oracle Instant Client 23.26 - Oracle Net service names.
# Add one entry per database, for example:
#
# MYDB =
# (DESCRIPTION =
# (ADDRESS = (PROTOCOL = TCP)(HOST = db.example.com)(PORT = 1521))
# (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = ORCLPDB1))
# )

The files belong to root, so edit them with sudo. To add an alias, append an entry with your database's host, port and service name. Then test it with a connection that SQL*Plus prompts you to complete.

sudo tee -a /usr/lib/oracle/23/client64/lib/network/admin/tnsnames.ora > /dev/null <<'TNS' MYDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = <db-host>)(PORT = 1521)) (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = <service-name>)) ) TNS sqlplus <db-user>@MYDB

ORA-12154 means the alias is not in tnsnames.ora. ORA-12170 or a timeout means the network path to the database (security groups, network ACLs, routes) does not allow the connection. ORA-12514 means the listener answered but does not know the service name.

To keep your own tnsnames.ora and sqlnet.ora elsewhere, set TNS_ADMIN to that directory in your shell profile or your application's environment.

Connect with the alias, or directly with EZCONNECT. SQL*Plus prompts for the password, which keeps it out of your shell history and the process list.

sqlplus <db-user>@MYDB sqlplus <db-user>@//<db-host>:1521/<service-name>

For Amazon RDS for Oracle, <db-host> is the DB instance endpoint shown in the RDS console and <service-name> is the database name (ORCL by default). When you are connected, run:

SELECT banner_full FROM v$version; SELECT sys_context('USERENV', 'SERVICE_NAME') FROM dual;

Never put a password on the command line (sqlplus user/password@db). It is visible to every user of the instance in the process list.

For unattended scripts, keep the credentials in an Oracle wallet (a secure external password store) in a directory only your account can read. Add WALLET_LOCATION and SQLNET.WALLET_OVERRIDE = TRUE to your own sqlnet.ora, and connect with sqlplus /@MYDB. Instant Client does not include mkstore or orapki, so create the wallet with a full Oracle Database Client (another version in this listing) or on the database host, and copy it over. The image ships no wallet, so every wallet you use is your own.

Oracle Net traffic is not encrypted unless the client and the server agree to encrypt it. sqlnet.ora carries commented settings for both methods.

• Oracle Native Network Encryption. Uncomment the SQLNET.ENCRYPTION_CLIENT and SQLNET.CRYPTO_CHECKSUM_CLIENT lines (REQUIRED, AES256 and SHA256) to refuse any unencrypted session. The database must accept encryption. Amazon RDS for Oracle enables it with the NATIVE_NETWORK_ENCRYPTION option.
• TLS (TCPS). Point WALLET_LOCATION at a wallet holding your database's CA certificate, and use (PROTOCOL = TCPS) and the database's TLS port in the alias. Amazon RDS for Oracle provides TLS with its SSL option and publishes its CA certificates.

grep -n 'ENCRYPTION\|CRYPTO\|WALLET' /usr/lib/oracle/23/client64/lib/network/admin/sqlnet.ora

10:# SQLNET.ENCRYPTION_CLIENT = REQUIRED 11:# SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256) 12:# SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED 13:# SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256) 15:# WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /path/to/your/wallet)))

Edit sqlnet.ora with sudo, as in step 6. If the database is only reachable through a bastion, an SSH tunnel also works. Run ssh -N -L 1521:<db-host>:1521 ec2-user@<bastion> and connect to //localhost:1521/<service-name>.

Instant Client needs no ORACLE_HOME and no LD_LIBRARY_PATH. The libraries are in the system library path, sqlplus is in /usr/bin, and the other tools are linked into /usr/local/bin. They work from scripts and cron with a plain PATH.

cat /etc/ld.so.conf.d/oracle-instantclient.conf ls -l /usr/bin/sqlplus /usr/local/bin/sqlldr /usr/local/bin/expdp | awk '{print $9,$10,$11}' env -i PATH=/usr/local/bin:/usr/bin:/bin sqlldr -help | sed -n '1,3p'

/usr/lib/oracle/23/client64/lib /usr/bin/sqlplus -> /usr/lib/oracle/23/client64/bin/sqlplus /usr/local/bin/expdp -> /usr/lib/oracle/23/client64/bin/expdp /usr/local/bin/sqlldr -> /usr/lib/oracle/23/client64/bin/sqlldr SQL*Loader: Release 23.26.4.0.0 - Production on Sun Oct 25 03:44:21 2026 Version 23.26.4.0.0

A cron job's default PATH is /usr/bin:/bin. In cron, call the tools other than sqlplus by their /usr/local/bin path, or set PATH at the top of the crontab. Applications use the libraries directly.

