Apache tomcat

Версии

История версий

Deploy and handle web applications

Tomcat 7 is bundled with 5 already deployed web applications (change localhost with your server’s FQDN if needed):

The CLI way

One can also just copy the WAR file of the application to directory . For that later, be sure that the option is still set for the right host as shown here:

/etc/tomcat8/server.xml

...
<Host name="localhost"  appBase="webapps"
      unpackWARs="true" autoDeploy="true">
...

Hosting files outside the webapps folder

If you want to keep your project outside the webapps folder this is possible by creating a .
Go to and create your context. A context is a simple xml file which specifies where tomcat should look for the project. The basic format of the file is

/etc/tomcat7/Catalina/localhost/whatShouldFollowLocalhost.xml

<Context path="/whatSholdFollwLocalhost" docBase="/where/your/project/is/" reloadable="true"/>

A working example is as follows. This assumes that the project is hosted somewhere in the users /home-folder.

/etc/tomcat7/Catalina/localhost/myProject.xml

<Context path="/myProject" docBase="/home/archie/code/jsp/myProject" reloadable="true"/>

Troubleshooting

Tomcat service is started, but page is not loaded

First check for any syntax error. If everything is fine and is correctly running, type to check the logs for any exception thrown (see ). If you read anything like , this is due to some other service listening on the same port. For instance, it is possible that Apache HTTP Server and Tomcat are listening on the same port (if for example you have Apache running on port 8080 with Nginx serving it as a proxy on port 80). If this is the case, edit the file and change the Connector port to something else under :

/etc/tomcat7/server.xml

<?xml version='1.0' encoding='utf-8'?>
...
...
<Service name="Catalina">
    <Connector executor="tomcatThreadPool"
                 port="8090" protocol="HTTP/1.1"
                 connectionTimeout="20000"
                 redirectPort="8443" />
...
...
</Service>

Finally restart and services.

rm /dev/random 
mknod -m 644 /dev/random c 1 9

Компоненты

Начиная с Tomcat 4.x выпускается с Catalina (контейнер сервлетов), Coyote (HTTP-коннектор) и Jasper (JSP-движок).

Catalina — контейнер сервлетов Tomcat’а, который реализует спецификацию сервлетов Servlet API. Servlet API является основой для всех остальных технологий Java, касающихся Web и дает возможность динамически генерировать любой web-контент, используя любые библиотеки, доступные для Java. Архитектором Catalina являлся Craig McClanahan.

Coyote — компонент стека HTTP Tomcat’а, который поддерживает протокол HTTP 1.1 для веб-серверов или контейнера приложений. Coyote прослушивает входящие соединения на определённом TCP порту сервера, пересылает запросы в механизм Tomcat для обработки запросов и отправляет ответ назад запрашивающему клиенту.

Jasper — механизм JSP Tomcat’а. Tomcat 5.x использует Jasper 2, который является реализацией спецификации JavaServer Pages 2.0 Sun Microsystems. Jasper анализирует JSP-файлы, чтобы компилировать их в Java код, как сервлеты (которые могут быть обработаны с помощью Catalina). Во время выполнения, Jasper может автоматически обнаруживать изменения JSP-файла и перекомпилировать его.
В Jasper 2, были добавлены важные особенности:

Некоторые из свободных ресурсов и объединений Apache Tomcat включают Tomcatexpert.com (а SpringSource спонсорское сообщество разработчиков и операторов, которые работают с Apache Tomcat в крупномасштабных производственных средах) и Apache Tomcat Ресурсный центр MuleSoft (который имеет учебные руководства по установке, обновлению, Настройка, мониторинг, устранение неполадок и крепления различные версии Tomcat).

2015: Описание Apache Tomcat

Продукт исполняет спецификацию сервлетов, спецификацию JavaServer Pages (JSP) и JavaServer Faces (JSF). Написан на языке Java.

Tomcat позволяет запускать веб-приложения, содержит ряд программ для самоконфигурирования.

Скриншот окна страницы сервера Tomcat, 2013

Сервер используется в качестве самостоятельного веб-сервера, в качестве сервера контента в сочетании с веб-сервером Apache HTTP Server, в качестве контейнера сервлетов в серверах приложений JBoss и GlassFish.

