Oracle Linux 9 with GNOME desktop

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched. For Oracle Linux 9 with GNOME Desktop, the login user is ec2-user.

Launch from AWS Marketplace

• Open the listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose Launch from EC2 Console (or One-click launch). In Version, choose Oracle Linux 9 with GNOME Desktop - YYYY-MM-DD HH:MM, then choose your Region.
• Choose an instance type. m5.large (2 vCPU, 8 GiB) is recommended. The login screen plus one GNOME session fits in less, but a browser and a few applications need the room. There is no GPU requirement, because the desktop renders in software.
• Choose your EC2 key pair. It is the only way in.
• Allow inbound TCP 22 from your own IP address only in the security group. That is the only port this image needs, because VNC travels inside SSH.
• Set the storage. The root volume is 16 GiB gp3 by default. Choose a larger size if you will install applications. cloud-init grows the root filesystem to fill it on first boot.
• Choose Launch.

ULN Registration

Oracle's Server with GUI environment includes ULN Registration (the rhn-setup-gnome package), and it appears in the application grid. It registers a machine with the Unbreakable Linux Network, Oracle's channel for customers who hold a paid Oracle Linux Support subscription. You do not need it. This image already receives its updates from Oracle's public yum repositories, with no registration and no account. The image is not registered with ULN.

dnf -q repolist enabled

repo id repo name ol9_UEKR8 Oracle Linux 9 UEK Release 8 (x86_64) ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64) ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)

If you do hold an Oracle Linux Support subscription and want ULN, the registration tool is there to use. The image never enables a ULN channel on its own.

Desktops for more users

Each user gets their own display and port. Create the user with a password, have them set their VNC password, then enable their desktop. The helper assigns the next free display (:2 is port 5902). Run:

sudo useradd -m alice
sudo passwd alice
sudo -u alice -H vncpasswd
sudo sac-vnc enable alice

Alice then tunnels her own port, for example ssh -N -L 5902:localhost:5902 alice@<public-ip>, once her SSH public key is in ~alice/.ssh/authorized_keys.

Turn VNC off again

Disable VNC for your user:

sudo sac-vnc disable

VNC desktop for ec2-user disabled: display :1 removed, nothing listening on port 5901

This stops the session, disables vncserver@:1.service and removes the mapping, so nothing listens after a reboot. sudo sac-vnc status shows the state at any time.

Security posture

Run the commands below to confirm these settings:

• SSH is key-only and forwards local ports only.
• Root is locked.
• No account has a password until you set one.
• The host firewall admits SSH only.
• SELinux is enforcing.
• The instance never suspends.

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication|allowtcpforwarding) '
sudo passwd -S root | awk '{print $1, $2}'
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo firewall-cmd --list-services getenforce busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend

permitrootlogin no pubkeyauthentication yes passwordauthentication no allowtcpforwarding local root LK accounts with a password: 0 dhcpv6-client ssh Enforcing s "na"

allowtcpforwarding local is what lets the SSH tunnel of Step 5 reach the desktop. Local forwards (ssh -L) work, while remote forwards (ssh -R) are refused, and X11 forwarding, gateway ports and tunnel devices stay off. After Step 3, the password count reads 1 (your own account).

root LK means the root account is locked. na means logind will not suspend the instance, so the desktop menu offers Power Off and Log Out but never Suspend. A suspended instance stops answering while EC2 still reports it running.

Each instance also gets its own identity at first boot. The instance generates its SSH host keys, /etc/machine-id, the NVMe host identity (/etc/nvme/hostnqn, /etc/nvme/hostid) and the BrlAPI key of the braille display library (/etc/brlapi.key, readable by root and the brlapi group only), so no two instances share them.

The system journal is persistent. journald keeps it in /var/log/journal on the root filesystem, so the logs of earlier boots survive a restart (journalctl --list-boots).

Known issue: TigerVNC and CVE-2025-49177

CVE-2025-49177 is not fixed in the TigerVNC package on Oracle Linux 9. The Red Hat Security Data API lists tigervnc on Red Hat Enterprise Linux 9 as "Will not fix", severity Important, CVSS 3.1 score 6.1 with a local attack vector (AV:L). Oracle's CVE page for it lists an erratum for Oracle Linux 10 only, so there is no Oracle Linux 9 TigerVNC update to install. It is a flaw in the X server's XFIXES extension: the XFixesSetClientDisconnectMode handler does not validate the request length, so a connected X client can read memory left over from earlier requests.

What that means on this image: Xvnc accepts X clients only through its local socket and the desktop user's own X authority cookie, with no X11 TCP port, and VNC is off until you enable it. If your security policy does not accept an unfixed vendor CVE, do not enable VNC on this image. If Oracle publishes a fixed package, dnf-automatic applies it automatically.

