Install Tomcat 7 on CentOS, RHEL, or Fedora
This post will cover installing and basic configuration of Tomcat 7 on CentOS 5.x. or CentOS 6.x
Tomcat 7 implements the JavaServer Pages 2.2 and Servlet 3.0 specifications and a number of new features. The Manager application also has a new look and finer-grain roles and access than 6.x
In this post, we'll install Tomcat 7, the new JDK 7, configure Tomcat as a service, create a start/stop script, and (optionally) configure Tomcat to run under a non-root user.
We will also configure basic access to Tomcat Manager and take a quick look at memory management using JAVA_OPTS
Finally, we will look at running Tomcat on port 80 as well as some strategies for running Tomcat behind Apache.
I have just updated this post with Tomcat 7.0.29, the current stable release of Tomcat 7.
If you are using a different release, simply change the file names below accordingly.
To begin, we'll need to install the Java Development Kit (JDK) 7
JDK 1.6 is the minimum JDK version for Tomcat 7.
Tomcat 7 implements the JavaServer Pages 2.2 and Servlet 3.0 specifications and a number of new features. The Manager application also has a new look and finer-grain roles and access than 6.x
In this post, we'll install Tomcat 7, the new JDK 7, configure Tomcat as a service, create a start/stop script, and (optionally) configure Tomcat to run under a non-root user.
We will also configure basic access to Tomcat Manager and take a quick look at memory management using JAVA_OPTS
Finally, we will look at running Tomcat on port 80 as well as some strategies for running Tomcat behind Apache.
I have just updated this post with Tomcat 7.0.29, the current stable release of Tomcat 7.
If you are using a different release, simply change the file names below accordingly.
To begin, we'll need to install the Java Development Kit (JDK) 7
JDK 1.6 is the minimum JDK version for Tomcat 7.
Step 1: Install JDK 1.7
You can download the latest JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html
We'll install the latest JDK, which is JDK 7, Update 5. The JDK is specific to 32 and 64 bit versions.
My CentOS box is 64 bit, so I'll need: jdk-7u5-linux-x64.tar.gz.
If you are on 32 bit, you'll need: jdk-7u5-linux-i586.tar.gz
Start by creating a new directory /usr/java:
Change to the /usr/java directory we created
Download the appropriate JDK and save it to /usr/java directory we created above.
Unpack jdk-7u5-linux-x64.tar.gz in the /usr/java directory using tar -xzf:
This will create the directory /usr/java/jdk1.7.0_05.
I preferred to create a symbolic link against the JDK directory so that up-gradation of jdk will be easier.
Create symbolic link /usr/java/default against the JDK directory
This (/usr/java/default) will be our JAVA_HOME.
We can now set JAVA_HOME and put Java into the path of our users.
To set it for your current session, you can issue the following from the CLI:
To set the JAVA_HOME permanently, however, we need to add below to the ~/.bash_profile of the user (in this case, root).
We can also add it /etc/profile and then source it to give to all users.
Note: If you decided to use JDK 6 rather than 7 as we did above, simply save the JDK 6 bin file to /opt (or another location), then navigate to /usr/java and issue: 'sh /opt/jdk-6u33-linux-x64.bin'. This will create a JAVA Home of /usr/java/jdk1.6.0.33
Step 2: Download and Unpack Tomcat 7.0.29 (or latest)
We will install Tomcat 7 under /usr/share.
Switch to the /usr/share directory:
and save it to /usr/share
Once downloaded, you should verify the MD5 Checksum for your Tomcat download using the md5sum command.
unpack the file using tar -xzf:
Step 3: Configure Tomcat to Run as a Service.
We will now see how to run Tomcat as a service and create a simple Start/Stop/Restart script, as well as to start Tomcat at boot.
Change to the /etc/init.d directory and create a script called 'tomcat' as shown below.