Разработку и поддержку Tomcat ведет фонд Apache Software Foundation и добровольцы. Пользователи имеют свободный доступ к исходным кодам и бинарным файлам Tomcat согласно лицензии Apache License 2.0. Номера версий Tomcat начинаются с 3.0.x (предыдущие версии Sun выпустила для внутреннего пользования).

Installation

Install one of , , or .

Using tomcat-native will remove the following warning in :

INFO: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path 

Filesystem hierarchy

Replace the with your installed version (7 or 8).

Installing Tomcat on Linux (Debian)

We’re going to install Tomcat on Ubuntu Linux 16.06, but this procedure should work well on any Debian-based Linux distribution.

Let’s also make sure that we have Java installed and available on the system:

You should get the following output:

3.3. Create a User and a Group

We’re going to run the server under a separate group and user; let’s create a group for it first:

And let’s create a Tomcat user to avoid use the root user:

Let’s also update the permissions of the server – to use them with the new user and group:

Finally, let’s make sure that Tomcat starts automatically with a simple Upstart script:

The tomcat.conf script is used by the operative system to start the Tomcat service at boot time.

This script is used to start and stop the service when needed:

3.4. Start

Go to the opt/tomcat/bin directory and execute the following command:

You should see the following output:

Now its time of test our server.

Open your browser in the URL:

And you should see the following page:

Further setup

Using Tomcat with a different JRE/JDK

Apart from installing the desired JRE/JDK, the only requirement is to set the TOMCAT_JAVA_HOME variable in Tomcat’s service file.

The variable can be overridden by a custom configuration, as described in :

1. create the directory /etc/systemd/system/tomcat7.service.d
2. in that directory, save a start.conf file with this content (for the Oracle JDK package AUR, use instead /usr/lib/jvm/java-8-jdk):

Environment=TOMCAT_JAVA_HOME=/usr/lib/jvm/java-8-openjdk

Alternatively, copy the service file /usr/lib/systemd/system/tomcat7.service, to /etc/systemd/system/ and replace this line:

Environment=TOMCAT_JAVA_HOME=/usr/lib/jvm/java-7-openjdk

by (e.g. for Oracle JDK)

Environment=TOMCAT_JAVA_HOME=/opt/java

Security configuration

• Keep your Tomcat installation up to date to get the latest fixes to security issues
• Remove unwanted default applications such as , , default home page («_» in the webapp). This prevents potential security holes to be exploited. Use the for that.

For more security you could even remove the host-manager and manager web applications. Keep in mind that the later is useful to deploy web applications.

Disable the WAR auto-deploy option. This would prevent someone who gained restricted access to the server to copy a WAR into the /usr/share/java/webapps directory to get it running. Edit server.xml and set the autoDeploy to false:

/etc/tomcat7/server.xml

...
<Host name="localhost"  appBase="webapps"
      unpackWARs="true" autoDeploy="false">
...

Anonymize Tomcat’s default error page to prevent potential attackers to retrieve Tomcat’s version. To see what Tomcat says by default, just visit an nonexistent page such as http://localhost:8080/I_dont_exist. You get a 404 error page with Tomcat’s version at the bottom.

To anonymize this, edit/open the following JAR (Editors like can edit zips directly)

/usr/share/tomcat7/lib/catalina.jar

And edit the following file

org/apache/catalina/util/ServerInfo.properties

...
server.info=
server.number=
server.built=
...

• Disable unused in
• Keep restricted access to . Only user and/or should be able to read and write this.
• Keep usage. Do not use upstream startup scripts unless particular reason as explained in the security note above.
• Use strong different passwords for each user in , give roles to users who really need them and even disable usernames/roles you do not use/need.

One can even crypt passwords using the following upstream script:

/usr/share/tomcat7/bin/digest.sh -a SHA NEW_PASSWORD

This will output something like:

NEW_PASSWORD:b7bbb48a5b7749f1f908eb3c0c021200c72738ce

Paste the hashed part in place of the clear password in and add the following to :

/etc/tomcat7/server.xml

<Host
  ...
  <Realm
    ...
    className="org.apache.catalina.realm.MemoryRealm" digest="SHA"
    ...
  />
  ...
/>

Note that this may not be relevant because only root and/or tomcat is supposed to have read/write access to that file. If an intruder manages to gain root access then he would not need such passwords to mess with your applications/data anyway. Be sure to keep restricted RW access to that file!

Always know what you are deploying

Компоненты

Tomcat версии 4.x был выпущен с Jasper (перепроектированный механизм JSP), Catalina (перепроектированный контейнер сервлетов) и Coyote (стек HTTP).

