Deployment guide

Oracle Linux 7

Overview

This guide covers the deployment and configuration of Oracle Enterprise Linux 7 on AWS, using SecureAnyCloud AMIs from AWS Marketplace. Oracle Linux is an enterprise-grade Linux distribution built from Red Hat Enterprise Linux source code. It is binary compatible with RHEL and adds Oracle's own Unbreakable Enterprise Kernel (UEK) for enhanced performance and reliability.

What you get:

Oracle Enterprise Linux 7 with the latest security patches
AWS CLI 2.7.7 for AWS service management
AWS CloudWatch Agent 1.247352.0b251908 for monitoring and log collection
AWS Systems Manager Agent 3.1.1476.0 for remote management
Cloud Init 19.4 for instance initialization
An OS package update script that keeps the system current
24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA

Prerequisites

Before you launch this AMI, you need:

An active AWS account
An active subscription to the Oracle Linux 7 listing on AWS Marketplace
An EC2 key pair for SSH access
Familiarity with EC2 instance management and SSH

Recommended instance type: t3.small (2 vCPU, 2 GB RAM) or larger. The minimum requirements are 1 vCPU, 2 GB RAM and 20 GB of disk space.

Launch the AMI

Open AWS Marketplace and search for "Oracle Linux 7 SecureAnyCloud".
Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
Select your preferred Region and Software Version.
Choose Continue to Launch.
Choose Launch through EC2 for full control over the instance configuration.
Select your instance type (t3.small is recommended).
Configure storage with a minimum of 20 GB gp3.
Configure your Security Group with the following inbound rules:

Port Protocol Source Purpose

22 TCP Your IP SSH access

Select your EC2 key pair and launch the instance.

Connect via SSH

When your instance is running and has passed both status checks (2/2), connect over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user:

sudo su -

Important: Wait for the EC2 instance to reach 2/2 successful status checks before you connect. Early connection attempts can produce permission denied errors.

Verify the System

Check the OS version:

cat /etc/oracle-release

Check available disk space:

df -h

Check memory:

free -m

Using AWS CLI

The AWS CLI is preinstalled and ready to use. Verify it with:

aws --help

Check the version:

aws --version

To use AWS CLI commands, attach an IAM role with appropriate permissions to your instance, or configure credentials:

aws configure

Configuring CloudWatch Agent

The AWS CloudWatch Agent is preinstalled for collecting system metrics and logs.

Run the configuration wizard as the root user:

/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard

The wizard guides you through selecting metrics (CPU, memory and disk) and log files to monitor.

Start the CloudWatch Agent after configuration:

/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json

Check the CloudWatch Agent status:

/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status

Expected output:

{ "status": "running", "starttime": "2022-06-05T12:10:13+0000", "configstatus": "configured", "cwoc_status": "stopped", "cwoc_starttime": "", "cwoc_configstatus": "not configured", "version": "1.247350.0b251814" }

Using Systems Manager

The AWS Systems Manager Agent (SSM) is preinstalled for remote management without SSH.

Check SSM Agent status:

systemctl status amazon-ssm-agent

To use Systems Manager features, attach an IAM role with the AmazonSSMManagedInstanceCore policy to your instance.

Configuring Cloud Init

Cloud Init handles instance initialization on first boot. The configuration file is located at:

vi /etc/cloud/cloud.cfg

See the Cloud Init documentation to customize instance behavior on launch.

Server Components

Component Version Install Path

AWS CLI 2.7.7 /usr/local/aws-cli

AWS CloudWatch Agent 1.247352.0b251908 /opt/aws/amazon-cloudwatch-agent

AWS Systems Manager Agent 3.1.1476.0 /usr/bin/amazon-ssm-agent

Cloud Init 19.4 /etc/cloud

Filesystem Layout

Mount Point Size Description

/ 38 GB Root filesystem

/boot 2 GB Operating system kernel files

Scripts and Log Files

Script/Log Path Description

initial_boot_update.sh /stage/scripts Updates the OS with the latest packages on first boot

initial_boot_update.log /stage/scripts Output log for the boot update script

On Startup

An OS package update script runs on first boot to make sure the image is fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Common Administration Tasks

Update all packages:

yum update -y

Install a package:

yum install -y package-name

Check running services:

systemctl list-units --type=service --state=running

View system logs:

journalctl -f

Check kernel version:

uname -r

Oracle Linux Specific Features

Unbreakable Enterprise Kernel (UEK)

Oracle Linux includes the Unbreakable Enterprise Kernel (UEK), Oracle's own optimized kernel built for enterprise workloads. UEK 5 is the default kernel on Oracle Linux 7. It provides enhanced performance, advanced diagnostics and improved hardware support compared to the Red Hat Compatible Kernel (RHCK).

