Oracle Linux 9 with GNOME Desktop on AWS User Guide

Overview

This image is Oracle Linux 9 with the GNOME desktop. It is one software version of the cloudimg Hardened Debian & Linux Desktops AMIs listing on AWS Marketplace. Every desktop in the listing is described at /guides/linux-desktop-aws/.

It is the cloudimg Oracle Linux 9 image (built from Oracle's own AWS image template) with Oracle Linux's Server with GUI environment added: GNOME 40 with the GDM login screen, running on the X.Org server, from Oracle's public yum server. It boots the Unbreakable Enterprise Kernel (UEK Release 8), as Oracle's own cloud images do. You reach the desktop with any VNC viewer through TigerVNC, the VNC server Oracle ships in its AppStream repository. Each user gets their own full GNOME session on the instance.

VNC ships switched off, and the image holds no password of any kind. No account password, no VNC password and no TLS key are baked in. You set your own two passwords over SSH, then turn VNC on with one command. VNC then listens on localhost only, so you always connect through an SSH tunnel and port 5901 is never open to the internet.

What cloudimg does to the image:

• The GNOME desktop from Oracle's public yum server only. The image includes GDM, GNOME Shell, Files, Terminal, Firefox, Text Editor, System Monitor and Settings, installed in one transaction with weak dependencies off. Every enabled repository is an Oracle Linux 9 repository on yum.oracle.com. There is no third-party repository, no EPEL and no paid channel. Things no EC2 instance can use are left out: Wi-Fi firmware, the Hyper-V and VMware guest agents, and the Red Hat Compatible Kernel with the VDO kernel module built for it.
• No registration needed. The image receives its updates from Oracle's public repositories with no account and no ULN registration (see ULN Registration).
• Printing is not included. The CUPS print server and its filters are left out and excluded from dnf (see Printing).
• TigerVNC, off and locked down. A system-wide policy file forces every VNC desktop to listen on localhost only and to offer only security types that need the VNC password. A user's own TigerVNC settings cannot override it. The cloudimg-vnc helper refuses to start a desktop for an account that has no password or no VNC password.
• Remediated with the OpenSCAP PCI-DSS v4.0 Control Baseline profile. The build applies the SCAP Security Guide 0.1.82 profile pci-dss (Oracle's own signed scap-security-guide package and its ssg-ol9-ds.xml content) with oscap --remediate after the desktop is installed. That way its GNOME rules (screen lock, idle delay, no automount or autorun, no automatic login) and its Avahi rule apply to this desktop. The build then reboots and runs a scored evaluation, and it fails if fewer than 95% of the scored rules pass. On this image 233 of the 238 scored rules pass (97.9%), with 7 rules waived: 6 that do not fit a key-only EC2 instance, and sshd_disable_tcp_forwarding, because its AllowTcpForwarding no would block the SSH tunnel that is the only way to reach the desktop (see Waived rules). The waived rules are not counted as passing. The report ships in the image at /usr/share/doc/cloudimg/pci-dss-report.html. This is a configuration baseline measured by open-source tooling, not a PCI DSS attestation: PCI DSS compliance is assessed for your whole cardholder data environment, not for an operating system image.
• Fully patched at build time, with automatic updates left on (dnf-automatic, see Patching).
• Key-only SSH as ec2-user. Password login over SSH is off and stays off after you set a desktop password. Root login is refused and the root account is locked. SSH allows local port forwarding only, which is what the VNC tunnel uses.
• Platform hardening. The image runs the firewalld host firewall (inbound SSH only) with SELinux enforcing, and keeps a persistent system journal on disk. It also runs chrony on the Amazon Time Sync Service and the AWS Systems Manager agent.

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Operating system variant	SSH login user
Oracle Linux 9 with GNOME Desktop	ec2-user

Launch from AWS Marketplace

1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose Launch from EC2 Console (or One-click launch). In Version, choose Oracle Linux 9 with GNOME Desktop - YYYY-MM-DD HH:MM, then choose your Region.
4. Instance type: m5.large (2 vCPU, 8 GiB) is recommended. The login screen plus one GNOME session fits in less, but a browser and a few applications need the room. There is no GPU requirement: the desktop renders in software.
5. Key pair: choose your EC2 key pair. It is the only way in.
6. Security group: allow inbound TCP 22 from your own IP address only. That is the only port this image needs: VNC travels inside SSH.
7. Storage: the root volume is 16 GiB gp3 by default. Choose a larger size if you will install applications. cloud-init grows the root filesystem to fill it on first boot.
8. Choose Launch.

