Oracle Linux 8 Minimal on AWS User Guide

Overview

This guide covers launching and verifying the Oracle Linux 8 Minimal AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Oracle Linux listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every release and variant in the listing is described at /guides/oracle-linux-aws/.

Oracle Linux 8 is a free enterprise Linux distribution from Oracle, binary compatible with Red Hat Enterprise Linux 8. This image is built from Oracle Linux 8.10, imported from Oracle's own Oracle Linux 8 cloud image, and adds four things:

• A trimmed package set. Packages a cloud server does not need are removed (the GeoLite2 location databases on this build). Each removal is simulated first and refused if it would take a package the instance needs to boot, network or be reached; on Oracle Linux that keeps linux-firmware, because the Unbreakable Enterprise Kernel package depends on it. The list of what was removed and what was kept ships on the image.
• PCI-DSS v4.0 Control Baseline remediation. The image is remediated with the OpenSCAP PCI-DSS v4.0 Control Baseline profile from SCAP Security Guide 0.1.82 (Oracle's own signed scap-security-guide package and its ssg-ol8 content), then rebooted and evaluated. On this build 228 of 234 scored rules pass (97.4%). Six rules are waived because they cannot work on an EC2 image, each with its reason. The HTML report, the machine-readable results, the waiver list and a summary ship in /usr/share/doc/cloudimg/. This is a configuration baseline, not a PCI DSS attestation: PCI DSS compliance is assessed for your whole cardholder data environment, not for an operating system image.
• EC2 defaults that keep you in control. Key-only SSH as ec2-user, root locked, no password on any account, SELinux enforcing, IMDSv2 required, a host firewall (firewalld) that allows SSH in and everything out, the AWS Systems Manager agent, and time from the Amazon Time Sync Service.
• Fully patched at build time, with dnf-automatic applying security updates on your instance.

What is on the image: Oracle Linux 8.10 with the Unbreakable Enterprise Kernel (UEK) Release 7 (kernel 5.15), cloud-init, OpenSSH, firewalld, chrony, SELinux (targeted policy, enforcing), the AWS Systems Manager agent, auditd, rsyslog, AIDE file integrity checking, dnf-automatic, OpenSCAP and the pinned SCAP Security Guide content used for the evaluation. Postfix is installed for local mail only, disabled and bound to loopback; its TLS key is generated on each instance at first boot.

Default user: ec2-user · Architecture: x86_64 · Root volume: 10 GiB gp3, XFS (grows to the size you choose at launch) · Boot mode: legacy BIOS

Connecting to your instance

Version	SSH user	Root device
Oracle Linux 8 Minimal	ec2-user	/dev/sda1 (10 GiB gp3)

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for ec2-user on first boot.
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, keyboard-interactive off. The root account has no password and is locked.
• Per-instance identity. SSH host keys, the machine ID and the Postfix TLS key are generated fresh on every instance, so no two instances share a key.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• SELinux enforcing with the targeted policy, as Oracle Linux ships it.
• Host firewall. firewalld's public zone allows only SSH and the DHCPv6 client inbound and allows all outbound traffic, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. Nothing else on the image listens on any address.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Oracle Linux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose Oracle Linux 8 Minimal - YYYY-MM-DD (the date is when the version was added) and your Region.
4. Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
5. Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
6. Security group: allow inbound TCP 22 from your own IP address or network only.
7. Storage: the root volume is 10 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.
8. Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-linux-8-minimal}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Step 3: Confirm the release and kernel

cat /etc/oracle-release
grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release
uname -srm
rpm -q kernel-uek

Expected output:

Oracle Linux Server release 8.10
NAME="Oracle Linux Server"
VERSION="8.10"
ID="ol"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Oracle Linux Server 8.10"
Linux 5.15.0-325.221.6.4.el8uek.x86_64 x86_64
kernel-uek-5.15.0-325.221.6.4.el8uek.x86_64

The image boots the Unbreakable Enterprise Kernel (UEK Release 7, kernel 5.15), the kernel Oracle uses in its own cloud images. The Red Hat Compatible Kernel is not installed. Oracle Linux 8.10 is the final minor release of Oracle Linux 8; this version keeps receiving Oracle Linux 8 errata and new UEK builds through normal dnf updates. Your kernel version may be newer if updates have installed since this image was built.