Verify which kernel is running:

uname -r

If the output contains uek, you are running the Unbreakable Enterprise Kernel. If it contains el7, you are running the RHCK.

Switch between kernels:

# List installed kernels grubby --info=ALL | grep title
# Set the default kernel (example for RHCK)
sudo grubby --set-default /boot/vmlinuz-<rhck-version>
# Reboot to apply
sudo reboot

UEK 5 highlights:

Based on Linux 4.14 LTS with Oracle enhancements
Optimized for Oracle Database and middleware workloads
DTrace tracing framework for advanced diagnostics
Enhanced Btrfs filesystem support

Ksplice Zero Downtime Patching

Oracle Linux includes Ksplice, a technology that applies critical kernel security patches without a reboot. It suits production database servers where uptime is critical.

Check Ksplice status:

sudo ksplice kernel show

Apply available patches without reboot:

sudo ksplice kernel upgrade

Note: Ksplice requires an Oracle Linux Premier Support subscription for full functionality. The AMI includes the Ksplice tools preinstalled.

Oracle Database Compatibility

Oracle Linux 7 is Oracle's certified operating system for Oracle Database deployments, including 11g, 12c, 18c, 19c and 21c. Key advantages include:

Prevalidated and certified for Oracle Database
Required Oracle prerequisite packages available via oracle-database-preinstall RPMs
Automatic Storage Management (ASM) kernel driver support via UEK
Optimized huge pages and shared memory configuration for database workloads

Install Oracle Database prerequisites:

sudo yum install -y oracle-database-preinstall-19c

This command configures the kernel parameters, user accounts and resource limits that Oracle Database installation requires.

Troubleshooting

Cannot connect via SSH

Verify that the instance has passed 2/2 status checks.
Check that your security group allows port 22 from your IP.
Make sure you are using the correct key pair and username (ec2-user).

yum update fails

Verify that the instance has internet access (public subnet or NAT gateway)
Check DNS resolution: nslookup yum.oracle.com
Check disk space: df -h

CloudWatch Agent not sending metrics

Verify that the agent is running: /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status
Make sure the instance has an IAM role with CloudWatchAgentServerPolicy
Check agent logs: tail -f /opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log

SSM Agent not connecting

Verify that the agent is running: systemctl status amazon-ssm-agent
Make sure the instance has an IAM role with AmazonSSMManagedInstanceCore
Check that the instance has network access to the SSM service endpoint

Security Recommendations

Restrict SSH access: Allow port 22 only from trusted IP addresses.
Use IAM roles for AWS API access instead of access keys.
Keep the system updated: Run yum update regularly for security patches.
Enable SELinux: Verify that SELinux is enforcing: getenforce
Configure firewall rules: Use firewalld for additional host-level security.
Monitor with CloudWatch: Set up alerts for CPU, memory and disk usage.
Use SSM Session Manager as an alternative to SSH for secure, auditable access.
Review system logs regularly for suspicious activity.

Support

If you run into any issues with this product, contact SecureAnyCloud support:

Email: sales@secureanycloud.com
Website: secureanycloud.com
Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on AWS

Launch Oracle Linux 7 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Videos

Overview: Oracle Linux 7.9 on Azure: overview (watch on YouTube)

Launch and log in: Oracle Linux 7.9 on Azure: launch and log in (watch on YouTube)

Overview

This guide covers the deployment and configuration of Oracle Enterprise Linux 7.9 on Microsoft Azure, using SecureAnyCloud's pre-configured virtual machine image from Azure Marketplace.

What you get:

Oracle Enterprise Linux 7.9, patched to the final Oracle Linux 7 errata available at build time
Unbreakable Enterprise Kernel (UEK) for enhanced performance
Azure Linux Agent (waagent), installed but shipped disabled. Enable it at deploy time (Step 1) or right after your first login (Step 2)
Chronyd for NTP time synchronization
SELinux set to permissive in /etc/selinux/config
24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen2 Hyper-V)

Default user: azureuser

Prerequisites

Before you deploy this image, you need:

An active Microsoft Azure subscription
Access to the Azure Portal or Azure CLI
An SSH key pair for Linux VM access
Familiarity with Azure VM management

Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Deploy the Virtual Machine

Option A: Azure Portal

Open Azure Marketplace and search for "Oracle Linux 7.9 on Azure SecureAnyCloud".
Select the image and choose Create.
Configure the basics:
Subscription: Select your Azure subscription.
Resource Group: Create a new one or select an existing one.
Virtual Machine Name: Enter a name for your VM.
Region: Select your preferred Azure region.
Size: Standard_B2s is recommended.
Under Administrator Account, select SSH public key and enter your key.
Under Inbound Port Rules, allow SSH (port 22).
On the Advanced tab, paste the cloud-init below into Custom data so that the Azure Linux Agent starts at first boot. See "Why enable the Azure Linux Agent" below.
Choose Review + Create, then Create.

