Oracle Database Client 19c on AWS User Guide

Overview

This image is Oracle Database Client 19c (19.3.0.0.0, Administrator client) on Windows Server 2019 Datacenter, one software version of the cloudimg Hardened AMIs for Oracle Database SE2 on Windows Server listing on AWS Marketplace. Every version in the listing is described at /guides/oracle-database-standard-edition-2-windows-aws/.

Use it as a Windows workstation or jump host for Oracle databases you already run: on Amazon RDS for Oracle, on EC2, on premises over a VPN, or one of the database versions of this listing.

Bring your own Oracle licence. This image holds no database and includes no Oracle licence. Oracle does not charge for the client software itself; you need a licence for every Oracle Database you connect to. The listing offers instance types of up to 8 vCPUs. The Windows Server licence is included in the EC2 charge.

What cloudimg does to the image:

• The full Administrator client, ready on the PATH. SQLPlus, SQLLoader, tnsping, Data Pump (expdp, impdp), the original exp and imp, the RMAN client, and the OCI, ODBC, ODP.NET and JDBC libraries, installed from Oracle's base release media into C:\app\oracle\product\19.0.0\client_1.
• No database, no listener, no Oracle password. The image holds the client software only. No Oracle service runs, no Oracle process listens on any port, and there is no Oracle account or credential in the image.
• Oracle programs cannot reach the instance metadata service. An outbound Windows Firewall rule blocks every program in the Oracle home (the client tools, the bundled Java, the external procedure agents) from 169.254.169.254, so nothing Oracle runs can read the instance's AWS credentials.
• Base release, no Oracle patches. The client is the 19.3.0.0.0 base release with no Release Update applied. Apply Release Updates with your own Oracle support entitlement (see Patching).
• Microsoft Security Baseline for Windows Server 2019 (Member Server), applied with Microsoft's LGPO tool and measured with HardeningKitty on a fresh instance against a 98% threshold, with 8 rules waived for EC2 (listed below). The report ships in C:\ProgramData\cloudimg\baseline\. This is a measurement made with open-source tooling against Microsoft's published baseline, not a certification by Microsoft or any other body.
• Fully patched Windows at build time. The build fails if any update is still pending or a reboot is owed.
• A unique Administrator password on every instance (Sysprep through EC2Launch v2; retrieve it with your key pair). Remote Desktop requires Network Level Authentication, SMBv1 is off, and the Windows Firewall allows inbound Remote Desktop (3389) only.
• IMDSv2 only, and no build residue: build tools, installers, the Oracle installer logs, the build's temporary installer account, history and event logs are removed and free space is wiped before capture.

Connecting to your instance

Connect with Remote Desktop as the Administrator:

Launch from AWS Marketplace

1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose Oracle Database Client 19c on Windows Server 2019 as the software version, your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended size; the listing offers instance types of up to 8 vCPUs.
4. Choose a key pair. You need its private key to get the Administrator password.
5. Choose the VPC and subnet from which the instance can reach your database's listener port (1521 by default).
6. Use a security group that allows RDP (TCP 3389) from your own address only. The client needs no inbound port; it only makes outbound connections to your databases.
7. Launch. The root volume is 75 GiB; you can choose a larger volume at launch.

There is no first-boot setup: the instance is ready as soon as Windows has finished starting and the Administrator password is available, usually within five minutes.

Get the Administrator password

In the EC2 console select the instance, choose Actions, Security, Get Windows password, upload the private key of your key pair and choose Decrypt password. Or with the AWS CLI on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password yet; try again a minute later.

Connect over Remote Desktop

Connect to the instance's public DNS name or IP address on port 3389 with a Remote Desktop client that supports Network Level Authentication (Microsoft Remote Desktop on Windows and macOS, FreeRDP on Linux), as Administrator with the password from the previous step. Each instance generates its own Remote Desktop certificate, so your client asks you to trust it on first connection.

Check the client

Open PowerShell in the Remote Desktop session. The client's bin folder is on the machine PATH, so the tools run from any new Command Prompt or PowerShell window:

Get-Command sqlplus, sqlldr, tnsping, expdp, impdp, exp, imp, rman | Select-Object Name, Source
sqlplus -V

sqlplus -V prints Version 19.3.0.0.0. The Oracle home is registered with Windows:

Get-ChildItem HKLM:\SOFTWARE\ORACLE | Where-Object { $_.PSChildName -like 'KEY_*' } |
  ForEach-Object { Get-ItemProperty $_.PSPath } | Select-Object ORACLE_HOME_NAME, ORACLE_HOME

Connect to a database

Check first that the instance can reach the database's listener (replace the host and port with your own):

Test-NetConnection your-db-host -Port 1521

TcpTestSucceeded : True means the network path is open. If it is False, allow this instance (or its security group) inbound on the database side, and check the route between the two networks.

