Tuesday, February 1, 2011

Install Tomcat 7 on CentOS / RHEL

PLEASE NOTE: This post covers installation of Tomcat 7 along with JDK 6. For installation of Tomcat 7 with JDK 6 or JDK 7, please see my updated and expanded post here:

This post will cover installing and basic configuration of Tomcat 7 on CentOS 5.x.

The procedure can be used for Fedora and RHEL as well.

Tomcat 7 implements the JavaServer Pages 2.2 and Servlet 3.0 specifications and a number of new features. The Manager application also has a new look with finer-grain roles and access than 6.x

In this post, we'll install the required JDK, Tomcat, configure Tomcat as a service, create a start/stop/restart script, and (optionally) configure Tomcat to run under a non-root user.

For this installation, we'll use Tomcat 7.0.19, the current stable release of Tomcat 7. This post began with the first Tomcat 7 release and I have tried to keep it updated to keep things as "copy and paste" as possible.

I've also updated the post for JDK 6, Update 26.

To begin, we'll need to install the Java Development Kit (JDK) 1.6

JDK 1.6 is the minimum JDK version for Tomcat 7.

If you do have the JDK installed, you can skip to: Step 2: Download and Unpack Tomcat 7.0.19:

Step 1: Install JDK 1.6

You can download the JDK here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

We'll install the latest JDK, which is JDK 6 Update 26. The JDK is specific to 32 and 64 bit versions.

My CentOS box is 64 bit, so I'll need: jdk-6u26-linux-x64.bin

If you are on 32 bit, you'll need: jdk-6u26-linux-i586.bin

Download the appropriate JDK and save it to a directory. I'm saving it to /root.

Move (mv) or copy (cp) the file to the /opt directory:

[root@srv6 ~]# mv jdk-6u26-linux-x64.bin /opt/jdk-6u26-linux-x64.bin  

Create a new directory /usr/java.

[root@srv6 ~]# mkdir /usr/java  

Change to the /usr/java directory we created and install the JDK using 'sh /opt/jdk-6u26-linux-x64.bin'

[root@srv6 ~]# cd /usr/java
[root@srv6 java]# sh /opt/jdk-6u26-linux-x64.bin

Set the JAVA_HOME path. This is where we installed our JDK above.

To set it for your current session, you can issue the following from the CLI:

[root@srv6 java]# JAVA_HOME=/usr/java/jdk1.6.0_26
[root@srv6 java]# export JAVA_HOME
[root@srv6 java]# PATH=$JAVA_HOME/bin:$PATH
[root@srv6 java]# export PATH

To set the JAVA_HOME permanently, we add below to either the ~/.bashrc or ~/.bash_profile of the user (in this case, root).

We can also add it /etc/profile and then source it to give to all users.

export JAVA_HOME
export PATH

Once you have added the above to ~/.bash_profile or ~/.bashrc, you should log out, then log back in and check that the JAVA_HOME is set correctly.

[root@srv6 ~]#  echo $JAVA_HOME

Step 2: Download and Unpack Tomcat 7.0.19

Download apache-tomcat-7.0.19.tar.gz here

Alternatively, you can download using wget.

[root@srv6 ~]#  wget http://apache.mivzakim.net/tomcat/tomcat-7/v7.0.19/bin/apache-tomcat-7.0.19.tar.gz

Save the file to a directory. I'm saving it to /root/apache-tomcat-7.0.19.tar.gz

Before proceeding, you should verify the MD5 Checksum for your Tomcat download (or any other download).

Since we saved the Tomcat download to /root/apache-tomcat-7.0.19.tar.gz, we'll go to the /root directory and use the md5sum command.

[root@srv6 ~]# md5sum apache-tomcat-7.0.19.tar.gz
5a5e9bc742714d1b7210d9f68764fd8e *apache-tomcat-7.0.19.zip

Compare the output above to the MD5 Checksum provided by here the Apache Tomcat MD5 page and insure that they match exactly.