View the compliance report

The evaluation that the build ran ships in /usr/share/doc/sac/ in three forms:

• pci-dss-report.html, the HTML report
• pci-dss-arf.xml, the machine-readable ARF results
• pci-dss-summary.json, with the counts, pass rate, threshold, SSG version and checksums

The shipped copy replaces the build host's name and addresses. Print the summary and the failing rules:

python3 -c "import json; d=json.load(open('/usr/share/doc/sac/pci-dss-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/pci-dss-summary.json'))['failingRules']]"

PCI-DSS v4.0 Control Baseline 0.1.82 - 233 of 238 scored rules pass (97.9%) - waived 7 accounts_password_last_change_is_in_past aide_build_database ensure_pam_wheel_group_empty selinux_confinement_of_daemons set_firewalld_default_zone

The five rules that do not pass on this image:

• Last password change date. The locked root account carries no "last changed" date in /etc/shadow, and the rule wants a date in the past for every account. Root has no password either way.
• AIDE database. The image ships an AIDE database built from its own files as the last build step (/var/lib/aide/aide.db.gz) and runs aide --check daily. However, the rule's file check does not find a database at the path it expects. To rebuild the database for your own instance after you install software, run sudo aide --init and move /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz.
• The su group. The profile restricts su to members of a group named sugroup (pam_wheel.so group=sugroup in /etc/pam.d/su). That group does not exist, so nobody can use su. The rule also wants the group to exist and be empty. To clear the finding without changing who can use su, run sudo groupadd sugroup.
• Unconfined daemons. The AWS Systems Manager agent (amazon-ssm-agent and its ssm-agent-worker) runs as the SELinux type unconfined_service_t, because Amazon's package ships no SELinux policy for it.
• Default firewalld zone. The benchmark wants DefaultZone=drop in /etc/firewalld/firewalld.conf. The image keeps public as the default zone, bound to eth0 and allowing only SSH and the DHCPv6 client inbound. Incoming traffic is filtered the same way, and new interfaces still get a working zone. If you want the stricter default, run sudo firewall-cmd --set-default-zone=drop and keep eth0 in public.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ec2-user@<public-ip>:/usr/share/doc/sac/pci-dss-report.html .

You can re-run the same evaluation on your instance at any time. It takes a few minutes and changes nothing. oscap exits with status 2 when any rule fails, and it still writes the report:

sudo oscap xccdf eval --tailoring-file /usr/share/doc/sac/pci-dss-tailoring.xml \
  --profile xccdf_co.sac_profile_pci-dss_ec2_single \
  --report ~/pci-dss-rescan.html /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml

Use the ssg-ol9-ds.xml content shown above. The scap-security-guide package also ships the RHEL 9 data stream, but that content only applies to Red Hat Enterprise Linux. On Oracle Linux, it reports almost every rule as not applicable.

Waived rules

The tailoring file deselects these rules of the profile, so they are not scored. The reasons are in /usr/share/doc/sac/pci-dss-waivers.txt. Everything else the profile selects is remediated and scored. List the waived rules:

grep -v '^#' /usr/share/doc/sac/pci-dss-waivers.txt | cut -f1,2

sudo_require_authentication [default-user-sudo] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] auditd_data_retention_admin_space_left_action [audit-sizing-8gb] sshd_disable_tcp_forwarding [vnc-ssh-tunnel]

Each rule and the reason it is waived:

• sudo_require_authentication: ec2-user is key-only with no password, and cloud-init gives it password-free sudo. Demanding a password for sudo would leave the only administrator unable to use it.
• ensure_root_password_configured: a root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
• accounts_maximum_age_login_defs and account_disable_post_pw_expiration: password-age defaults apply to every account that cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
• sshd_limit_user_access: an AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user data. SSH is key-only, root login is refused, and your security group restricts the source addresses.
• auditd_data_retention_admin_space_left_action: on a single root volume, the audit log shares the filesystem with the operating system, and halting the instance when the disk fills would take it down. auditd keeps its rotate and suspend defaults.
• sshd_disable_tcp_forwarding: the rule sets AllowTcpForwarding no, which would refuse the SSH tunnel that is the only way to reach the desktop. VNC listens on localhost only, and you reach it through an SSH local forward (ssh -L). The image therefore sets AllowTcpForwarding local instead. Local forwards work and remote forwards (ssh -R) are refused. X11 forwarding, gateway ports and tunnel devices stay off.

Networking and services that ship switched off

NetworkManager manages the EC2 network interface, and cloud-init writes its connection profile at first boot. Check the device state:

nmcli -t -f DEVICE,TYPE,STATE device

eth0:ethernet:connected lo:loopback:connected (externally)

The Server with GUI group brings several network services that this image leaves switched off. Check them:

for u in cockpit.socket avahi-daemon.service cups.service bluetooth.service ModemManager.service rpcbind.socket xvnc.socket; do echo "$u: $(systemctl is-enabled "$u" 2>/dev/null || true)" done

cockpit.socket: disabled avahi-daemon.service: masked cups.service: bluetooth.service: disabled ModemManager.service: disabled rpcbind.socket: xvnc.socket: disabled

masked on Avahi comes from the PCI-DSS profile. An empty value means the unit is not installed, because this image has no CUPS print server and no rpcbind. Cockpit, Bluetooth and ModemManager are installed but disabled.

