Installing Oracle Database Security Central on Azure

Follow these steps to upload Oracle Database Security Central to Azure.

Install the Azure command line interface (CLI).

See How to install the Azure CLI from Microsoft for more information.
Using the CLI, create an Azure storage account.

See Create an Azure storage account from Microsoft for more information.
Using the CLI, create a container in your Azure storage account.

See Create a container from Microsoft for more information.

Using the CLI, upload the Oracle Database Security Central image to Azure using az storage blob upload:

az storage blob upload --account-name *`<storage-account created in step two>`* --container-name *`<container name>`* --file *`<name of the image in the VCS>`* --name *`<name-in-azure>`*

For example,

az storage blob upload --account-name avdfstorageacct --container-name avdf-files --type page --file dbsec-central-azure_fw.vhd.gz --name dbfw.vhd

See Upload a blob from Microsoft for more information.

In the Azure portal, create an image from the VHD.

When creating the image, ensure to specify the following:
- OS type: Linux
- VM generation: Gen 1 (BIOS) Gen 2 (UEFI)
- Storage blob: Specify the storage blob where the vhd was uploaded in the previous step.
- Account type: Standard HDD
- Host caching: Read/write
- Key management: Platform managed-key
See Create Azure Local VM image using image in Azure Storage account from Microsoft for more information.
In the Azure portal, create a VM image based on the image you created in the previous step.

When creating the VM image, ensure to specify the following:
- Security type: Standard
- Image: Use the image created in the previous step
- VM architecture: x64
- Size: Standard D4s v3 -4 cpu, 16GB memory (at minimum)
- Authentication account:
  - Authentication Type : SSH public key
  - Username : opc
  - SSH public key source : Generate new pair
- Inbound port rules:
  - Public inbound ports : Allow selected ports
  - Select inbound ports : SSH(22), HTTP (443), HTTP(7443)
See Create a Linux Virtual Machine in the Azure Portal from Microsoft for more information.
Perform the steps in Post Instance Creation Steps
- Audit Vault Server:
  1. Log in to the appliance through SSH and switch to the root user.
  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using Azure instance console connection.
```
sudo passwd root
```
  3. Generate a one time passphrase by running the command:
```
sudo -u oracle /usr/local/dbfw/bin/generate_post_install_passphrase.py
```
  4. Copy the passphrase that is returned by the above command.
  5. Access the Audit Vault Server console by entering https://<IP address of the instance> as the URL in the browser.
  6. Enter the passphrase copied from the earlier step in the Post Install Authentication page of the Audit Vault Server console.
  7. Fill in the details in the Post Install Configuration page.
  8. In the AVS IP for Agent Communication section, specify the public IP of the Audit Vault Server if you are expecting to collect audit data from any target outside of Azure. See section Deploying Audit Vault Agents for more details.
    
    Note: After the post installation step is complete, changing the AVS IP for Agent communication is not supported.
  9. Select Save.
    
    DNS is automatically set to 169.254.169.254.
    
    See Also:
    
    DNS in Your Virtual Cloud Network
- Database Firewall:
  1. Log in to the appliance through SSH and switch to the root user.
  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using Azure instance console connection.
```
sudo passwd root
```
SSH into the instance:
1. Copy the downloaded Azure_SSH.pem file to ~/.ssh/ folder
```
cp Azure_SSH.pem  ~/.ssh/
```
2. Run the following command:
```
ssh -i  "~/.ssh/Azure_SSH.pem" opc@*`<ip address>`*
```