Step 4: See what the Minimal trim removed

The image lists exactly what was removed, and anything that a removal would have taken with it is kept and listed instead:

cat /usr/share/doc/cloudimg/minimal-manifest.txt
rpm -qa | wc -l

Expected output:

Minimal version: packages 356 -> 354
Removed:
  geolite2-city
  geolite2-country
Kept (a removal would have taken a protected package, or it failed):
  linux-firmware would-remove-protected: kernel-uek
368

The base image is already small, so most of the candidate list (wireless and sound firmware, Cockpit, Plymouth, sos, tuned) was never installed. linux-firmware is kept on purpose: the kernel-uek package requires it, and removing it would remove the kernel package with it. After the trim, the PCI-DSS remediation adds the tools it needs (OpenSCAP, AIDE, the audit dispatcher plugins, Postfix and their libraries), so a new instance has 368 packages. The count on your instance moves by a few as kernels and updates install.

Anything removed is one sudo dnf install away from the standard Oracle Linux repositories.

Step 5: Read the compliance evidence

The evaluation the build ran after its reboot ships on the image. Oracle Linux 8 has no python3 command by default, so these commands use the system's own platform-python:

ls -lh /usr/share/doc/cloudimg/
/usr/libexec/platform-python -c "import json; s=json.load(open('/usr/share/doc/cloudimg/pci-dss-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 33M
-rw-r--r--. 1 root root  202 Oct 20 20:39 minimal-manifest.txt
-rw-r--r--. 1 root root  30M Oct 20 20:53 pci-dss-arf.xml
-rw-r--r--. 1 root root 2.6M Oct 20 20:53 pci-dss-report.html
-rw-r--r--. 1 root root 1.4K Oct 20 20:53 pci-dss-summary.json
-rw-r--r--. 1 root root 1.7K Oct 20 20:53 pci-dss-tailoring.xml
-rw-r--r--. 1 root root 2.3K Oct 20 20:53 pci-dss-waivers.txt
-rw-r--r--. 1 root root 1.6K Oct 20 20:39 scap-security-guide-LICENSE.txt
profile:       PCI-DSS v4.0 Control Baseline (SCAP Security Guide 0.1.82)
scored rules:  234  pass: 228  fail: 6  rate: 97.4%
waived:        6  not applicable: 14
evaluated at:  2026-10-20T20:53:12Z

• pci-dss-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• pci-dss-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• pci-dss-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not checked, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/cloudimg/pci-dss-report.html .

The six waived rules

grep -v '^#' /usr/share/doc/cloudimg/pci-dss-waivers.txt | cut -f1,2

Expected output:

sudo_require_authentication [default-user-sudo]
ensure_root_password_configured [serial-console-and-boot]
accounts_maximum_age_login_defs [key-only-account-aging]
account_disable_post_pw_expiration  [key-only-account-aging]
sshd_limit_user_access  [ssh-access-list]
auditd_data_retention_admin_space_left_action   [audit-sizing-8gb]

The full reason for each is the third column of the same file. In short:

• Password for sudo: ec2-user is key-only with no password, and cloud-init gives it password-free sudo. Demanding a password for sudo would leave the only administrator unable to use it.
• Root password: a root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own password if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Audit log retention action: on a small single root volume the audit log shares the filesystem with the operating system, and halting the instance when the disk fills would take it down. auditd keeps its rotate and suspend defaults.

The six rules that do not pass

/usr/libexec/platform-python -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/pci-dss-summary.json'))['failingRules']]"

Expected output:

accounts_password_last_change_is_in_past
ensure_pam_wheel_group_empty
package_cron_installed
selinux_confinement_of_daemons
set_firewalld_default_zone
sshd_use_approved_macs

• Last password change date. The locked root account carries no "last changed" date in /etc/shadow, and the rule wants a date in the past for every account. Root has no password either way.
• The su group. The profile restricts su to members of a group named sugroup (pam_wheel.so group=sugroup in /etc/pam.d/su), and that group does not exist, so nobody can use su. The rule also wants the group to exist and be empty. To clear the finding without changing who can use su, run sudo groupadd sugroup.
• Cron package. cron is installed and running: Oracle Linux 8 ships it as the cronie package (rpm -q cronie, systemctl is-enabled crond). The SCAP Security Guide 0.1.82 check for Oracle Linux 8 looks for a package literally named cron, which Oracle Linux 8 does not have, so it reports a failure that no package can clear.
• Unconfined daemons. The AWS Systems Manager agent runs as the SELinux type unconfined_service_t, because Amazon's package ships no SELinux policy for it. Every other daemon is confined.
• Default firewalld zone. The benchmark wants DefaultZone=drop in /etc/firewalld/firewalld.conf. The image keeps public as the default zone, bound to eth0 and allowing only SSH and the DHCPv6 client inbound, so incoming traffic is filtered the same way while new interfaces still get a working zone. If you want the stricter default, run sudo firewall-cmd --set-default-zone=drop and keep eth0 in public.
• SSH MAC list. The rule looks for an explicit MACs line in /etc/ssh/sshd_config, and there is none. On Oracle Linux 8 the SSH server takes its ciphers and MACs from the system-wide crypto policy (Step 11), which the service passes on the command line and which overrides sshd_config; the policy's MACs are SHA-2 and SHA-1 HMACs and UMAC-128.

