Oracle Linux 10.2

Option A: AWS Marketplace console

• Open the SecureAnyCloud Oracle Linux listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for full control. In Version, choose Oracle Linux 10.2 - YYYY-MM-DD HH:MM (the date and time, in UTC, are when the version was added). Then choose your Region.
• Choose an instance type. m5.large is recommended, and any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Allow inbound TCP 22 from your own IP address or network only in the security group.
• Set the storage. The root volume is 10 GiB gp3 by default. Choose a larger size if you need one, and cloud-init grows the root partition and filesystem to fill it on first boot.
• Leave the metadata settings at their defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-linux-10-2}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all, through AWS Systems Manager Session Manager. This works if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Run these commands to print the release, kernel and package count:

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm rpm -q kernel-uek rpm -qa | wc -l

Expected output:

Oracle Linux Server release 10.2 NAME="Oracle Linux Server" VERSION="10.2" ID="ol" VERSION_ID="10.2" PLATFORM_ID="platform:el10" PRETTY_NAME="Oracle Linux Server 10.2" Linux 6.12.0-207.111.5.5.el10uek.x86_64 x86_64 kernel-uek-6.12.0-207.111.5.5.el10uek.x86_64 376

The image boots the Unbreakable Enterprise Kernel (UEK Release 8, kernel 6.12), the kernel Oracle uses in its own cloud images. The Red Hat Compatible Kernel is not installed. No package of Oracle's cloud image is removed. With the OpenSCAP, AIDE, audit and Postfix packages that the PCI-DSS remediation adds, a new instance has 376 packages. The count moves by a few as kernels and updates install.

This version tracks Oracle Linux 10. Oracle's ol10_baseos_latest repository moves the instance to each new Oracle Linux 10 minor release through normal dnf updates. Your kernel and minor release may be newer if updates have installed since this image was built.

The evaluation that the build ran after its reboot ships on the image. List the files and print the summary:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/pci-dss-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 26M -rw-r--r--. 1 root root 24M Oct 21 15:12 pci-dss-arf.xml -rw-r--r--. 1 root root 2.5M Oct 21 15:12 pci-dss-report.html -rw-r--r--. 1 root root 1.4K Oct 21 15:12 pci-dss-summary.json -rw-r--r--. 1 root root 1.9K Oct 21 15:12 pci-dss-tailoring.xml -rw-r--r--. 1 root root 3.0K Oct 21 15:12 pci-dss-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 21 15:05 scap-security-guide-LICENSE.txt profile: PCI-DSS v4.0 Control Baseline (SCAP Security Guide 0.1.82) scored rules: 229 pass: 223 fail: 6 rate: 97.4% waived: 7 not applicable: 14 evaluated at: 2026-10-21T15:12:21Z

• pci-dss-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• pci-dss-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• pci-dss-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 5).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not checked, not selected, or waived are not counted.
• The same evaluation, re-run on a fresh instance launched from the published AMI, gave the same 223 of 229 (97.4%).

To copy the report to your workstation, run this command on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/pci-dss-report.html .

The seven waived rules

List the waived rules:

grep -v '^#' /usr/share/doc/sac/pci-dss-waivers.txt | cut -f1,2

Expected output:

sudo_require_authentication [default-user-sudo] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] auditd_data_retention_admin_space_left_action [audit-sizing-8gb] rpm_verify_permissions [package-defaults-tightened]

The full reason for each is the third column of the same file. In short:

• Password for sudo. ec2-user is key-only with no password, and cloud-init gives it password-free sudo. Demanding a password for sudo would leave the only administrator unable to use it.
• Root password. A root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own password if you need serial console access (see Step 10).
• Password ageing defaults. The accounts that cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups. A list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Audit log retention action. On a small single root volume, the audit log shares the filesystem with the operating system, and halting the instance when the disk fills would take it down. auditd keeps its rotate and suspend defaults.
• RPM file permissions (rpm_verify_permissions). The profile makes /etc/crontab (0600) and the /etc/cron.d, /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly and /etc/cron.monthly directories (0700) readable by root only, and those rules are applied and scored. rpm_verify_permissions then reports exactly those modes as different from the package defaults. Its fix (rpm --setperms) would put them back to 0644 and 0755, undoing the hardening. The profile contradicts itself here, so this one rule is waived. rpm_verify_hashes and rpm_verify_ownership stay applied and scored.