Connect with Easy Connect, which needs no configuration file. SQL*Plus asks for the password, so it never appears on the command line or in your PowerShell history:

sqlplus your_user@//your-db-host:1521/your_service

To use short names instead, add an entry to tnsnames.ora in C:\app\oracle\product\19.0.0\client_1\network\admin (the file ships with a commented example):

Add-Content C:\app\oracle\product\19.0.0\client_1\network\admin\tnsnames.ora `
  'MYDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = your-db-host)(PORT = 1521)) (CONNECT_DATA = (SERVICE_NAME = your_service)))'
tnsping MYDB
sqlplus your_user@MYDB

For Amazon RDS for Oracle, the host is the DB instance's endpoint and the service is its database name (for example ORCL). For the database versions of this listing, which keep their listener on 127.0.0.1, follow that version's guide to reach it through Session Manager port forwarding or to open the listener to your network first.

Load and move data

*SQLLoader loads a text file into a table, driven by a control file you write:

sqlldr your_user@//your-db-host:1521/your_service control=C:\data\load.ctl log=C:\data\load.log

Data Pump (expdp, impdp) runs the export or import on the database server: the dump file is written to a directory object on the server (for example DATA_PUMP_DIR), not to this instance:

expdp your_user@//your-db-host:1521/your_service schemas=YOUR_SCHEMA directory=DATA_PUMP_DIR dumpfile=your_schema.dmp logfile=your_schema_exp.log

The original exp and imp tools write their dump file on this instance, and the RMAN client connects to a target database to run its backups.

Libraries for your applications

The libraries applications use to reach Oracle are in the Oracle home:

$oh = 'C:\app\oracle\product\19.0.0\client_1'
'bin\oci.dll', 'bin\sqora32.dll', 'ODP.NET\managed\common\Oracle.ManagedDataAccess.dll', 'jdbc\lib\ojdbc8.jar' |
  ForEach-Object { '{0,-55} {1}' -f $_, (Test-Path (Join-Path $oh $_)) }

No Oracle service

A client home runs no Oracle service and opens no port. If the installer registered a service (the Oracle MTS Recovery Service, used only with Microsoft Transaction Server and COM+, is the one the client can register), cloudimg sets it to Disabled:

Get-CimInstance Win32_Service | Where-Object { $_.Name -like 'Oracle*' } | Select-Object Name, State, StartMode

If you use Microsoft Transaction Server with Oracle, set that service to Automatic and start it yourself.

Metadata service block

Every program in the Oracle home has an outbound Windows Firewall rule that blocks the instance metadata service (169.254.169.254) and 168.63.129.16. EC2Launch, the SSM agent and your own tools keep their access:

$rules = @(Get-NetFirewallRule -Group 'cloudimg metadata block')
"{0} outbound rules block the instance metadata service for programs in the Oracle home" -f $rules.Count
$rules | Select-Object -First 5 DisplayName, Direction, Action, Enabled

If you add programs to the Oracle home later (for example when you apply a Release Update), add the same rule for them.

View the baseline report

Everything the build measured ships in C:\ProgramData\cloudimg\baseline\:

Get-Content C:\ProgramData\cloudimg\baseline\baseline-summary.json | ConvertFrom-Json |
  Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

HardeningKitty ships no Microsoft finding list for Windows Server 2019. The list used here, finding_list_cloudimg_msft_ws2019_member_machine.csv, is generated from the rules file Microsoft publishes inside the Windows Server 2019 baseline (MSFT-WS2019-MemberServer-FINAL.PolicyRules), so each rule is scored against Microsoft's own value for Windows Server 2019.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image. Run it in an elevated PowerShell; it only reads settings and takes a minute or two:

$hk = 'C:\ProgramData\cloudimg\tools\HardeningKitty-0.9.4'
Import-Module "$hk\HardeningKitty.psm1" -Force
$list = "$hk\lists\finding_list_cloudimg_msft_ws2019_member_machine.csv"
$csv = Join-Path $env:TEMP 'hardeningkitty-now.csv'
Remove-Item $csv -ErrorAction SilentlyContinue
$null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1
$waived = (Get-Content -Raw C:\ProgramData\cloudimg\baseline\waivers.json | ConvertFrom-Json).waivers.id
$scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID })
$pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count
"{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count)
$scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules are set differently on purpose. Each one is in waivers.txt with its reason:

Windows Firewall

Every firewall profile is on with inbound traffic blocked unless a rule allows it. The only inbound rules enabled are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP):

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
  Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Outbound connections (to your databases) are allowed.

Patching

Windows is fully patched when the image is built. Check for newer updates with:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
$searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

and install them from Settings, Windows Update (or sconfig option 6).

Oracle Database Client is the 19.3.0.0.0 base release. Oracle's Release Updates are available only to customers with Oracle support, so cloudimg does not apply them. Apply the current 19c Release Update with your own My Oracle Support entitlement, following the Release Update's readme (OPatch from the Oracle home). Close every program that uses the client first. Check the version with sqlplus -V.

Licensing

This image includes no Oracle licence. Oracle does not charge for the Oracle Database Client itself, which is used under Oracle's license terms; every Oracle Database you connect to must be licensed by you (for a database version of this listing, Oracle Database Standard Edition 2 licences, on instances of up to 8 vCPUs). The Windows Server licence is included in the EC2 charge.

Support

cloudimg provides 24/7 technical support for this image by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk. Licensing questions go to Oracle.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Microsoft and Windows Server are trademarks of the Microsoft group of companies. cloudimg is not affiliated with or endorsed by Oracle or Microsoft.