SecureAnyCloud
Deployment guide

Oracle WebLogic 12c

Overview

Oracle WebLogic Server is an enterprise-grade Java application server for developing, deploying and managing large-scale distributed applications. It supports Java EE standards, provides clustering capabilities and integrates with Oracle databases and other Oracle middleware products.

The Oracle WebLogic 12c AMI from SecureAnyCloud gives you a preconfigured WebLogic Server installation that runs on Amazon EC2. It includes a sample domain (base_domain) with an AdminServer already configured, so you can start the instance and open the WebLogic Administration Console within minutes. The AMI is suitable for development, testing, staging and production environments.

What you get:

  • A preconfigured Oracle WebLogic Server installation with a sample base_domain domain and an AdminServer
  • The WebLogic Administration Console on port 7001
  • All Oracle software under a dedicated /u01 mount point on its own EBS volume
  • Start and stop scripts in the home directory of the oracle OS user
  • A randomly generated administrator password stored in a credentials file
  • 24/7 SecureAnyCloud support

This guide shows you how to connect to the instance, start WebLogic, open the Administration Console, change the administrator password and apply security best practices. To explore the full catalogue of preconfigured AMIs on the AWS Marketplace, visit secureanycloud.com.

Prerequisites

Before you launch the Oracle WebLogic 12c AMI, make sure you have the following.

AWS account. You need an active AWS account with permission to launch EC2 instances and manage security groups.

EC2 key pair. Create a key pair, or select an existing one, in the region where you plan to launch the instance. SSH authentication requires it.

Security group. Allow inbound traffic on these ports:

  • SSH, TCP 22: remote administration
  • TCP 7001: Oracle WebLogic Administration Console

Restrict SSH to your own IP address or a trusted CIDR range. Limit the Administration Console port (7001) to trusted IP addresses as well.

Minimum system requirements. 1 vCPU, 1 GB of RAM and 20 GB of disk space.

For production workloads or deployments with multiple managed servers, consider an m5.large or larger instance type with at least 4 GB of RAM. WebLogic benefits significantly from additional memory.

Step by Step Setup

Step 1 - Launch the instance

  • Open the AWS Marketplace listing for Oracle WebLogic 12c by SecureAnyCloud.
  • Select Continue to Subscribe, then Continue to Configuration.
  • Choose your AWS Region and instance type.
  • On the launch page, choose your VPC and subnet, and assign the security group you prepared.
  • Select your EC2 key pair and launch the instance.

Step 2 - Wait for the status checks

Wait until the EC2 instance shows 2/2 status checks passed before you connect. The instance runs an initial boot update script that applies the latest operating system patches, so the first boot can take a few minutes longer than usual.

If you connect before both status checks have passed, you may see an error such as:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ec2-user@your-instance-ip's password:

This is expected during early boot. Wait for the status checks to complete, then try again.

Step 3 - Connect over SSH

Connect to the instance with your private key:

ssh -i /path/to/your-key.pem ec2-user@<PUBLIC_IP>

Replace <PUBLIC_IP> with the public IP address or public DNS name shown in the EC2 console.

Step 4 - Switch to the root user

After you connect as ec2-user, switch to the root user:

sudo su -

Step 5 - Retrieve the WebLogic administrator password

The WebLogic administrator password is randomly generated at build time. Read it from the credentials file:

cat /stage/scripts/weblogic-credentials.txt

Note the password. You need it to sign in to the WebLogic Administration Console. The default administrator username is weblogic.

Step 6 - Switch to the oracle user

Manage WebLogic services as the oracle OS user. Type this command manually instead of pasting it:

sudo su - oracle

Step 7 - Start the WebLogic instance

Three scripts are available in the home directory of the oracle user. Run the start script to launch the sample WebLogic instance:

cd $HOME . ./start-weblogic.sh

The script writes a start log in the home directory of the oracle user. Follow the startup progress:

tail -f /home/oracle/start-weblogic.log

Wait for these messages in the log. They confirm that the server has started:

<Server state changed to RUNNING> <Server started in RUNNING mode>

The full startup output shows the AdminServer for the "base_domain" domain running in Production Mode and listening on port 7001 for protocols including iiop, t3, ldap, snmp and http.

Step 8 - Open the WebLogic Administration Console

Open a web browser and go to:

http://<PUBLIC_IP>:7001/console

The Oracle WebLogic Server Administration Console login page opens.

Sign in with these credentials:

  • Username: weblogic
  • Password: the randomly generated password from /stage/scripts/weblogic-credentials.txt

Select Login to open the console.