Step 6: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about two minutes:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/pci-dss-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_pci-dss_ec2_single \
  --results /tmp/pci-check-results.xml --report /tmp/pci-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml > /tmp/pci-check.log 2>&1
echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo /usr/libexec/platform-python -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/pci-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass)
{'fail': 6, 'notapplicable': 14, 'notchecked': 2, 'notselected': 939, 'pass': 228}
pass rate: 97.4%

Your own report is at /tmp/pci-check-report.html. The content file is ssg-ol8-ds.xml, the Oracle Linux 8 data stream; the RHEL 8 data stream that the same package carries reports every rule as not applicable on Oracle Linux. As you install software and change settings, re-run this to see how your changes affect the result.

Step 7: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 8: The host firewall and listening ports

sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo firewall-cmd --get-active-zones
sudo ss -tlnp

Expected output:

running
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
public
  interfaces: eth0
trusted
  interfaces: lo
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                       
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=975,fd=3))
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=975,fd=4))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port; Postfix is disabled.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The default cockpit service is removed from the zone; Cockpit is not installed.
• The loopback interface sits in firewalld's trusted zone.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive.

Step 9: Time sync and the Systems Manager agent

systemctl is-active chronyd amazon-ssm-agent
chronyc -n sources
rpm -q amazon-ssm-agent

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 216.66.48.42                  1   8   377    40  +2486us[+2491us] +/- 9799us
^- 199.85.8.46                   2   8   377    37    -11us[  -11us] +/- 9931us
^- 198.38.16.1                   3   8   377    39   +414us[ +419us] +/- 7613us
^- 45.83.234.123                 2   7   277   493  +2652us[+2647us] +/-   43ms
^* 169.254.169.123               3   4   377     5  +4075ns[+4780ns] +/-  520us
amazon-ssm-agent-3.3.5390.0-1.x86_64

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package (3.3.5390.0 on this build). It is not in the Oracle Linux repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

Step 10: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh
echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf-automatic.timer
uname -r
dnf repolist

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available)
upgrade_type = security
apply_updates = yes
enabled
5.15.0-325.221.6.4.el8uek.x86_64
repo id           repo name
ol8_UEKR7         Latest Unbreakable Enterprise Kernel Release 7 for Oracle Linux 8 (x86_64)
ol8_appstream     Oracle Linux 8 Application Stream (x86_64)
ol8_baseos_latest Oracle Linux 8 BaseOS Latest (x86_64)

The instance uses Oracle's public yum server (yum.oracle.com): BaseOS, AppStream and UEK Release 7. No subscription is needed. dnf-automatic runs daily and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 11: Security settings on the instance

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval) '

Expected output:

Enforcing
root LK 1969-12-31 0 99999 7 -1 (Password locked.)
maxauthtries 4
clientaliveinterval 900
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK means the root account is locked. The 1969-12-31 date is how passwd shows an empty "last changed" field (see Step 5).
• maxauthtries 4 and clientaliveinterval 900 come from the PCI-DSS profile: SSH allows four authentication attempts per connection and checks idle sessions every 15 minutes.

SSH ciphers and MACs come from the crypto policy. On Oracle Linux 8 the sshd service is started with the algorithms of the system-wide crypto policy on its command line, and those take precedence over sshd_config. To see what the server really offers:

update-crypto-policies --show
grep -o -e '-oCiphers=[^ ]*' -e '-oMACs=[^ ]*' /etc/crypto-policies/back-ends/opensshserver.config

Expected output:

DEFAULT
-oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc
-oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512

The PCI-DSS remediation also writes a Ciphers line into /etc/ssh/sshd_config from the profile's default list (it names older CBC and 3DES ciphers). That line has no effect while the crypto policy is applied: a client that asks for 3des-cbc is refused with "no matching cipher found". To change the algorithms, change the crypto policy (man update-crypto-policies; for example the NO-SHA1 sub-policy module is available), not sshd_config.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd ec2-user

Step 12: Disk size, swap, file integrity and mail

df -hT /
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1
swapon --noheadings --show | wc -l
sudo grep -h aide /etc/crontab
systemctl is-enabled postfix cloudimg-postfix-tls