Catalina for tomcat

Catalina — контейнер сервлетов Tomcat’а, который реализует спецификацию сервлетов Servlet API. Servlet API является основой для всех остальных технологий Java, касающихся Web и дает возможность динамически генерировать любой web-контент, используя любые библиотеки, доступные для java. Архитектором Catalina являлся Craig McClanahan.

Coyote

Coyote — компонент стека HTTP Tomcat’а, который поддерживает протокол HTTP 1.1 для веб-серверов или контейнера приложений. Coyote прослушивает входящие соединения на определённом TCP порту сервера, пересылает запросы в механизм Tomcat для обработки запросов и отправляет ответ назад запрашивающему клиенту.

Jasper

Jasper — механизм JSP Tomcat’а. Tomcat 5.x использует Jasper 2, который является реализацией спецификации JavaServer Pages 2.0 Sun Microsystems. Jasper анализирует JSP-файлы, чтобы компилировать их в Java код, как сервлеты (которые могут быть обработаны с помощью Catalina). Во время выполнения, Jasper может автоматически обнаруживать изменения JSP-файла и перекомпилировать его.

2020: Уязвимость Ghostcat, позволяющая перехватить управление системой

29 февраля 2020 года стало известно о том, что в сервере приложений Apache Tomcat обнаружена серьезная уязвимость, позволяющая перехватить управление уязвимыми системами. Проблема, получившая название Ghostcat, затрагивает все версии Apache Tomcat, выпущенные за последние 13 лет.

По информации компании, уязвимость содержится в протоколе Apache JServ Protocol (AJP) — двоичном протоколе, обеспечивающем передачу входящих запросов с web-сервера до сервера приложений. AJP коннектор по умолчанию включен на всех серверах Tomcat и слушает порт 8009.

По словам специалистов китайской компании Chaitin, Ghostcat (CVE-2020-1938, CNVD-2020-10487) может использоваться для чтения/записи файлов на сервер Tomcat. К примеру, атакующие могут получить доступ к конфигурационным файлам приложения и украсть пароли либо записать файлы на сервер (бэкдоры, web-шеллы и т. д.). Последнее возможно только в том случае, если какое-либо приложение на сервере разрешает загрузку файлов.

Уязвимости подвержены следующие ветки Apache Tomcat:

• Apache Tomcat 9.x < 9.0.31
• Apache Tomcat 8.x < 8.5.51
• Apache Tomcat 7.x < 7.0.100
• Apache Tomcat 6.x

Корректирующие обновления на февраль 2020 года доступны для релизов Tomcat 7.x , Tomcat 8.x , и Tomcat 9.x , за исключением ветки 6.x, поддержка которой была прекращена в 2016 году. Согласно результатам поиска BinaryEdge, на февраль 2020 года в Сети доступно более миллиона Tomcat-серверов. Кроме того, с момента публикации информации о проблеме на GitHub уже появился ряд PoC-кодов для тестирования и осуществления атак Ghostcat .

Tomcat Setup

Introduction

There are several ways to set up Tomcat for running on different
platforms. The main documentation for this is a file called
RUNNING.txt. We encourage you to refer to that
file if the information below does not answer some of your questions.

Windows

Installing Tomcat on Windows can be done easily using the Windows
installer. Its interface and functionality is similar to other wizard
based installers, with only a few items of interest.

• Installation as a service: Tomcat will be
  installed as a Windows service no matter what setting is selected.
  Using the checkbox on the component page sets the service as «auto»
  startup, so that Tomcat is automatically started when Windows
  starts. For optimal security, the service should be run as a
  separate user, with reduced permissions (see the Windows Services
  administration tool and its documentation).
• Java location: The installer will provide a default
  JRE to use to run the service. The installer uses the registry to
  determine the base path of a Java 7 or later JRE,
  including the JRE installed as part of the full JDK. When running on
  a 64-bit operating system, the installer will first look for a
  64-bit JRE and only look for a 32-bit JRE if a 64-bit JRE is not
  found. If a JRE cannot be found when running on a 64-bit operating
  system, the installer will look for a 64-bit JDK. Finally, if a JRE
  or JDK has not been found, the installer will try to use the
  environment variable. It is not mandatory to
  use the default JRE detected by the installer. Any installed Java
  7 or later JRE (32-bit or 64-bit) may be
  used.
• Tray icon: When Tomcat is run as a service, there
  will not be any tray icon present when Tomcat is running. Note that
  when choosing to run Tomcat at the end of installation, the tray
  icon will be used even if Tomcat was installed as a service.
• Defaults: The defaults used by the installer may be
  overridden by use of the command
  line argument. The configuration file uses the format
  with each pair on a separate line. The names
  of the available configuration options are:
  • JavaHome
  • TomcatPortShutdown
  • TomcatPortHttp
  • TomcatMenuEntriesEnable
  • TomcatShortcutAllUsers
  • TomcatServiceDefaultName
  • TomcatServiceName
  • TomcatServiceFileName
  • TomcatServiceManagerFileName
  • TomcatAdminEnable
  • TomcatAdminUsername
  • TomcatAdminPassword
  • TomcatAdminRoles