Now, move (mv) or copy (cp) the file to the /usr/share directory:

[root@srv6 ~]# mv apache-tomcat-7.0.19.tar.gz /usr/share/apache-tomcat-7.0.19.tar.gz

Change to the /usr/share directory and unpack the file using tar -xzf:

[root@srv6 ~]# cd /usr/share
[root@sv2 srv6 ]# tar -xzf apache-tomcat-7.0.19.tar.gz  

This will create the directory /usr/share/apache-tomcat-7.0.19

Step 3: Configure Tomcat to Run as a Service.

We will now see how to run Tomcat as a service and create a simple Start/Stop/Restart script, as well as to start Tomcat at boot.

Change to the /etc/init.d directory and create a script called 'tomcat' as shown below.

[root@srv6 share]# cd /etc/init.d
[root@srv6 init.d]# vi tomcat

# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
export JAVA_HOME
export PATH

case $1 in
sh $CATALINA_HOME/bin/startup.sh
sh $CATALINA_HOME/bin/shutdown.sh
sh $CATALINA_HOME/bin/shutdown.sh
sh $CATALINA_HOME/bin/startup.sh
exit 0

The above script is simple and contains all of the basic elements you will need to get going.

As you can see, we are simply calling the startup.sh and shutdown.sh scripts located in the Tomcat bin directory (/usr/share/apache-tomcat-7.0.19/bin).

You can adjust your script according to your needs and, in subsequent posts, we'll look at additional examples.

CATALINA_HOME is the Tomcat home directory (/usr/share/apache-tomcat-7.0.19)

Now, set the permissions for your script to make it executable:

[root@srv6 init.d]# chmod 755 tomcat

We now use the chkconfig utility to have Tomcat start at boot time. In my script above, I am using chkconfig: 234 20 80. 2445 are the run levels and 20 and 80 are the stop and start priorities respectively. You can adjust as needed.

[root@srv6 init.d]# chkconfig --add tomcat
[root@srv6 init.d]# chkconfig --level 234 tomcat on

Verify it:

[root@srv6 init.d]# chkconfig --list tomcat
tomcat          0:off   1:off   2:on    3:on    4:on    5:off   6:off

Now, let's test our script.

Start Tomcat:
[root@srv6 ~]# service tomcat start
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

Stop Tomcat:

[root@srv6 ~]# service tomcat stop
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

Restarting Tomcat (Must be started first):

[root@srv6 ~]# service tomcat restart
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar
Using CATALINA_BASE:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_HOME:   /usr/share/apache-tomcat-7.0.19
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-7.0.19/temp
Using JRE_HOME:        /usr/java/jdk1.6.0_26
Using CLASSPATH:       /usr/share/apache-tomcat-7.0.19/bin/bootstrap.jar:/usr/share/apache-tomcat-7.0.19/bin/tomcat-juli.jar

We should review the Catalina.out log located at /usr/share/apache-tomcat-7.0.19/logs/catalina.out and check for any errors.

[root@srv6 init.d]# more /usr/share/apache-tomcat-7.0.19/logs/catalina.out

We can now access the swanky new Tomcat Manager page at:

http://yourdomain.com:8080 or http://yourIPaddress:8080 and we should see the Tomcat home page.

Step 4: Configuring Tomcat Manager Access.

Tomcat 7 contains a number of changes that offer finer-grain roles.

For security reasons, no users or passwords are created for the Tomcat manager roles by default. In a production deployment, it is always best to remove the Manager application.

To set roles, user name(s) and password(s), we need to configure the tomcat-users.xml file located at $CATALINA_HOME/conf/tomcat-users.xml.

In the case of our installation, $CATALINA_HOME is located at /usr/share/apache-tomcat-7.0.19.

By default the Tomcat 7 tomcat-users.xml file will look as below.

