Oracle WebLogic Server 14c on Oracle Linux 9 on Azure User Guide

Overview

This guide covers the deployment and configuration of Oracle WebLogic Server 14c (release 14.1.2.0.0) on Oracle Linux 9 on Microsoft Azure, using cloudimg's pre configured virtual machine image from the Azure Marketplace. WebLogic Server is Oracle's enterprise Java application server for running Jakarta EE and Java EE applications, web services and messaging workloads, with clustering, JDBC connection pooling, JMS and a full security realm.

What's included in this VM image:

• Oracle WebLogic Server 14.1.2.0.0 (generic installation, WebLogic Server and Coherence) at /u01/app/oracle/product/wlserver
• Oracle JDK 21 LTS at /u01/java/jdk-21
• A base_domain created in production mode, with the AdminServer on TCP port 7001
• NodeManager configured for the domain on TCP port 5556
• weblogic.service and nodemanager.service systemd units, enabled at boot
• A one shot weblogic-firstboot.service that generates this VM's own administrator password before either server starts
• Oracle Linux 9 with every available update applied at build time
• Azure Linux Agent (waagent) for Azure provisioning and extensions
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default OS user: azureuser Oracle OS user: oracle (owns the WebLogic installation and the domain)

Security posture

The image ships with no known or shared WebLogic credential:

• The domain was built with a throwaway random password that was never written to disk.
• weblogic.service and nodemanager.service cannot start until first boot has finished, so nothing listens on port 7001 or 5556 before this VM has its own secrets.
• On the first boot of every VM, weblogic-firstboot.service generates a new password for the weblogic administrator, a new NodeManager credential, a new embedded LDAP credential and new random passwords for the two internal system accounts in the security realm, then releases the servers.
• The administrator password is written to /home/oracle/CREDENTIALS.txt, owned by root with mode 0600.
• SSH host keys and /etc/machine-id are regenerated per VM, and the only SSH key that works is the one you supply at deployment.

Licensing

Oracle WebLogic Server is a commercial Oracle product. The cloudimg charge covers packaging, security patching, image maintenance and 24/7 support. You need your own Oracle WebLogic Server licence for any production use of the software. Oracle JDK 21 is distributed under the Oracle No-Fee Terms and Conditions.

Prerequisites

Before deploying this image, make sure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or the Azure CLI
3. An SSH key pair for Linux VM access
4. Network security group rules that allow TCP 22 (SSH) from your administration network, plus TCP 7001 if you will reach the AdminServer directly rather than through an SSH tunnel

Recommended VM size: Standard_D4s_v3 (4 vCPU, 16 GB RAM) or larger for application workloads. Standard_B2s is enough for evaluation.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Sign in to the Azure Portal.
2. Search the Marketplace for Oracle Linux 9 VM with WebLogic Server 14c (published by cloudimg) and click Create.
3. On the Basics tab choose your subscription, resource group, region and VM size, select SSH public key authentication and set the username to azureuser.
4. On the Networking tab allow SSH (22) from your own IP range. Only open 7001 if you need direct access to the AdminServer.
5. Review and create the VM.

Option B: Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

az vm image terms accept --urn cloudimg1647283583153:oracle-weblogic-14c-oel9:default:latest

az vm create \
  --resource-group myResourceGroup \
  --name my-weblogic-14c-vm \
  --image cloudimg1647283583153:oracle-weblogic-14c-oel9:default:latest \
  --size Standard_D4s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

When the VM is running, connect as azureuser:

ssh azureuser@<public-ip>

Confirm the operating system release:

cat /etc/oracle-release

Oracle Linux Server release 9.8

Step 3: Confirm First Boot Has Finished

First boot generates the credentials and then starts the AdminServer and NodeManager. It usually completes within a minute of the VM booting, and the AdminServer is ready around thirty seconds later. Check all three units:

sudo systemctl is-active weblogic-firstboot.service weblogic.service nodemanager.service

active
active
active

weblogic-firstboot.service reports active because it is a one shot unit that has exited successfully. It disables itself once it has run, while the two server units stay enabled for every boot:

sudo systemctl is-enabled weblogic-firstboot.service weblogic.service nodemanager.service

disabled
enabled
enabled

If a unit shows activating, wait a few seconds and run the command again. The first boot log is at /var/log/weblogic-firstboot.log.