#cloud-config runcmd: - [systemctl, enable, --now, --no-block, waagent]

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oracle-linux-7:default:latest cat > enable-waagent.yaml <<'YAML' #cloud-config runcmd: - [systemctl, enable, --now, --no-block, waagent] YAML
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-7-azure-vm \
  --image sac1647283583153:oracle-linux-7:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard \
  --custom-data enable-waagent.yaml

Why enable the Azure Linux Agent

cloud-init provisions this image, and the Azure Linux Agent (waagent) ships installed but disabled. Your VM deploys and you can log in with SSH either way. Until the agent runs, however, the portal shows Agent status: Not Ready, and everything that works through the agent fails.

This includes VM extensions (including the ones Azure Policy, Microsoft Defender for Cloud or Azure Monitor add automatically), Run Command, the portal's Reset password, and Azure Backup.

The custom data above switches the agent on at first boot. If you deployed without it, run the command in Step 2 once after you log in.

Connect via SSH

When your VM is running, connect over SSH:

ssh azureuser@<public-ip-address>

If you did not pass the custom data in Step 1, switch the Azure Linux Agent on now. It starts immediately and stays on after reboots:

sudo systemctl enable --now waagent

To find the public IP address of your VM, run:

az vm show --resource-group myResourceGroup --name my-oracle-linux-7-azure-vm --show-details --query publicIps -o tsv

Verify the Installation

After you connect, verify the operating system:

cat /etc/os-release uname -r

Check disk space and memory:

df -h free -h

Check the Azure Linux Agent:

systemctl status waagent

It should show active (running). If it shows inactive (dead), the agent was not enabled at deploy time. Enable it now. Within a minute or two, the portal's Agent status changes to Ready:

sudo systemctl enable --now waagent systemctl is-active waagent

Update the System

Keep your system up to date with the latest security patches:

sudo yum update -y

Configure Firewall (Optional)

The Azure Network Security Group (NSG) controls inbound and outbound traffic. You can also configure the local firewall. List the current rules with:

sudo firewall-cmd --list-all

To allow additional ports:

sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Common Use Cases

Legacy Oracle Database hosting (11g, 12c)
Enterprise applications requiring RHEL 7 compatibility
Migration of on-premises Oracle Linux 7 workloads to Azure

Troubleshooting

Cannot Connect via SSH

Verify that the VM is in the Running state in the Azure Portal.
Check that the Network Security Group allows port 22.
Make sure you are using the correct username: azureuser
Verify that your SSH key matches the one you configured during deployment.

Azure Agent Not Running, or the Portal Shows "Agent status: Not Ready"

The agent ships disabled (see Step 1). Extensions, Run Command, Reset password and Azure Backup fail until it runs. Enable it with:

sudo systemctl enable --now waagent

When the portal shows Ready, retry the extension, Run Command or password reset that failed.

Reset Password Says "Succeeded" but the New Password Is Refused

The portal's Reset password needs the Azure Linux Agent running (see above). On this image, the reset sets the password and turns on SSH password logins, but the SSH service keeps its old settings until it restarts.

After a reset, Restart the VM from the portal, or, if you can still log in with your key, run sudo systemctl restart sshd. Then log in with the new password. A reset also makes sudo ask for that password.

Package Manager Issues

sudo yum update -y

If repositories are unreachable, check DNS resolution:

nslookup google.com

Important Notes

Oracle Linux 7 left Oracle's Premier Support on 31 December 2024, and 7.9 is its final release. The free public yum channel therefore publishes no new errata. Continued security updates need an Oracle Linux Extended Support subscription.

For new deployments, SecureAnyCloud also publishes Oracle Linux 8 and Oracle Linux 9 images on Azure.

Support

For help with this image, contact SecureAnyCloud support:

Website: secureanycloud.com
Product catalog: secureanycloud.com/products
User guides: secureanycloud.com/guides
SLA: 24-hour response guaranteed

Deploy on Azure

Launch Oracle Linux 7.9 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure