8.1.1 About Updating to Oracle Linux 9 on Exadata Servers

Starting with Oracle Exadata System Software release 26.2.0, the bundled Linux operating system is Oracle Linux 9.

When you update to Oracle Exadata System Software release 26.2.0 or later, Exadata servers are updated to Oracle Linux 9. This update provides an updated security and platform foundation for Oracle Exadata. In particular, it supports FIPS 140-3 and introduces post-quantum cryptography capabilities through updated user-space cryptographic libraries. Java 25 provides an updated Java platform that aligns with Oracle Linux 9 and supports post-quantum cryptography capabilities.

The transition from Oracle Linux 8 to Oracle Linux 9 is a major operating system upgrade. Before updating, review custom software, integrations, and automation for Oracle Linux 9 compatibility. In particular:

• Remove custom Oracle Linux 8 RPM packages unless they are specifically approved for use with Oracle Linux 9 in the applicable Exadata environment. Also review third-party packages and software for Oracle Linux 9 compatibility.

• Review applications and integrations, including SSH and file-transfer automation, that depend on older cryptographic algorithms, certificates, SSH settings, OpenSSL behavior, or SCP behavior. Oracle Linux 9 uses stricter system-wide cryptographic policies, includes changes associated with FIPS 140-3 and newer OpenSSL releases, uses stronger OpenSSH defaults, and uses SFTP semantics for SCP by default. These changes can affect scripts that depend on legacy SSH algorithms or SCP behavior.

  As part of this review, ensure that all Exadata servers and the system that runs the update use SSH RSA keys with a minimum key length of 2048 bits. If this requirement is not met, regenerate and distribute SSH keys that meet the minimum key-length requirement before starting the update. The update cannot start until this requirement is met.

• Review network-management automation. Oracle Linux 9 standardizes on NetworkManager and prefers NetworkManager keyfile connection profiles. Update scripts that depend on legacy network services, ifup or ifdown, direct manipulation of ifcfg-* files, or obsolete utilities such as brctl.

• Update Python 2 scripts and review Python automation for compatibility with the Python versions and packages provided with Oracle Linux 9.

• Review virtualization automation that assumes a specific libvirtd service configuration. Oracle Linux 9 supports a modular libvirt daemon architecture, so service checks and management scripts should not depend unnecessarily on the Oracle Linux 8 daemon layout.

• Review resource-management, container, and monitoring software that depends directly on cgroups v1. Oracle Linux 9 uses cgroups v2 by default.

• Review your LDAP or other SSSD-backed directory implementation for potential conflicts with Oracle Exadata operating system users and groups.

  Starting with Oracle Linux 9, the default Name Service Switch (NSS) order for user and group lookups in /etc/nsswitch.conf places SSSD before local files (sss files rather than files sss). If LDAP or another SSSD-backed directory contains a UID or GID that conflicts with a local Exadata account or group, NSS can resolve the directory identity instead of the local Exadata identity.

  Such conflicts can cause dbmsrv service accounts on Oracle Exadata database servers, including dbmsvc, dbmadmin, and dbmmonitor, to use an unexpected identity or group membership. Resulting ownership or access-control failures can prevent Exadata management services from starting or operating correctly.

  Before configuring LDAP/SSSD on a new system, or upgrading an existing system to release 26.2.0, identify UID and GID conflicts between the directory service and local dbmsrv service users and groups. For details about the local dbmsrv service users and groups, including their corresponding UIDs and GIDs, see Overview of the dbmsrv Service.

  If conflicts exist, either change the conflicting directory entries or migrate the local dbmsrv user and group IDs by using /opt/oracle.SupportTools/migrate_ids.sh. See Changing User IDs and Group IDs for dbmsrv for the supported procedure and additional considerations.

  Do not manually change /etc/nsswitch.conf as a workaround because future updates can overwrite that change. The migrate_ids.sh procedure applies only to dbmsrv service users and groups on database servers, including bare-metal servers, KVM hosts, and guests.

  Identity conflicts on Oracle Exadata storage servers are unlikely because the predefined storage server groups use reserved GIDs below 1000 and the predefined user accounts use UIDs from 1000 through 1010. If an LDAP/SSSD identity conflict is identified on a storage server, contact Oracle Support for assistance.

Exadata Live Update cannot perform the major operating system transition from Oracle Linux 8 to Oracle Linux 9. Use the supported conventional update process and the update tool supplied with the Oracle Exadata System Software release 26.2 payload to update the system to release 26.2. After the system runs release 26.2, you can use Exadata Live Update for eligible subsequent updates.