  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at


  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  See the License for the specific language governing permissions and
  limitations under the License.
  NOTE:  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary.
  NOTE:  The sample user and role entries below are wrapped in a comment
  and thus are ignored when reading this file. Do not forget to remove
  <!.. ..> that surrounds them.
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>

Note that while examples are provided, the elements between the <tomcat-users> and </tomcat-users> tags have been commented-out.

New roles for Tomcat 7 offer finer-grained access.

The following roles are available:


We can enable access for the manager-gui role, for example as below:

<role rolename="manager-gui">
<user username="tomcat" password="secret" roles="manager-gui">

Caution should be exercised in granting multiple roles so as not to under-mind security.

Step 5 (Optional): How to Run Tomcat using Minimally Privileged (non-root) User.

In our Tomcat configuration above, we are running Tomcat as Root.

For security reasons, it is always best to run services with the only those privileges that are necessary.

There are some who make a strong case that this is not required, but it's always best to err on the side of caution.

To run Tomcat as non-root user, we need to do the following:

1. Create the group 'tomcat':

[root@srv6 ~]# groupadd tomcat

2. Create the user 'tomcat' and add this user to the tomcat group we created above.

[root@srv6 ~]# useradd -s /bin/bash -g tomcat tomcat

The above will create a home directory for the user tomcat in the default user home as /home/tomcat

If we want the home directory to be elsewhere, we simply specify so using the -d switch.

[root@srv6 ~]# useradd -g tomcat -d /usr/share/apache-tomcat-7.0.19/tomcat tomcat

The above will create the user tomcat's home directory as /usr/share/apache-tomcat-7.0.19/tomcat

3. Change ownership of the tomcat files to the user tomcat we created above:

[root@srv6 ~]# chown -Rf tomcat.tomcat /usr/share/apache-tomcat-7.0.19/

Note: it is possible to enhance our security still further by making certain files and directories read-only. This will not be covered in this post and care should be used when setting such permissions.

4. Adjust the start/stop service script we created above. In our new script, we need to su to the user tomcat:

# description: Tomcat Start Stop Restart
# processname: tomcat
# chkconfig: 234 20 80
export JAVA_HOME
export PATH

case $1 in
/bin/su tomcat $TOMCAT_HOME/startup.sh
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
/bin/su tomcat $TOMCAT_HOME/shutdown.sh
/bin/su tomcat $TOMCAT_HOME/startup.sh
exit 0

Step 6 (Optional): How to Run Tomcat on Port 80 as Non-Root User.

Note: the following applies when you are running Tomcat in "stand alone" mode with Tomcat running under the minimally privileged user Tomcat we created in the previous step.

To run services below port 1024 as a user other than root, you can add the following to your IP tables:

[root@srv6 ~]# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080  
[root@srv6 ~]# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080  

Be sure to save and restart your iptables for the above change to take affect.

Tomcat 7 Hosting

Related Posts:
Tomcat Oracle JDBC Connection
Tomcat Manager Password
Tomcat Custom 404 Page
Install Tomcat 6 on CentOS

Learn More About Apache Tomcat 7

Apache Tomcat Foundation
Tomcat 7


Anonymous said...

Excellent tutorial.

It help me a lot in setting up Tomcat in Linux.


Darren Seay said...

Very well written, i was able to get tomcat 7 up and running faster that i could have imagined just reading this article. Thanks!

David Ghedini said...

Thanks, Darren. I'm glad you found it useful.

Anonymous said...

Hi David,

great tutorial. Works like a charm !!


Anonymous said...

Brilliant tutorial, thanks for taking the time to write it so clearly. Saved me lots of time.


olivier said...

Thank you for this ->EPIC<- tutorial sir David.

Works great! And Saved me a lot of time. I can't be more happy about it (^_^)

Anonymous said...

[root@WS init.d]# service tomcat start
sh: /usr/share/apache-tomcat-7.0.12.src/bin/startup.sh: No such file or directory

David Ghedini said...