Step 1: Connect over SSH and check the desktop

ssh -i ~/.ssh/my-key.pem ec2-user@<public-ip>

ec2-user has passwordless sudo, and no account has a password. Check the release and kernel, that the instance booted to the graphical target with the GNOME login screen (GDM) running on X.Org, and the installed desktop and VNC packages:

cat /etc/oracle-release
uname -r
systemctl get-default
systemctl is-active gdm
grep '^WaylandEnable' /etc/gdm/custom.conf
rpm -q --qf '%{NAME} %{VERSION}\n' gdm gnome-shell mutter xorg-x11-server-Xorg tigervnc-server

Oracle Linux Server release 9.8
6.12.0-208.112.5.el9uek.x86_64
graphical.target
active
WaylandEnable=False
gdm 40.1
gnome-shell 40.10
mutter 40.9
xorg-x11-server-Xorg 1.20.11
tigervnc-server 1.15.0

Package and kernel versions move forward as Oracle publishes updates. RHEL 9 family TigerVNC desktops are X11 sessions, which is why GDM runs with Wayland disabled. el9uek in the kernel release is the Unbreakable Enterprise Kernel; the Red Hat Compatible Kernel is not installed.

An EC2 instance has no display device that Oracle Linux 9 can drive, so the GDM login screen on the instance's own console runs on the X.Org dummy video driver. Before GDM starts, /usr/local/libexec/cloudimg-xorg-headless writes /etc/X11/xorg.conf.d/90-cloudimg-headless-dummy.conf when there is no display device, and removes it when there is one (for example on a GPU instance with its driver installed). Your VNC desktops do not use that file.

Step 2: Check that VNC is off

A new instance has VNC switched off. The helper shows the whole picture in one command:

sudo cloudimg-vnc status
grep -vE '^#|^$' /etc/tigervnc/vncserver-config-mandatory
sudo ss -tlnH | awk '{print $4}' | sort

VNC policy: localhost only, security types tlsvnc,vncauth (/etc/tigervnc/vncserver-config-mandatory)
xvnc.socket (unauthenticated mode): disabled / inactive
VNC desktops configured: none
listening on VNC ports 5900-5999: none
users with a VNC password set: none (each user runs: vncpasswd)
localhost
securitytypes=tlsvnc,vncauth
0.0.0.0:22
[::]:22

The policy file forces two settings on every user, and TigerVNC reads it after each user's own configuration, so a user's settings cannot undo it:

• localhost makes the VNC server listen on 127.0.0.1 and ::1 only.
• securitytypes=tlsvnc,vncauth offers only security types that require the VNC password. None (no password) is never offered.

SSH on port 22 is the only listener. The unauthenticated inetd mode xvnc.socket is disabled.

The helper lives at /usr/local/sbin/cloudimg-vnc. On Oracle Linux, sudo replaces your PATH with its own secure_path, which does not include /usr/local/sbin, so the image also ships /usr/sbin/cloudimg-vnc as a symlink and sudo cloudimg-vnc works as written. Its subcommands are status, enable [<user>], disable [<user>] and details. <user> defaults to ec2-user.

Step 3: Set your two passwords

Neither password exists until you create it, and both belong to you.

First your account password. The VNC session logs you straight into GNOME, but the desktop asks for this password when the screen locks and when an application needs administrator rights. Run this and enter the new password twice:

sudo passwd ec2-user

The PCI-DSS profile sets the password rules: at least 12 characters, including at least one digit and one lower-case letter, and 10 wrong attempts lock the account for 30 minutes. passwd explains what it rejects.

Then your VNC password, which your VNC viewer asks for. Run vncpasswd as yourself, without sudo, enter the password twice, and answer n to the view-only question:

vncpasswd

Password:
Verify:
Would you like to enter a view-only password (y/n)? n
A view-only password is not used

VNC's own password scheme uses only the first 8 characters of the password, which is why the image never exposes VNC to the network. vncpasswd stores it in ~/.config/tigervnc/passwd with mode 0600. SSH stays key only: neither password enables password login over SSH.