  By using along with and
  it is possible to perform fully configured
  unattended installs of Apache Tomcat.

• Refer to the
  Windows Service How-To
  for information on how to manage Tomcat as a Windows service.

The installer will create shortcuts allowing starting and configuring
Tomcat. It is important to note that the Tomcat administration web
application can only be used when Tomcat is running.

Unix daemon

Tomcat can be run as a daemon using the jsvc tool from the
commons-daemon project. Source tarballs for jsvc are included with the
Tomcat binaries, and need to be compiled. Building jsvc requires
a C ANSI compiler (such as GCC), GNU Autoconf, and a JDK.

Before running the script, the environment
variable should be set to the base path of the JDK. Alternately, when
calling the script, the path of the JDK may
be specified using the parameter, such as
.

Using the following commands should result in a compiled jsvc binary,
located in the folder. This assumes
that GNU TAR is used, and that is an
environment variable pointing to the base path of the Tomcat
installation.

Please note that you should use the GNU make (gmake) instead of
the native BSD make on FreeBSD systems.

Tomcat can then be run as a daemon using the following commands.

When running on Java 9 you will need to additionally specify the
following when starting jsvc to avoid warnings on shutdown.

You may also need to specify if the JVM defaults
to using a server VM rather than a client VM. This has been observed on
OSX.

jsvc has other useful parameters, such as which
causes it to switch to another user after the daemon initialization is
complete. This allows, for example, running Tomcat as a non privileged
user while still being able to use privileged ports. Note that if you
use this option and start Tomcat as root, you’ll need to disable the
check that
prevents Tomcat starting when running as root.

will return the full jsvc usage
information. In particular, the option is useful
to debug issues running jsvc.

The file can be used as a
template for starting Tomcat automatically at boot time from
with jsvc.

Note that the Commons-Daemon JAR file must be on your runtime classpath
to run Tomcat in this manner. The Commons-Daemon JAR file is in the
Class-Path entry of the bootstrap.jar manifest, but if you get a
ClassNotFoundException or a NoClassDefFoundError for a Commons-Daemon
class, add the Commons-Daemon JAR to the -cp argument when launching
jsvc.

Установка Apache Tomcat 8 (Текст)

Сначала нужно обновить систему.

$ sudo apt-get update

Затем установить Java Development Kit. Иначе код Java не будет выполняться.

$ sudo apt-get install default-jdk

Установка Tomcat версии 8 и других дополнений Tomcat.

$ sudo apt-get install tomcat8

$ sudo apt-get nstall tomcat8-docs tomcat8-examples tomcat8-admin

Запустить Tomcat8.

$ sudo systemctl start tomcat8

На экране появится стандартная страница Tomcat

$ sudo nano /var/lib/tomcat8/conf/tomcat-users.xml

<role rolename="manager-gui"/>

<role rolename="admin-gui"/>

<user username="Придумать имя" password="Придумать пароль" roles="manager-gui,admin-gui"/>

Tomcat Setup

Introduction

There are several ways to set up Tomcat for running on different
platforms. The main documentation for this is a file called
RUNNING.txt. We encourage you to refer to that
file if the information below does not answer some of your questions.

Windows

Installing Tomcat on Windows can be done easily using the Windows
installer. Its interface and functionality is similar to other wizard
based installers, with only a few items of interest.