To use the Cockpit web console, run sudo systemctl enable --now cockpit.socket. Reach it through an SSH tunnel as well, because the host firewall admits SSH only. Run ssh -N -L 9090:localhost:9090 ec2-user@<instance-public-ip>, then open https://localhost:9090.

Do not enable xvnc.socket. It serves a login screen over VNC on port 5900 with no VNC password.

Printing

This image does not include printing. The CUPS print server (cups) and its filters (cups-filters, cups-filters-libs) are not installed, and /etc/dnf/dnf.conf excludes them so that no update or dependency brings them back. The CUPS client library (cups-libs) stays, because GTK and GNOME Settings link against it. Check the state:

rpm -q cups cups-filters cups-libs | sed 's/-[0-9].*//' grep '^exclude=' /etc/dnf/dnf.conf

package cups is not installed package cups-filters is not installed cups-libs exclude=kernel-uek-headers cups cups-filters cups-filters-libs cups-browsed libcupsfilters libppd

If you need printing, edit the exclude= line in /etc/dnf/dnf.conf back to Oracle's own exclude=kernel-uek-headers and keep that entry. Then run sudo dnf install -y cups cups-filters and sudo systemctl enable --now cups.

Patching

Oracle publishes its security errata (ELSA advisories) as advisory data in its public repositories, so dnf can tell you which pending updates fix security issues. dnf-automatic applies updates automatically each day. Check what is pending now:

sudo dnf -q check-update --refresh >/dev/null; echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
sudo dnf -q updateinfo list --security | wc -l grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer

dnf check-update exit code: 100 (0 = nothing to update, 100 = updates available) 0 upgrade_type = security apply_updates = yes enabled

upgrade_type = security means dnf-automatic installs only the updates that Oracle publishes as security errata, once a day. To stop automatic updates, run sudo systemctl disable --now dnf-automatic.timer.

An instance launched later lists the updates released since, with exit code 100. To install everything now, run sudo dnf -y upgrade, then sudo systemctl reboot if a new kernel was installed. Automatic updates never restart the instance for you. dnf needs-restarting -r tells you whether a restart is owed.

Support lifecycle

Oracle Linux 9 is not an end-of-life product. It reached general availability in July 2022. Oracle's Premier Support for it runs until June 2032 and Extended Support until June 2035. Check Oracle's Lifetime Support Policy for the dates that apply to your deployment.

Troubleshooting

"Connection refused" on localhost:5901

VNC is switched off on a new instance by design. Run sudo sac-vnc enable first, and check that the SSH tunnel is still running in its own terminal window. sudo sac-vnc status shows whether anything is listening on 5901.

The viewer says "Authentication failure"

The viewer wants your VNC password (set with vncpasswd), not your account password. Only its first 8 characters count. To set a new one, run vncpasswd again as yourself, then run sudo sac-vnc disable and sudo sac-vnc enable.

Connecting to the instance's public IP on port 5901 does not work

That is by design. The VNC server listens on localhost only, whatever a user's own TigerVNC settings say. Use the SSH tunnel in Step 5.

The screen is locked and asks for a password

The screen locks after 15 minutes of inactivity (PCI-DSS profile). Unlock it with your account password (the one from sudo passwd). After repeated failed attempts, the account is locked for a while. To unlock it early, run sudo faillock --user ec2-user --reset over SSH.

The desktop does not start for a user

sudo sac-vnc enable <user> says what is missing. For anything else, read journalctl -u vncserver@:1 and the session log in ~<user>/.local/state/tigervnc/.

Cannot connect via SSH

• Check that the security group allows port 22 from your address.
• Use the user ec2-user and the key pair you chose at launch. Password login over SSH is disabled by design.

A service is blocked and the logs mention SELinux

SELinux is enforcing. Read the denial with sudo ausearch -m avc -ts recent before you change anything. Fix the label or the boolean it names rather than turning SELinux off.

Emergency access

No account has a password until you set one. EC2 Serial Console and single-user recovery need a local password, and the one you set in Step 3 works for the serial console. If SSH is unavailable, use Session Manager to get in.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com.

Oracle Linux is free and open source, and Oracle permits its redistribution. The binaries, updates and errata are available at no cost, and an Oracle Linux Support subscription is optional. It is assembled from thousands of independently packaged components, each under its own licence (see rpm -qi <package>). No subscription, registration or licence key is required. This image is not Oracle Database and carries no Oracle Database licensing.

Oracle and Oracle Linux are trademarks of Oracle and/or its affiliates. GNOME is a trademark of the GNOME Foundation. TigerVNC is a trademark of its respective owner. PCI DSS is a trademark of the PCI Security Standards Council. The names are used only to identify the software this image contains. SecureAnyCloud is not affiliated with or endorsed by Oracle, the GNOME Foundation, the TigerVNC project or the PCI Security Standards Council.

Deploy on AWS

Launch Oracle Linux 9 with GNOME Desktop on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com