Step 4: Start your VNC desktop

sudo cloudimg-vnc enable

VNC desktop for ec2-user enabled on display :1: listening on localhost port 5901 only
from your own machine: ssh -N -L 5901:localhost:5901 ec2-user@<instance-ip>
then point a VNC viewer at localhost:5901 and enter ec2-user's VNC password

The helper adds :1=ec2-user to /etc/tigervnc/vncserver.users, runs systemctl enable --now vncserver@:1.service, waits until port 5901 is listening, and stops the desktop again if the port is bound anywhere other than localhost. The desktop starts again after a reboot.

If a password is missing, it refuses and tells you which one:

refusing to start a VNC desktop for ec2-user: the account has no password yet.
The GNOME lock screen and administrator prompts inside the desktop ask for it. Set it first:
  sudo passwd ec2-user

refusing to start a VNC desktop for ec2-user: no VNC password is set.
As ec2-user (without sudo) run:  vncpasswd

Step 5: Connect through an SSH tunnel

On your own workstation, open the tunnel and leave it running:

ssh -i ~/.ssh/my-key.pem -N -L 5901:localhost:5901 ec2-user@<public-ip>

Then point your VNC viewer at localhost:5901 (TigerVNC and RealVNC accept localhost:5901; some viewers want the display form localhost:1; on macOS open Screen Sharing and connect to vnc://localhost:5901). Enter your VNC password, and your GNOME desktop opens.

TigerVNC Viewer marks the password dialog "This connection is not secure". It says that because TigerVNC's TLSVnc security type uses anonymous TLS, so there is no certificate for the viewer to verify. Through the SSH tunnel the connection is encrypted and the server is authenticated by your SSH host key check, which is why the image allows VNC over the tunnel only.

Connecting to the instance's public address on port 5901 does not work, by design: the server listens on localhost only, firewalld admits SSH only, and the security group needs only port 22.

An idle SSH tunnel can be closed by a NAT device or firewall between you and AWS. If your viewer disconnects after a quiet spell, add -o ServerAliveInterval=60 to the ssh command.

Step 6: Use the desktop

Your viewer shows the GNOME desktop at 1920x1080. The Activities button in the top-left corner (or the Super key) opens the overview with the dash and the search field:

The grid button at the end of the dash (or Super+A) lists the installed applications:

A terminal inside the desktop runs on display :1, and the VNC server is bound to the loopback addresses only:

To add software, use dnf in a terminal as on any Oracle Linux machine, for example sudo dnf install -y libreoffice, then open the application from the grid.

Closing your VNC viewer leaves the session running on the instance. Connect again and you return to it.

ULN Registration

Oracle's Server with GUI environment includes ULN Registration (the rhn-setup-gnome package), and it appears in the application grid. It registers a machine with the Unbreakable Linux Network, Oracle's channel for customers who hold a paid Oracle Linux Support subscription. You do not need it: this image already receives its updates from Oracle's public yum repositories, with no registration and no account. The image is not registered with ULN.

dnf -q repolist enabled

repo id                repo name
ol9_UEKR8              Oracle Linux 9 UEK Release 8 (x86_64)
ol9_appstream          Oracle Linux 9 Application Stream Packages (x86_64)
ol9_baseos_latest      Oracle Linux 9 BaseOS Latest (x86_64)

If you do hold an Oracle Linux Support subscription and want ULN, the registration tool is there to use. The image never enables a ULN channel on its own.

Desktops for more users

Each user gets their own display and port. Create the user with a password, have them set their VNC password, then enable their desktop. The helper assigns the next free display (:2 is port 5902):

sudo useradd -m alice
sudo passwd alice
sudo -u alice -H vncpasswd
sudo cloudimg-vnc enable alice

Alice then tunnels her own port, for example ssh -N -L 5902:localhost:5902 alice@<public-ip>, once her SSH public key is in ~alice/.ssh/authorized_keys.

Turn VNC off again

sudo cloudimg-vnc disable

VNC desktop for ec2-user disabled: display :1 removed, nothing listening on port 5901

This stops the session, disables vncserver@:1.service and removes the mapping, so nothing listens after a reboot. sudo cloudimg-vnc status shows the state at any time.