• Installation as a service: Tomcat will be
  installed as a Windows service no matter what setting is selected.
  Using the checkbox on the component page sets the service as «auto»
  startup, so that Tomcat is automatically started when Windows
  starts. For optimal security, the service should be run as a
  separate user, with reduced permissions (see the Windows Services
  administration tool and its documentation).
• Java location: The installer will provide a default
  JRE to use to run the service. The installer uses the registry to
  determine the base path of a Java 8 or later JRE,
  including the JRE installed as part of the full JDK. When running on
  a 64-bit operating system, the installer will first look for a
  64-bit JRE and only look for a 32-bit JRE if a 64-bit JRE is not
  found. If a JRE cannot be found when running on a 64-bit operating
  system, the installer will look for a 64-bit JDK. Finally, if a JRE
  or JDK has not been found, the installer will try to use the
  environment variable. It is not mandatory to
  use the default JRE detected by the installer. Any installed Java
  8 or later JRE (32-bit or 64-bit) may be
  used.
• Tray icon: When Tomcat is run as a service, there
  will not be any tray icon present when Tomcat is running. Note that
  when choosing to run Tomcat at the end of installation, the tray
  icon will be used even if Tomcat was installed as a service.
• Defaults: The defaults used by the installer may be
  overridden by use of the command
  line argument. The configuration file uses the format
  with each pair on a separate line. The names
  of the available configuration options are:
  • JavaHome
  • TomcatPortShutdown
  • TomcatPortHttp
  • TomcatMenuEntriesEnable
  • TomcatShortcutAllUsers
  • TomcatServiceDefaultName
  • TomcatServiceName
  • TomcatServiceFileName
  • TomcatServiceManagerFileName
  • TomcatAdminEnable
  • TomcatAdminUsername
  • TomcatAdminPassword
  • TomcatAdminRoles

  By using along with and
  it is possible to perform fully configured
  unattended installs of Apache Tomcat.

• Refer to the
  Windows Service How-To
  for information on how to manage Tomcat as a Windows service.

The installer will create shortcuts allowing starting and configuring
Tomcat. It is important to note that the Tomcat administration web
application can only be used when Tomcat is running.

Unix daemon

Tomcat can be run as a daemon using the jsvc tool from the
commons-daemon project. Source tarballs for jsvc are included with the
Tomcat binaries, and need to be compiled. Building jsvc requires
a C ANSI compiler (such as GCC), GNU Autoconf, and a JDK.

Before running the script, the environment
variable should be set to the base path of the JDK. Alternately, when
calling the script, the path of the JDK may
be specified using the parameter, such as
.

Using the following commands should result in a compiled jsvc binary,
located in the folder. This assumes
that GNU TAR is used, and that is an
environment variable pointing to the base path of the Tomcat
installation.

Please note that you should use the GNU make (gmake) instead of
the native BSD make on FreeBSD systems.

Tomcat can then be run as a daemon using the following commands.

When running on Java 9 you will need to additionally specify the
following when starting jsvc to avoid warnings on shutdown.

You may also need to specify if the JVM defaults
to using a server VM rather than a client VM. This has been observed on
OSX.

jsvc has other useful parameters, such as which
causes it to switch to another user after the daemon initialization is
complete. This allows, for example, running Tomcat as a non privileged
user while still being able to use privileged ports. Note that if you
use this option and start Tomcat as root, you’ll need to disable the
check that
prevents Tomcat starting when running as root.

will return the full jsvc usage
information. In particular, the option is useful
to debug issues running jsvc.

The file can be used as a
template for starting Tomcat automatically at boot time from
with jsvc.

Note that the Commons-Daemon JAR file must be on your runtime classpath
to run Tomcat in this manner. The Commons-Daemon JAR file is in the
Class-Path entry of the bootstrap.jar manifest, but if you get a
ClassNotFoundException or a NoClassDefFoundError for a Commons-Daemon
class, add the Commons-Daemon JAR to the -cp argument when launching
jsvc.

Преимущества Apache Tomcat

• Tomcat – это быстрый и простой способ запуска ваших приложений в Ubuntu. Он обеспечивает быструю загрузку и помогает запустить сервер более эффективно
• Tomcat содержит набор всеобъемлющих встроенных настроек, которые обеспечивают гибкость его использования
• Tomcat – бесплатное приложение с открытым исходным кодом. Кастомизируйте его под свой проект непосредственно через код
• Tomcat предлагает своим пользователям дополнительный уровень безопасности
• Благодаря его стабильности, даже когда вы сталкиваетесь с проблемами в Tomcat, он не останавливает работу остальной части сервера