I have made an alternative script later. I recommend to use that, you will find it in this link
tomcat7-startup-script-etc/initd
As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Tomcat bin directory (/usr/share/apache-tomcat-7.0.29/bin).
You can adjust your script according to your needs and, in subsequent posts, we'll look at additional examples.
CATALINA_HOME is the Tomcat home directory (/usr/share/apache-tomcat-7.0.29)
Now, set the permissions for your script to make it executable:
Start Tomcat:
http://yourdomain.com:8080 or http://yourIPaddress:8080 and we should see the Tomcat home page.
Step 4: Configuring Tomcat Manager Access.
Tomcat 7 contains a number of changes that offer finer-grain roles.
For security reasons, no users or passwords are created for the Tomcat manager roles by default. In a production deployment, it is always best to remove the Manager application.
To set roles, user name(s) and password(s), we need to configure the tomcat-users.xml file located at $CATALINA_HOME/conf/tomcat-users.xml.
In the case of our installation, $CATALINA_HOME is located at /usr/share/apache-tomcat-7.0.29.
By default the Tomcat 7 tomcat-users.xml file will have the elements between the
New roles for Tomcat 7 offer finer-grained access and The following roles are now available:
manager-gui
manager-status
manager-jmx
manager-script
admin-gu
admin-script.
We can set the manager-gui role, for example as below:
We can set the manager-gui role, for example as below:
Caution should be exercised in granting multiple roles so as not to under-mind security.
Step 5 (Oprtional): Manage Memory Usage Using JAVA_OPTS.
Getting the right heap memory settings for your installation will depend on a number of factors.
For simplicity, we will set our inital heap size, Xms, and our maximum heap size, Xmx, to the same value of 128 Mb
Simliarly, there are several approaches you can take as to where and how you set your JAVA_OPTS
Again, for simplicity, we will add our JAVA_OPTS memory parameters in our Catalina.sh file.
So, open the Catalina.sh file located under /usr/share/apache-tomcat-7.0.29/bin with a text editor or vi.
Since we are using 128 Mb for both initial and maximum heap size, add the following line to Catalina.sh
I usually just add this in the second line of the file so it looks as so:
Step 6 (Optional): How to Run Tomcat using Minimally Privileged (non-root) User.
In our Tomcat configuration above, we are running Tomcat as Root.
For security reasons, it is always best to run services with the only those privileges that are necessary.
There are some who make a strong case that this is not required, but it's always best to err on the side of caution.
To run Tomcat as non-root user, we need to do the following:
1. Create the group 'tomcat':
If we want the home directory to be elsewhere, we simply specify so using the -d switch.
3. Change ownership of the tomcat files to the user tomcat we created above:
4. Adjust the start/stop service script we created above. In our new script, we need to su to the user tomcat:
Step 7 (Optional): How to Run Tomcat on Port 80 as Non-Root User.
Note: the following applies when you are running Tomcat in "stand alone" mode with Tomcat running under the minimally privileged user Tomcat we created in the previous step.
To run services below port 1024 as a user other than root, you can add the following to your IP tables:
Be sure to save and restart your IP Tables.
Step 8 (Optional): Running Tomcat behind Apache
As an alternative to running Tomcat on port 80, if you have Apache in front of Tomcat, you can use mod_proxy as well as ajp connector to map your domain to your Tomcat application(s) using an Apache vhost as shown below.
While Tomcat has improved it's 'standalone performance', I still prefer to have Apace in front of it for a number of reasons.
In your Apache config, be sure to set KeepAlive to 'on'. Apache tuning, of course, is a whole subject in itself...
Example 1: VHOST with mod_proxy:
Example 2: VHOST with ajp connector and mod_proxy:
In both vhost examples above, we are "mapping" the domain to Tomcat's ROOT directory.
If we wish to map to an application such as yourdomain.com/myapp, we can add some rewrite as shown below.
This will rewrite all requests for yourdomain.com to yourdomain.com/myapp.
Example 3: VHOST with rewrite:
Comments