Security posture

Confirm that SSH is key only and forwards local ports only, root is locked, no account has a password until you set one, the host firewall admits SSH only, SELinux is enforcing and the instance never suspends:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication|allowtcpforwarding) '
sudo passwd -S root | awk '{print $1, $2}'
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo firewall-cmd --list-services
getenforce
busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
allowtcpforwarding local
root LK
accounts with a password: 0
dhcpv6-client ssh
Enforcing
s "na"

allowtcpforwarding local is what lets the SSH tunnel of Step 5 reach the desktop: local forwards (ssh -L) work, while remote forwards (ssh -R) are refused, and X11 forwarding, gateway ports and tunnel devices stay off. After Step 3, the password count reads 1 (your own account). root LK means the root account is locked, and na means logind will not suspend the instance, so the desktop menu offers Power Off and Log Out but never Suspend (a suspended instance stops answering while EC2 still reports it running).

Each instance also gets its own identity at first boot: SSH host keys, /etc/machine-id, the NVMe host identity (/etc/nvme/hostnqn, /etc/nvme/hostid) and the BrlAPI key of the braille display library (/etc/brlapi.key, readable by root and the brlapi group only) are generated on the instance, so no two instances share them.

The system journal is persistent: journald keeps it in /var/log/journal on the root filesystem, so the logs of earlier boots survive a restart (journalctl --list-boots).

Known issue: TigerVNC and CVE-2025-49177

CVE-2025-49177 is not fixed in the TigerVNC package on Oracle Linux 9. The Red Hat Security Data API lists tigervnc on Red Hat Enterprise Linux 9 as "Will not fix", severity Important, CVSS 3.1 score 6.1 with a local attack vector (AV:L). Oracle's CVE page for it lists an erratum for Oracle Linux 10 only, so there is no Oracle Linux 9 TigerVNC update to install. It is a flaw in the X server's XFIXES extension: the XFixesSetClientDisconnectMode handler does not validate the request length, so a connected X client can read memory left over from earlier requests.

What that means on this image: Xvnc accepts X clients only through its local socket and the desktop user's own X authority cookie, with no X11 TCP port, and VNC is off until you enable it. If your security policy does not accept an unfixed vendor CVE, do not enable VNC on this image. If Oracle publishes a fixed package, dnf-automatic applies it automatically.

View the compliance report

The evaluation the build ran ships in /usr/share/doc/cloudimg/ in three forms:

• pci-dss-report.html, the HTML report
• pci-dss-arf.xml, the machine-readable ARF results
• pci-dss-summary.json, with the counts, pass rate, threshold, SSG version and checksums

The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/cloudimg/pci-dss-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/pci-dss-summary.json'))['failingRules']]"

PCI-DSS v4.0 Control Baseline 0.1.82 - 233 of 238 scored rules pass (97.9%) - waived 7
accounts_password_last_change_is_in_past
aide_build_database
ensure_pam_wheel_group_empty
selinux_confinement_of_daemons
set_firewalld_default_zone

The five rules that do not pass on this image:

• Last password change date. The locked root account carries no "last changed" date in /etc/shadow, and the rule wants a date in the past for every account. Root has no password either way.
• AIDE database. The image ships an AIDE database built from its own files as the last build step (/var/lib/aide/aide.db.gz) and runs aide --check daily, but the rule's file check does not find a database at the path it expects. To rebuild the database for your own instance after you install software, run sudo aide --init and move /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz.
• The su group. The profile restricts su to members of a group named sugroup (pam_wheel.so group=sugroup in /etc/pam.d/su), and that group does not exist, so nobody can use su. The rule also wants the group to exist and be empty. To clear the finding without changing who can use su, run sudo groupadd sugroup.
• Unconfined daemons. The AWS Systems Manager agent (amazon-ssm-agent and its ssm-agent-worker) runs as the SELinux type unconfined_service_t, because Amazon's package ships no SELinux policy for it.
• Default firewalld zone. The benchmark wants DefaultZone=drop in /etc/firewalld/firewalld.conf. The image keeps public as the default zone, bound to eth0 and allowing only SSH and the DHCPv6 client inbound, so incoming traffic is filtered the same way while new interfaces still get a working zone. If you want the stricter default, run sudo firewall-cmd --set-default-zone=drop and keep eth0 in public.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ec2-user@<public-ip>:/usr/share/doc/cloudimg/pci-dss-report.html .