Step 4: Retrieve the Administrator Password

The credentials generated for this VM are stored in a root only file:

sudo cat /home/oracle/CREDENTIALS.txt

The file looks like this, with your VM's own address and password:

# Oracle WebLogic Server 14c - per-VM credentials (generated on this VM's first boot)
# Generated: 2026-09-14T14:46:45Z
WEBLOGIC_USER=weblogic
WEBLOGIC_PASSWORD=<your per VM password>
WEBLOGIC_ADMIN_URL=http://<public-ip>:7001
WEBLOGIC_REST_URL=http://<public-ip>:7001/management/weblogic/latest
NODEMANAGER_USER=weblogic
NODEMANAGER_PASSWORD=<your per VM password>
DOMAIN_HOME=/u01/app/oracle/product/user_projects/domains/base_domain

Store the password in your secret manager. The NodeManager credential is set to the same value.

Step 5: Confirm WebLogic Is Listening

The AdminServer listens on port 7001 and NodeManager on port 5556:

sudo ss -tlnp | grep -E ':7001|:5556'

LISTEN 0      300    [::ffff:10.0.0.16]:7001            *:*    users:(("java",pid=12534,fd=669))
LISTEN 0      300    [::ffff:127.0.0.1]:7001            *:*    users:(("java",pid=12534,fd=667))
LISTEN 0      300                 [::1]:7001         [::]:*    users:(("java",pid=12534,fd=668))
LISTEN 0      50                      *:5556            *:*    users:(("java",pid=11436,fd=627))

A quick health check against the AdminServer's welcome page should return 200:

curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:7001/console/welcome/

Management requests without credentials are refused, which you can confirm with an anonymous call to the REST management API (expect 401):

curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:7001/management/weblogic/latest/serverRuntime

Step 6: Open the WebLogic Welcome Page

WebLogic Server 14.1.2.0.0 no longer includes the classic in server Administration Console. The AdminServer serves a welcome page that explains how to administer the domain and links to the WebLogic Remote Console download.

From your workstation, open an SSH tunnel to the VM:

ssh -L 7001:127.0.0.1:7001 azureuser@<public-ip>

Then browse to http://127.0.0.1:7001/console, which redirects to the welcome page:

To administer the domain from a graphical interface, install WebLogic Remote Console on your workstation (the welcome page links to the download), keep the SSH tunnel open, and add a connection to http://127.0.0.1:7001 with the username weblogic and the password from Step 4. Remote Console covers deployments, data sources, JMS, security realms and monitoring.

Step 7: Use the REST Management API

The WebLogic REST management API is enabled and uses the same administrator credentials. This reads the password from the credentials file and queries the AdminServer:

PW=$(sudo sed -n 's/^WEBLOGIC_PASSWORD=//p' /home/oracle/CREDENTIALS.txt)
curl -s -u "weblogic:${PW}" "http://127.0.0.1:7001/management/weblogic/latest/serverRuntime?links=none&fields=name,state,weblogicVersion"

{
    "weblogicVersion": "WebLogic Server 14.1.2.0.0  Tue Nov 26 02:40:45 GMT 2024 2171472",
    "state": "RUNNING",
    "name": "AdminServer"
}

Check the domain itself:

PW=$(sudo sed -n 's/^WEBLOGIC_PASSWORD=//p' /home/oracle/CREDENTIALS.txt)
curl -s -u "weblogic:${PW}" "http://127.0.0.1:7001/management/weblogic/latest/domainConfig?links=none&fields=name,domainVersion,productionModeEnabled"

{
    "productionModeEnabled": true,
    "domainVersion": "14.1.2.0.0",
    "name": "base_domain"
}

Step 8: Script Administration with WLST

The WebLogic Scripting Tool (WLST) runs as the oracle user. This example connects to the running AdminServer over T3 and prints the domain and server state:

PW=$(sudo sed -n 's/^WEBLOGIC_PASSWORD=//p' /home/oracle/CREDENTIALS.txt)
cat > /tmp/wlst-check.py <<'PY'
import os
connect('weblogic', os.environ['WLS_PW'], 't3://127.0.0.1:7001')
print('Connected to domain: ' + cmo.getName())
serverRuntime()
print('AdminServer state: ' + cmo.getState())
disconnect()
PY
sudo -u oracle WLS_PW="$PW" /u01/app/oracle/product/oracle_common/common/bin/wlst.sh /tmp/wlst-check.py 2>&1 | grep -E 'Connected to domain|AdminServer state'
rm -f /tmp/wlst-check.py

Connected to domain: base_domain
AdminServer state: RUNNING

For an interactive session, run sudo -u oracle /u01/app/oracle/product/oracle_common/common/bin/wlst.sh and use connect('weblogic', '<password>', 't3://127.0.0.1:7001'), then edit(), startEdit(), your changes, save() and activate().