Step 9 - Change the administrator password (recommended)

Change the default password after your first sign-in. In the Administration Console:

  • Select Lock & Edit in the top left pane to enter edit mode.
  • In the left navigation, select Security Realms.
  • Select myrealm to open the security realm settings.
  • Open the Users and Groups tab.
  • Select the weblogic user.
  • Open the Passwords tab.
  • Enter a new strong password in both the New Password and Confirm New Password fields.
  • Select Save.
  • Select Release Configuration in the left pane to apply the change.

Server Components

The Oracle WebLogic 12c AMI includes these preconfigured components:

  • Oracle WebLogic Server in /u01: the enterprise Java application server, with the Administration Console.
  • Java (JDK), bundled with WebLogic: the Java Development Kit that WebLogic Server requires.

The WebLogic installation includes:

  • AdminServer, configured in the base_domain domain
  • Administration Console, available on port 7001
  • WLST (WebLogic Scripting Tool) for command-line administration
  • Support for protocols including IIOP, T3, LDAP, SNMP and HTTP

Filesystem Layout

The AMI uses dedicated mount points to separate the operating system from the Oracle software.

  • /: the root filesystem, which contains the operating system
  • /boot: the operating system kernel files
  • /u01: the Oracle software installation directory, on a dedicated volume

Key directories and files

  • /u01: the top-level Oracle software installation directory
  • /u01/oracle: the Oracle WebLogic installation home
  • /home/oracle: the home directory of the oracle OS user, which holds the start and stop scripts
  • /home/oracle/setEnv.sh: sets Oracle environment variables, including paths for WLST and other utilities
  • /home/oracle/start-weblogic.sh: starts the WebLogic AdminServer instance
  • /home/oracle/stop-weblogic.sh: stops the WebLogic AdminServer instance
  • /home/oracle/start-weblogic.log: log output from the most recent WebLogic start
  • /stage/scripts: SecureAnyCloud provisioning scripts and credential files
  • /stage/scripts/weblogic-credentials.txt: the randomly generated WebLogic administrator password

The /u01 volume is a separate EBS volume. You can resize the storage for the Oracle installation independently, without affecting the root filesystem.

Managing Services

You manage WebLogic services as the oracle OS user, with the scripts in its home directory.

Set up the Oracle environment

Before you use any Oracle utility, such as WLST, source the environment script:

sudo su - oracle . ./setEnv.sh

The script sets the required environment variables, including ORACLE_HOME, JAVA_HOME and the PATH entries for the WebLogic tools.

Start the WebLogic instance

sudo su - oracle cd $HOME . ./start-weblogic.sh

Follow the startup log:

tail -f /home/oracle/start-weblogic.log

The server is ready when the log shows Server state changed to RUNNING.

Stop the WebLogic instance

sudo su - oracle cd $HOME . ./stop-weblogic.sh

Check the WebLogic status

To confirm that the WebLogic process is running, check the Java processes:

ps -ef | grep weblogic

Or check that port 7001 is listening:

netstat -tlnp | grep 7001

Scripts and Log Files

SecureAnyCloud includes several scripts and log files in the AMI to streamline provisioning and service management.

  • initial_boot_update.sh in /stage/scripts: updates the operating system with the latest available patches on first boot
  • initial_boot_update.log in /stage/scripts: output log of the initial boot update script
  • weblogic-credentials.txt in /stage/scripts: the randomly generated WebLogic administrator password
  • setEnv.sh in /home/oracle: sets Oracle environment variables for tools such as WLST
  • start-weblogic.sh in /home/oracle: starts the sample Oracle WebLogic AdminServer instance
  • stop-weblogic.sh in /home/oracle: stops the Oracle WebLogic AdminServer instance
  • start-weblogic.log in /home/oracle: log output from the most recent WebLogic start

Disable the initial boot update script

The OS update script runs automatically on every reboot through crontab. To manage updates manually instead, disable it:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# DELETE THE BELOW LINE, SAVE AND EXIT THE FILE: @reboot /stage/scripts/initial_boot_update.sh

Using the Administration Console

The WebLogic Administration Console is a web-based interface for managing every aspect of your WebLogic domain.

Open the console

Go to http://<PUBLIC_IP>:7001/console in your web browser and sign in as the weblogic user.

Edit the configuration

The console works in lock-and-edit mode, so multiple administrators cannot make conflicting changes at the same time. To make a change:

  • Select Lock & Edit in the Change Center panel on the left.
  • Make your configuration changes.
  • Select Release Configuration to save and apply them.

