Apple No More?

I'm a (sort-of) java developer, so one of the most frequent sys-admin tasks I have to do is install Tomcat on Linux. Since there's usually quite a lag between Tomcat releases and packages appearing in yum repos, I generally do this "by hand".

It used to be received wisdom that the way to run Tomcat was "behind" an apache installation, but given improvements in the codebase, the Java VM and the option for it to use the Apache Portable Runtime library, I don't think that's the case any longer. Why run two servers when I really only need one?

This means, of course, that it has to start on port 80, and not the default 8080. Which is a problem on linux, as all ports below 1024 are "privileged" and available only to root. Native programs like apache get round this by starting up as root, grabbing the port, then switching to a n0n-root user for their normal operations. This level of native integration is beyond a JVM. You could run Tomcat as root, but that's generally considered a Bad Thing from a security perspective.

What to do then? Well,if you consult the docs, you will see that the Apache project provides you with a small program called jsvc, to solve just this problem. It's packaged up as a tarball in the Tomcat bin directory. Compiling it is usually very easy.

At this point the documentation becomes a bit more vague. It tells you how you can start Tomcat as root (using jsvc) and have it switch to a non-privileged user. But it doesn't tell you how to installTomcat as a linux service, or how to stop the server process.

Tomcat 5 (we're now at version 7) came with a sample start/stop script for use with the linux service command (so you could execute "service tomcat start" for instance). But it had a couple of problems -- it annoyingly did not show the green/red OK/FAILED message that these scripts usually output, and more seriously it's restart method was flawed (it did not wait for the previous process to terminate before running start, so that two processes attempted to occupy the same port).

I've re-written this script (to work with recent releases of Redhat, CentOS, Fedora and Amazon linuxes -- Debian based systems will vary). If you place it in /etc/init.d then it should allow you to run tomcat on port 80 as a service. Obviously you will need to edit it so that the paths are all applicable to your system. Also I make no guarantees that this'll work for you, or that its even the best way of doing things (I'm sure it's not). But you may find it helpful as a starting point, as there seems to be a dearth of info on the topic.

#!/bin/bash

#

# Tomcat Apache Tomcat webserver

#

# chkconfig: 2345 65 37

# description: Tomcat is a webserver and servlet \

# container. In this case, it's \

# controlled with the jsvc daemon, \

# meaning it can be started as root \

# (to run on port 80) but will then \

# switch to a non-privileged user.

#

# processname: jsvc.exec

# pidfile: /var/run/tomcat.pid

# config: /usr/local/tomcat/conf/server.xml

#

# D I Macdonald 30 Apr 2011

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

RETVAL=0

#various script-specific vars

JSVC=/usr/local/bin/jsvc

PID_FILE=/var/run/tomcat.pid

JAVA_HOME=/usr/java

CATALINA_HOME=/usr/local/tomcat

TOMCAT_USER=tomcat

#set the max heap size here...

MEM_OPTS=-Xmx512m

CATALINA_TMPDIR=/usr/local/tomcat/temp

CATALINA_OUT=$CATALINA_HOME/logs/catalina.out

CATALINA_OUT_BAK=$CATALINA_HOME/logs/catalina.out.old

CATALINA_ERR=$CATALINA_HOME/logs/catalina.err

CATALINA_ERR_BAK=$CATALINA_HOME/logs/catalina.err.old

BOOT_CLASS=org.apache.catalina.startup.Bootstrap

CLASSPATH=$CATALINA_HOME/bin/bootstrap.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/tomcat-juli.jar

start()

{

#must be root!

[ "$EUID" != "0" ] && exit 4

# Check that networking is up.

[ ${NETWORKING} = "no" ] && exit 1

echo -n $"Starting tomcat: "

if [ -e $PID_FILE ]

then

echo "Tomcat is already running (pidfile $PID_FILE exists)."

exit 1

fi

#start the server

$JSVC -jvm server -user $TOMCAT_USER -cp $CLASSPATH -outfile $CATALINA_OUT -errfile $CATALINA_ERR -pidfile $PID_FILE $ME

M_OPTS -Djava.endorsed.dirs=$CATALINA_HOME/common/endorsed -Dcatalina.home="$CATALINA_HOME" -Djava.io.tmpdir="$CATALINA_TMPDIR"

$BOOT_CLASS && success || failure

RETVAL=$?

echo

#return $RETVAL

}

stop() {

[ "$EUID" != "0" ] && exit 4

# Stop the server

echo -n $"Shutting down tomcat: "

$JSVC -cp $CLASSPATH -pidfile $PID_FILE -stop $BOOT_CLASS && success || failure

RETVAL=$?

echo

#return $RETVAL

}

status()

{

if [ -e $PID_FILE ]

then

echo "Tomcat is running."

else

echo "Tomcat is stopped."

fi

}

# See how we were called.

case "$1" in

start)

start

;;

stop)

stop

;;

restart)

stop

start

;;

status)

status

;;

*)

echo "Usage: service tomcat {start|stop|restart|status}"

exit 2

esac

exit $RETVAL