The six rules that do not pass

List the rules that fail:

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/pci-dss-summary.json'))['failingRules']]"

Expected output:

accounts_password_last_change_is_in_past ensure_pam_wheel_group_empty selinux_confinement_of_daemons set_firewalld_default_zone sysctl_fs_suid_dumpable sysctl_kernel_core_pattern

• Last password change date. The locked root account carries no "last changed" date in /etc/shadow, and the rule wants a date in the past for every account. Root has no password either way.
• The su group. The profile restricts su to members of a group named sugroup (pam_wheel.so group=sugroup in /etc/pam.d/su). That group does not exist, so nobody can use su. The rule also wants the group to exist and be empty. To clear the finding without changing who can use su, run sudo groupadd sugroup.
• Unconfined daemons. The AWS Systems Manager agent runs as the SELinux type unconfined_service_t, because Amazon's package ships no SELinux policy for it. Every other daemon is confined.
• Default firewalld zone. The benchmark wants DefaultZone=drop in /etc/firewalld/firewalld.conf. The image keeps public as the default zone, bound to eth0 and allowing only SSH and the DHCPv6 client inbound. Incoming traffic is filtered the same way, and new interfaces still get a working zone. If you want the stricter default, run sudo firewall-cmd --set-default-zone=drop and keep eth0 in public.
• Core dump settings (two rules). Core dumps are disabled on the running system. sysctl fs.suid_dumpable kernel.core_pattern prints fs.suid_dumpable = 0 and kernel.core_pattern = |/bin/false, set in /etc/sysctl.d/99-sac-pci.conf. On Oracle Linux 10, the systemd-udev package ships /usr/lib/sysctl.d/50-coredump.conf, which would turn them back on. The image replaces it with /etc/sysctl.d/50-coredump.conf, which systemd reads instead of the vendor file. The SCAP Security Guide 0.1.82 checks read the vendor file's lines as configuration anyway, so they report a failure although the settings in force are the ones the profile asks for. The image keeps the package file intact rather than editing a file that rpm owns.

You can repeat the evaluation at any time with the same content and tailoring. It takes about two minutes. Run:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/pci-dss-tailoring.xml \
  --profile xccdf_co.sac_profile_pci-dss_ec2_single \
  --results /tmp/pci-check-results.xml --report /tmp/pci-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ol10-ds.xml > /tmp/pci-check.log 2>&1 echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/pci-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass) {'fail': 6, 'notapplicable': 14, 'notchecked': 2, 'notselected': 632, 'pass': 223} pass rate: 97.4%

Your own report is at /tmp/pci-check-report.html. The content file is ssg-ol10-ds.xml, the Oracle Linux 10 data stream. Oracle's package also carries the Oracle Linux 9 data stream ssg-ol9-ds.xml, but use the Oracle Linux 10 one on this release. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

Send one request without a token and one with a token:

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

Check the firewall state and the listening ports:

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo firewall-cmd --get-active-zones sudo ss -tlnp

Expected output:

running public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: public (default) interfaces: eth0 trusted interfaces: lo State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=989,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=989,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port, and Postfix is disabled.
• The public zone allows ssh and dhcpv6-client. The dhcpv6-client service allows replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address. The default cockpit service is removed from the zone, and Cockpit is not installed.
• The loopback interface sits in firewalld's trusted zone. forward: yes is firewalld's default for a zone on Oracle Linux 10. IP forwarding itself is off in the kernel (net.ipv4.ip_forward = 0), so the instance does not route traffic between interfaces.

To open a port for your own service, take two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic does not arrive.