You can re-run the same evaluation on your instance at any time. It takes a few minutes and changes nothing. oscap exits with status 2 when any rule fails, and the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/doc/cloudimg/pci-dss-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_pci-dss_ec2_single \
  --report ~/pci-dss-rescan.html /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml

Use the ssg-ol9-ds.xml content shown above: the scap-security-guide package also ships the RHEL 9 data stream, but that content only applies to Red Hat Enterprise Linux, so on Oracle Linux it reports almost every rule as not applicable.

Waived rules

These rules of the profile are deselected through the tailoring file and are not scored. The reasons are in /usr/share/doc/cloudimg/pci-dss-waivers.txt. Everything else the profile selects is remediated and scored.

grep -v '^#' /usr/share/doc/cloudimg/pci-dss-waivers.txt | cut -f1,2

sudo_require_authentication [default-user-sudo]
ensure_root_password_configured [serial-console-and-boot]
accounts_maximum_age_login_defs [key-only-account-aging]
account_disable_post_pw_expiration  [key-only-account-aging]
sshd_limit_user_access  [ssh-access-list]
auditd_data_retention_admin_space_left_action   [audit-sizing-8gb]
sshd_disable_tcp_forwarding [vnc-ssh-tunnel]

Rule	Why it is waived
sudo_require_authentication	ec2-user is key only with no password, and cloud-init gives it password-free sudo. Demanding a password for sudo would leave the only administrator unable to use it.
ensure_root_password_configured	A root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
accounts_maximum_age_login_defs, account_disable_post_pw_expiration	Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
sshd_limit_user_access	An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user data. SSH is key only, root login is refused, and your security group restricts the source addresses.
auditd_data_retention_admin_space_left_action	On a single root volume the audit log shares the filesystem with the operating system, and halting the instance when the disk fills would take it down. auditd keeps its rotate and suspend defaults.
sshd_disable_tcp_forwarding	The rule sets AllowTcpForwarding no, which would refuse the SSH tunnel that is the only way to reach the desktop. VNC listens on localhost only and you reach it through an SSH local forward (ssh -L), so the image sets AllowTcpForwarding local instead: local forwards work and remote forwards (ssh -R) are refused. X11 forwarding, gateway ports and tunnel devices stay off.

Networking and services that ship switched off

NetworkManager manages the EC2 network interface, and cloud-init writes its connection profile at first boot:

nmcli -t -f DEVICE,TYPE,STATE device

eth0:ethernet:connected
lo:loopback:connected (externally)

The Server with GUI group brings several network services that this image leaves switched off:

for u in cockpit.socket avahi-daemon.service cups.service bluetooth.service ModemManager.service rpcbind.socket xvnc.socket; do
  echo "$u: $(systemctl is-enabled "$u" 2>/dev/null || true)"
done

cockpit.socket: disabled
avahi-daemon.service: masked
cups.service: 
bluetooth.service: disabled
ModemManager.service: disabled
rpcbind.socket: 
xvnc.socket: disabled

masked on Avahi comes from the PCI-DSS profile. An empty value means the unit is not installed: this image has no CUPS print server and no rpcbind. Cockpit, Bluetooth and ModemManager are installed but disabled. To use the Cockpit web console, run sudo systemctl enable --now cockpit.socket and reach it through an SSH tunnel as well (ssh -N -L 9090:localhost:9090 ec2-user@<instance-public-ip>, then open https://localhost:9090), because the host firewall admits SSH only. Do not enable xvnc.socket: it serves a login screen over VNC on port 5900 with no VNC password.