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/nvme0n1p1 xfs    10G  4.0G  6.0G  41% /
NAME        SIZE TYPE FSTYPE MOUNTPOINT
nvme0n1      10G disk        
└─nvme0n1p1  10G part xfs    /
2026-10-20 21:23:18,927 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 1)
0
05 4 * * * root /usr/sbin/aide --check
disabled
enabled

• Disk layout. The root filesystem is XFS on partition 1, the only partition of the root volume; the instance boots in legacy BIOS mode. About 600 MiB of the space used is the dnf metadata cache, which dnf refreshes shortly after first boot; sudo dnf clean all frees it.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 1 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files as the last build step, and the profile schedules aide --check daily at 04:05 from /etc/crontab. After you install software, rebuild it with sudo aide --init and move /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz.
• Postfix. Postfix is installed so local daemons can hand mail to root, but it is disabled and, if you enable it, listens on loopback only. cloudimg-postfix-tls.service generates this instance's own Postfix TLS key and certificate at first boot, so no two instances share one.

Step 13: Install software and add users

The instance uses the standard Oracle Linux 8 repositories:

sudo dnf -q list --available nginx

Expected output (the versions change over time):

Available Packages
nginx.x86_64      1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e      ol8_appstream

Newer nginx releases are offered as Application Stream modules (dnf module list nginx). Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice; the password quality rules of the PCI-DSS profile apply when a user changes their own password: at least 12 characters with at least one digit and one lower-case letter (/etc/security/pwquality.conf). SSH stays key-only; the password is used by sudo. (Password-free sudo is granted only to ec2-user, created by cloud-init.)

Common use cases

• A base for workloads in a PCI DSS scope that need a documented configuration baseline on an enterprise Linux 8, with the evaluation report already on the machine
• Software certified or packaged for Oracle Linux 8 or RHEL 8 compatible systems, on the Unbreakable Enterprise Kernel with SELinux enforcing from the first boot
• Existing Oracle Linux 8 estates that want the same release on EC2, with a long support horizon
• Fleets managed through Systems Manager, with IMDSv2 required from the first boot
• A starting point for your own golden image: add your software, re-run Step 6, and keep the report with your build

Troubleshooting

SSH says "Too many authentication failures"

The SSH server allows four authentication attempts per connection. If your SSH agent holds several keys, it can use them up before it offers the right one. Tell SSH to offer only the key you name:

ssh -o IdentitiesOnly=yes -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name ec2-user (not opc, the user of Oracle's OCI images) and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. If you changed firewalld, make sure the ssh service is still allowed. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

My service is running but not reachable

Allow the port in both the security group and firewalld (Step 8). sudo firewall-cmd --list-all shows the firewalld rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback. If the service runs on a non-standard port, SELinux may also need to allow it: install the SELinux management tools with sudo dnf -y install policycoreutils-python-utils, then, for example, sudo semanage port -a -t http_port_t -p tcp 8080 for a web server on 8080.

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 7), or use the AWS CLI or a current SDK.

A script says "python3: command not found"

Oracle Linux 8 does not install a python3 command by default; system tools use /usr/libexec/platform-python. For your own scripts, install Python from the AppStream repository, for example sudo dnf -y install python3.12.

Package manager issues

Refresh the metadata first:

sudo dnf -q makecache --refresh && echo "repository metadata refreshed"

If the repositories are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts yum.oracle.com

Important notes

Oracle Linux is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); rpm -qi <package> shows each package's licence. No subscription or licence key is needed to run this image or to receive updates from Oracle's public yum server. Oracle Linux Support is a separate, optional subscription from Oracle; this image does not include it, and Ksplice and the OCI agent are not on the image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

Oracle Linux 8.10 is the last minor release of Oracle Linux 8, and this version keeps receiving its errata as ordinary updates for as long as Oracle supports Oracle Linux 8. Plan moves to a newer major release (the listing also carries Oracle Linux 9 and 10) on your own schedule.

The PCI-DSS v4.0 Control Baseline profile used here is the OpenSCAP profile published in SCAP Security Guide. The image is remediated with that profile; this is not a PCI DSS attestation, and the image is not certified by the PCI Security Standards Council or by any assessor. A pass rate measures this image as built; your own changes affect it, which is why the evaluation can be re-run (Step 6).

Oracle and Oracle Linux are registered trademarks of Oracle and/or its affiliates. Red Hat Enterprise Linux is a trademark of Red Hat, Inc. PCI DSS is a trademark of the PCI Security Standards Council. These names are used only to identify the software, its compatibility and the profile. cloudimg is not affiliated with or endorsed by Oracle, Red Hat or the PCI Security Standards Council.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• Oracle Linux on AWS hub: www.cloudimg.co.uk/guides/oracle-linux-aws