DCA Hardened Relational Database for PostgreSQL® (Arm64) — Support & Quick Start

At a glance

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. PostgreSQL 16 runs as a systemd service bound to localhost only (TCP 5432; peer auth on the local socket, scram-sha-256 over TCP). Check status:

   sudo systemctl status postgresql

3. The postgres role's password was generated uniquely for this instance at first boot. Read it (root only):

   sudo cat /root/.pg_default_credentials

4. Smoke-test from the instance, as the postgres OS user (peer auth, no password; a 'could not change directory' notice is harmless) and over TCP with the generated password:

   sudo -u postgres psql -Atc 'SELECT 1'
   PGPASSWORD='YOUR_PASSWORD' psql -h 127.0.0.1 -U postgres -Atc 'SHOW server_version'

5. To reach the server from your application tier, expose it deliberately: listen on all interfaces, allow your application CIDR with SCRAM, restart:

   sudo -u postgres psql -c "ALTER SYSTEM SET listen_addresses = '*';"
   echo 'host all all APPLICATION_CIDR scram-sha-256' | sudo tee -a /var/lib/pgsql/data/pg_hba.conf
   sudo systemctl restart postgresql

   Port 5432 is already permitted in the host firewall. Restrict it in your VCN security list or NSG to the application tier's CIDR; never expose it to the internet.

6. Data lives in /var/lib/pgsql/data (postgresql.conf, pg_hba.conf and postgresql.auto.conf, which holds the ALTER SYSTEM overrides, are in that directory). For anything beyond evaluation, attach a block volume, stop the service, move the directory onto it and mount it at that path before loading data.
7. Rotate the generated password at any time:

   sudo -u postgres psql -c "ALTER ROLE postgres WITH PASSWORD 'your-strong-password';"

The image is CVE-patched at build time. Apply ongoing updates, including PostgreSQL 16 minor releases from the Oracle Linux 9 AppStream, with:

sudo dnf -y update

What the image provides

• PostgreSQL 16 (server, client, and contrib extensions) from the Oracle Linux 9 AppStream
• Data cluster initialized with data checksums for early corruption detection
• SCRAM-SHA-256 password encryption enforced by default
• systemd-managed service, enabled and ready on boot
• Logging collector enabled for operational visibility
• Password authentication only - no default or shared passwords baked into the image
• An instance-unique administrative password is generated on first boot, stored root-readable-only
• PostgreSQL listens on localhost only by default; remote access is a deliberate, documented action
• SSH is key-only (no password login, no baked keys); the image is fully generalized
• SELinux remains enforcing; host firewall default-denies all but SSH and the PostgreSQL port
• Built from the latest Oracle Linux 9 platform image and fully patched at build time

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.