Printing

This image does not include printing. The CUPS print server (cups) and its filters (cups-filters, cups-filters-libs) are not installed, and /etc/dnf/dnf.conf excludes them so that no update or dependency brings them back. The CUPS client library (cups-libs) stays, because GTK and GNOME Settings link against it.

rpm -q cups cups-filters cups-libs | sed 's/-[0-9].*//'
grep '^exclude=' /etc/dnf/dnf.conf

package cups is not installed
package cups-filters is not installed
cups-libs
exclude=kernel-uek-headers cups cups-filters cups-filters-libs cups-browsed libcupsfilters libppd

If you need printing, edit the exclude= line in /etc/dnf/dnf.conf back to Oracle's own exclude=kernel-uek-headers (keep that entry), then run sudo dnf install -y cups cups-filters and sudo systemctl enable --now cups.

Patching

Oracle publishes its security errata (ELSA advisories) as advisory data in its public repositories, so dnf can tell you which pending updates fix security issues. dnf-automatic applies updates automatically each day. Check what is pending now:

sudo dnf -q check-update --refresh >/dev/null; echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
sudo dnf -q updateinfo list --security | wc -l
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf-automatic.timer

dnf check-update exit code: 100 (0 = nothing to update, 100 = updates available)
0
upgrade_type = security
apply_updates = yes
enabled

upgrade_type = security means dnf-automatic installs only the updates that Oracle publishes as security errata, once a day. To stop automatic updates, run sudo systemctl disable --now dnf-automatic.timer.

An instance launched later lists the updates released since, with exit code 100. To install everything now, run sudo dnf -y upgrade, then sudo systemctl reboot if a new kernel was installed. Automatic updates never restart the instance for you; dnf needs-restarting -r tells you whether a restart is owed.

Support lifecycle

Oracle Linux 9 is not an end-of-life product. It reached general availability in July 2022. Oracle's Premier Support for it runs until June 2032 and Extended Support until June 2035. Check Oracle's Lifetime Support Policy for the dates that apply to your deployment.

Troubleshooting

"Connection refused" on localhost:5901

VNC is switched off on a new instance by design. Run sudo cloudimg-vnc enable first, and check that the SSH tunnel is still running in its own terminal window. sudo cloudimg-vnc status shows whether anything is listening on 5901.

The viewer says "Authentication failure"

The viewer wants your VNC password (set with vncpasswd), not your account password. Only its first 8 characters count. To set a new one, run vncpasswd again as yourself, then sudo cloudimg-vnc disable and sudo cloudimg-vnc enable.

Connecting to the instance's public IP on port 5901 does not work

That is by design. The VNC server listens on localhost only, whatever a user's own TigerVNC settings say. Use the SSH tunnel in Step 5.

The screen is locked and asks for a password

The screen locks after 15 minutes of inactivity (PCI-DSS profile). Unlock it with your account password (the one from sudo passwd). After repeated failed attempts the account is locked for a while; to unlock it early, run sudo faillock --user ec2-user --reset over SSH.

The desktop does not start for a user

sudo cloudimg-vnc enable <user> says what is missing. For anything else, read journalctl -u vncserver@:1 and the session log in ~<user>/.local/state/tigervnc/.

Cannot connect via SSH

1. Check that port 22 is allowed in the security group from your address.
2. Use the user ec2-user and the key pair you chose at launch. Password login over SSH is disabled by design.

A service is blocked and the logs mention SELinux

SELinux is enforcing. Read the denial with sudo ausearch -m avc -ts recent before you change anything. Fix the label or the boolean it names rather than turning SELinux off.

Emergency access

No account has a password until you set one. EC2 Serial Console and single-user recovery need a local password, and the one you set in Step 3 works for the serial console. If SSH is unavailable, Session Manager is the other way in.

Support

cloudimg provides 24/7 technical support for this image by email and live chat: support@cloudimg.co.uk.

Oracle Linux is free and open source, and Oracle permits its redistribution: the binaries, updates and errata are available at no cost, and an Oracle Linux Support subscription is optional. It is assembled from thousands of independently packaged components, each under its own licence (see rpm -qi <package>). No subscription, registration or licence key is required. This image is not Oracle Database and carries no Oracle Database licensing.

Oracle and Oracle Linux are trademarks of Oracle and/or its affiliates. GNOME is a trademark of the GNOME Foundation. TigerVNC is a trademark of its respective owner. PCI DSS is a trademark of the PCI Security Standards Council. The names are used only to identify the software this image contains. cloudimg is not affiliated with or endorsed by Oracle, the GNOME Foundation, the TigerVNC project or the PCI Security Standards Council.