• OCI (C, C++, python-oracledb thick mode, node-oracledb thick mode, PHP OCI8, Perl DBD::Oracle, Go godror): the drivers find libclntsh.so through the system library path. For python-oracledb, call oracledb.init_oracle_client() with no arguments. Install the language driver itself with your own package manager.
• Java: the Basic package provides Oracle's JDBC driver for JDK 8 and later (/usr/lib/oracle/23/client64/lib/ojdbc8.jar, thin and OCI) and the native JDBC-OCI library (libocijdbc23.so) for the JDBC OCI driver. No Java runtime is installed. For JDK 11 and later, you can use ojdbc11.jar from Oracle's JDBC download page or Maven Central (com.oracle.database.jdbc:ojdbc11) instead.
• ODBC: the Instant Client ODBC package is not included in this image.
• Building OCI or OCCI programs on the instance: no C compiler ships. Install one with sudo dnf install gcc gcc-c++ make. Get the header files from Oracle's Instant Client SDK package (oracle-instantclient-devel, the same release as the Basic package) on Oracle's download page or yum repository.

This image ships Oracle's Instant Client release 23.26.4.0.0 as Oracle built it. SecureAnyCloud applies no Oracle patch to it. Oracle publishes new Instant Client releases (23.26.x) for everyone, about once a quarter. They appear on its Instant Client download page and in its Oracle Linux 9 Instant Client yum repository, which can lag the download page by some weeks.

• Oracle Instant Client downloads: https://www.oracle.com/database/technologies/instant-client/linux-x86-64-downloads.html
• Oracle's Critical Patch Update advisories, which list the security fixes in each quarterly update: https://www.oracle.com/security-alerts/

To take a newer release from the yum repository, add Oracle's repository definition and upgrade the Instant Client packages. dnf only moves to a release newer than the one installed.

sudo dnf install oracle-instantclient-release-26ai-el9
sudo dnf upgrade 'oracle-instantclient*' sqlplus -V

To take a release that is on the download page but not yet in the repository, download its el9 Basic, SQL*Plus and Tools RPMs from Oracle. Check them against the SHA-256 values on that page, and install them together with sudo dnf install ./oracle-instantclient-*.rpm.

The Oracle Linux packages update themselves. dnf-automatic applies Oracle Linux security errata every day. Check it with:

grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer rpm -q --qf '%{NAME} %{VERSION} built %{BUILDTIME:date} by %{VENDOR}\n' oracle-instantclient-basic

upgrade_type = security apply_updates = yes enabled oracle-instantclient-basic 23.26.4.0.0 built Thu 08 Oct 2026 21:31:54 UTC by Oracle Corporation

To apply every available update now, run sudo dnf upgrade. Reboot if a new kernel was installed.

sudo ss -tlnp sudo firewall-cmd --list-services getenforce
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|x11forwarding|pubkeyauthentication) ' chronyc -n sources | sed -n '1,3p'

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=733,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=733,fd=8)) dhcpv6-client ssh Enforcing permitrootlogin no pubkeyauthentication yes passwordauthentication no x11forwarding no MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 169.254.169.123 3 4 377 1 -8341ns[+4625ns] +/- 642us

• Only SSH listens. The image never needs an inbound port beyond 22, so keep port 1521 closed on this instance.
• The SSH settings live in /etc/ssh/sshd_config.d/00-sac.conf, which is read before every other SSH setting. Your EC2 key pair is the only way in. Root login and passwords are refused.
• SELinux is enforcing, and the host firewall (firewalld) allows SSH only, alongside your security group.
• The instance metadata service accepts IMDSv2 requests only (the AMI requires a session token).
• The clock follows the Amazon Time Sync Service (169.254.169.123), which every subnet reaches without internet access. The time zone is UTC.