Step 9: Change the Administrator Password

To replace the generated password with one of your own, reset it online with WLST and then update boot.properties so the AdminServer can still start unattended. Run the following as azureuser, replacing both placeholders:

sudo -u oracle /u01/app/oracle/product/oracle_common/common/bin/wlst.sh
connect('weblogic', '<current-password>', 't3://127.0.0.1:7001')
cd('/SecurityConfiguration/base_domain/Realms/myrealm/AuthenticationProviders/DefaultAuthenticator')
cmo.resetUserPassword('weblogic', '<new-password>')
disconnect()
exit()

Then write the new password into boot.properties (WebLogic encrypts it on the next start), update your record of the password and restart the AdminServer:

printf 'username=weblogic\npassword=<new-password>\n' | sudo -u oracle tee /u01/app/oracle/product/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties >/dev/null
sudo systemctl restart weblogic.service

The NodeManager credential is a separate setting in the domain security configuration and can be changed the same way through Remote Console or WLST.

Managing the WebLogic Services

Both servers are ordinary systemd services:

sudo systemctl status weblogic.service --no-pager --lines=0

Use sudo systemctl restart weblogic.service, stop or start as needed. The AdminServer takes around thirty seconds to return to RUNNING after a restart. The same verbs apply to nodemanager.service.

Recent server state changes from the AdminServer log:

sudo grep -E 'BEA-000365|BEA-000360' /u01/app/oracle/product/user_projects/domains/base_domain/servers/AdminServer/logs/AdminServer.log | tail -3

Check the installed WebLogic Server and Java versions:

sudo -u oracle /u01/java/jdk-21/bin/java -cp /u01/app/oracle/product/wlserver/server/lib/weblogic.jar weblogic.version | grep 'WebLogic Server'
/u01/java/jdk-21/bin/java -version 2>&1 | grep 'java version'

WebLogic Server 14.1.2.0.0  Tue Nov 26 02:40:45 GMT 2024 2171472
java version "21.0.12.1" 2026-08-18 LTS

Filesystem Layout

Path	Purpose
/u01/java/jdk-21	Oracle JDK 21 LTS
/u01/app/oracle/product	Middleware home (MW_HOME)
/u01/app/oracle/product/wlserver	WebLogic Server installation (WL_HOME)
/u01/app/oracle/product/user_projects/domains/base_domain	Domain home (DOMAIN_HOME)
/u01/app/oraInventory	Oracle inventory
/home/oracle/CREDENTIALS.txt	Per VM credentials (root only)
/etc/systemd/system/weblogic.service	AdminServer unit
/etc/systemd/system/nodemanager.service	NodeManager unit
/etc/systemd/system/weblogic-firstboot.service	First boot credential unit
/var/log/weblogic-firstboot.log	First boot log

The oracle user's ~/.bash_profile exports JAVA_HOME, MW_HOME, WL_HOME and DOMAIN_HOME.

Troubleshooting

The AdminServer does not start. Check the unit and the server log:

sudo journalctl -u weblogic.service -n 20 --no-pager

weblogic.service only starts after first boot has created /var/lib/cloudimg/weblogic-firstboot.done. If that file is missing, read /var/log/weblogic-firstboot.log.

You cannot reach port 7001 from your workstation. Use the SSH tunnel from Step 6, or confirm that your network security group allows your IP on 7001 and that firewalld has the port open with sudo firewall-cmd --list-ports.

Security Recommendations

• Keep port 7001 closed to the internet and reach the AdminServer through an SSH tunnel, a bastion or a private network.
• Replace the generated administrator password with your own and store it in a secret manager.
• Configure the SSL listen port with your own certificate before exposing any application.
• Create separate users and groups in the security realm for operators and deployers instead of sharing the weblogic account.
• Keep Oracle Linux patched with sudo dnf -y update, and apply Oracle's quarterly WebLogic Server patches from My Oracle Support under your Oracle licence.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk or visit www.cloudimg.co.uk/support.

Oracle WebLogic Server documentation is available at docs.oracle.com.

Oracle, Java and WebLogic are registered trademarks of Oracle Corporation and/or its affiliates.