Key console sections

  • Domain Structure in the left panel shows the domain tree, including Environment, Deployments, Services, Security Realms and Diagnostics.
  • Environment > Servers lists all configured server instances.
  • Deployments lets you deploy and manage Java EE applications and modules.
  • Services > Data Sources is where you configure JDBC connections to databases.
  • Security Realms manages users, groups, roles and authentication providers.
  • Diagnostics gives you access to log files, images and performance data.

Deploy an application

  • Select Lock & Edit.
  • Open Deployments in the left panel.
  • Select Install and browse to your WAR, EAR or JAR file.
  • Follow the wizard to choose the targeting options and deployment settings.
  • Select Release Configuration to activate the deployment.

Troubleshooting

You cannot connect over SSH

  • Confirm in the EC2 console that the instance has reached 2/2 status checks.
  • Check that your security group allows inbound TCP traffic on port 22 from your IP address.
  • Make sure you use the correct key pair and connect as ec2-user.
  • Check the key file permissions: chmod 400 /path/to/your-key.pem.

The Administration Console is not reachable

  • Check that the WebLogic server is running by reading the start log: tail -f /home/oracle/start-weblogic.log.
  • Look for Server state changed to RUNNING in the log output.
  • Check that your security group allows inbound traffic on port 7001.
  • Use http://, not https://, and the correct port in the URL.

WebLogic fails to start

  • Run the start script as the oracle user, not as root or ec2-user.
  • Source the script with . ./start-weblogic.sh, including the leading dot and space.
  • Read the start log for error messages: cat /home/oracle/start-weblogic.log.
  • Check that /u01 has enough free disk space: df -h /u01.
  • Check that port 7001 is not already in use: netstat -tlnp | grep 7001.

You cannot sign in to the Administration Console

  • Use the username weblogic. It is case sensitive.
  • Read the correct password from /stage/scripts/weblogic-credentials.txt.
  • If you changed the password and forgot it, reset it with WLST from the command line.

The WebLogic server is slow or unresponsive

  • Check that the instance has enough memory. WebLogic requires at least 1 GB but performs better with 4 GB or more.
  • Review the server logs for out-of-memory errors or long garbage collection pauses.
  • Consider increasing the JVM heap size in the WebLogic startup configuration.

Security Recommendations

Change the default password immediately

After your first sign-in, change the WebLogic administrator password in the Administration Console, as described in Step 9. Use a strong password that mixes uppercase and lowercase letters, numbers and special characters.

Restrict access to the Administration Console

Make the Administration Console on port 7001 reachable only from trusted IP addresses. Configure your security group to limit access to specific CIDR ranges. Never expose port 7001 to 0.0.0.0/0.

Use an SSH tunnel for the console

Instead of opening port 7001 directly, reach the console through an SSH tunnel:

ssh -i /path/to/your-key.pem -L 7001:localhost:7001 ec2-user@<PUBLIC_IP>

Then open the console at http://localhost:7001/console in your local browser.

Enable HTTPS for the Administration Console

In production environments, configure WebLogic to use SSL/TLS on the administration port. This encrypts all traffic between your browser and the console.

Secure the credentials file

After you retrieve the password, restrict the permissions on the credentials file:

sudo chmod 600 /stage/scripts/weblogic-credentials.txt

Or remove the file once you have changed the password:

sudo rm /stage/scripts/weblogic-credentials.txt

Apply security updates regularly

Keep the operating system up to date:

sudo yum update -y

Monitor Oracle Critical Patch Updates (CPUs) for WebLogic Server security fixes, and apply them according to Oracle's guidance.

Restrict access to the oracle user

The oracle OS user owns all WebLogic processes and files. Allow only authorised administrators to switch to this user, and review your sudoers configuration to limit access.

Back up your configuration

Back up the WebLogic domain configuration and your deployed applications regularly. Use AWS EBS snapshots of the /u01 volume for complete backups:

# From the command line, you can also export the domain configuration
sudo su - oracle . ./setEnv.sh

Support

If you hit an issue that this guide does not cover, or you need further help, the SecureAnyCloud support team is available 24/7.

Email: sales@secureanycloud.com Phone: (+44) 02045382725 Website: secureanycloud.com Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

When you contact support, include your EC2 instance ID, the AWS region and a description of the issue, along with any relevant log output.

Deploy on AWS

Launch Oracle WebLogic 12c with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com