Check the time and agent services:

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources rpm -q amazon-ssm-agent

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 23.143.82.48 2 6 17 32 -424us[ -852us] +/- 22ms ^- 23.186.168.126 2 6 17 32 +2653us[+2273us] +/- 56ms ^- 108.32.93.57 2 6 17 32 +2681us[+2253us] +/- 8942us ^- 38.45.67.7 2 6 17 32 +522us[ +94us] +/- 16ms ^* 169.254.169.123 3 4 37 16 +20us[ -360us] +/- 476us amazon-ssm-agent-3.3.5390.0-1.x86_64

The ^* marks the source that chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package (3.3.5390.0 on this build). It is not in the Oracle Linux repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r dnf repolist

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 6.12.0-207.111.5.5.el10uek.x86_64 repo id repo name ol10_UEKR8 Oracle Linux 10 UEK Release 8 (x86_64) ol10_appstream Oracle Linux 10 Application Stream Packages (x86_64) ol10_baseos_latest Oracle Linux 10 BaseOS Latest (x86_64)

The instance uses Oracle's public yum server (yum.oracle.com) for BaseOS, AppStream and UEK Release 8. No subscription is needed. dnf-automatic runs daily and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Check SELinux, the root account and the effective SSH settings:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval) '

Expected output:

Enforcing root L never 0 99999 7 -1 maxauthtries 4 clientaliveinterval 900 permitrootlogin no pubkeyauthentication yes passwordauthentication no

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• L means the root account is locked, and never means it has no "last changed" date (see Step 4).
• maxauthtries 4 and clientaliveinterval 900 come from the PCI-DSS profile. SSH allows four authentication attempts per connection and checks idle sessions every 15 minutes.
• sshd -T prints the settings that the SSH server really uses, after every file in /etc/ssh/sshd_config.d/ is applied. The image's key-only settings are in 00-ec2-key-only.conf, which is read first, so it wins over Oracle's 01-permitrootlogin.conf.

SSH ciphers and MACs come from the crypto policy. On Oracle Linux 10, the SSH server includes the system-wide crypto policy (/etc/ssh/sshd_config.d/40-redhat-crypto-policies.conf). To see what the server really offers, run:

update-crypto-policies --show sudo sshd -T | grep -E '^(ciphers|macs) '

Expected output:

DEFAULT ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr macs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512

No CBC or 3DES cipher is offered. To change the algorithms, change the crypto policy (man update-crypto-policies), not sshd_config.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance. The password is yours and is not on the image:

sudo passwd ec2-user

Check the disk, swap, AIDE schedule and Postfix state:

df -hT / lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab systemctl is-enabled postfix sac-postfix-tls

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p1 xfs 10G 2.5G 7.5G 25% / NAME SIZE TYPE FSTYPE MOUNTPOINT nvme0n1 10G disk └─nvme0n1p1 10G part xfs / 2026-10-21 15:33:28,859 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 1) 0 05 4 * * * root /usr/sbin/aide --check disabled enabled

• Disk layout. The root filesystem is XFS on partition 1, the only partition of the root volume. The instance boots in legacy BIOS mode.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 1 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files as the last build step, and the profile schedules aide --check daily at 04:05 from /etc/crontab. After you install software, rebuild it with sudo aide --init and move /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz.
• Postfix. Postfix is installed so local daemons can hand mail to root. It is disabled and, if you enable it, listens on loopback only. sac-postfix-tls.service generates this instance's own Postfix TLS key and certificate at first boot, so no two instances share one.

The instance uses the standard Oracle Linux 10 repositories. List an available package:

sudo dnf -q list --available nginx

Expected output (the versions change over time):

Available Packages nginx.src 2:1.26.3-6.0.1.el10_2.7 ol10_appstream nginx.x86_64 2:1.26.3-6.0.1.el10_2.7 ol10_appstream

Install and start software in the usual way. For example, run sudo dnf -y install nginx and then sudo systemctl enable --now nginx. Open its port in the security group and firewalld (Step 7). The AWS CLI is not on the image. If you need it, install the current version from AWS (the AWS CLI install guide).

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. The restorecon command gives the file the SELinux label that sshd expects. The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice.

The password quality rules of the PCI-DSS profile apply to new passwords, including those that root sets (enforce_for_root). A password needs at least 12 characters with at least one digit and one lower-case letter (/etc/security/pwquality.conf). SSH stays key-only, and sudo uses the password. Password-free sudo is granted only to ec2-user, which cloud-init creates.