Hi -
Your error indicates the script is looking for /usr/share/apache-tomcat-7.0.12.src

Please check your tomcat script for the CATALINA_HOME location. If you are following above, this would be /usr/share/apache-tomcat-7.0.12 (for version 7.0.12).

Andrei Todea said...

Thank you very much. Everything works! I would add that in order to access Tomcat from a different computer, one might need to allow access to its port (default 8080).

David Ghedini said...

Hi Andrei -
Glad you found it useful and good point about 8080. I'll add an update to the post.

Quiqueq said...

Hi, I followed the tutorial and everything worked great, except the last part where we setup the iptables so tomcat can run on port 80 as non-root user.

I add the 2 lines to the iptables but it doesn't seem to work. Also, when I try to restart, my website is getting a timeout both on port 80 as well as port 8080 (where it was working fine before adding the 2 iptables)

Quiqueq said...

Actually, my bad.
I actually had tomcat running on port 8181 instead of 8080, so that's why it wasn't working.

How can I remove those 2 iptables rules, and replace them with new ones, but forwarding to port 8181 instead of 8080 ?


David Ghedini said...

Hi -
You could simply edit the rules in your /etc/sysconfig/iptables. Alternatively, you could remove the 8080 ones using the -D switch and then add the 8181 rules. Either way should work.

Quiqueq said...

Hey Dave, thanks for the reply.

I went to /etc/sysconfig/iptables to edit it, and none of those entries are in there.

In fact, there are no entries pointing to 8080. Any ideas what could be happening?


David Ghedini said...

Hi Quiqueq -
When you added the rule initially did you actually save/restart your iptables? It sounds like your initial change was not saved.

Quiqueq said...

Hi Dave, you're right, I wasn't saving it.

If anyone else is having this problem...Once you enter the new iptable rules, if you restart iptables without saving it first, it gets reset to the original version. I was able to solve it by saving it first with the command:

service iptables save

David Ghedini said...

Glad to hear you got it sorted.

nesar said...

Thanks for make it easy for all. Its working fine but some times whenever i am trying to restart the service it doesn't start the service but in second time it start. Could i use this configuration in production except security issue. Because in my environment security is not big deal,have to care performance.

Dayo said...

Tanx for the post. Quick question: Would it be advisable to have a custom Tomcat installation in production environment as compared to the default sys install apt-get/yum? Your response will be appreciated. Thanx

David Ghedini said...

Hi Nesar -
Thanks. You should check your logs regarding the stop/start.
AFA production, I sometimes use above. For small sites I sometimes run as root out of general laziness and not wanting to SU every five minutes. For others, I'll use SSL and lock everything down. How much security measures you put in place (or don't) depends on your needs. MuleSoft has a nice checklist here: http://www.mulesoft.com/tomcat-security

David Ghedini said...

Hi Dayo - You are welcome. Every disto pulls down something different (some pull down nothing). I'm not familiar with all of them and I would recommend simply downloading and installing the latest tomcat and jdk to insure you are getting the latest security and bug fixes.

Jack said...

Just wanted to say thank you. Used this for tomcat 7.0.16 and the same java version and it worked flawlessly.

sysadmin said...

If you have more than one IP-address on the server and tomcat utilizes not the first one (typical situation when server runs many tomcats), the "-j REDIRECT" featue won't work, because it redirects trafic to the first ip-address found on the interface. In this case you need something like this:

iptables -t nat -A PREROUTING -d -p tcp --dport 80 -j DNAT --to-destination

(ip-address should be replaced with the actual one that tomcat listens).

David Ghedini said...

@sysadmin -
Good point.
Thanks, David

Nitin Balar said...

Mr. Devid
Thank you vary much for the great blog post providing the configuration part of the tomcat.
I am really vary much thankful because due to your blog I could pass my technical interview based on tomcat.
So once again thank you vary much and god bless you for your glorious life.

Anonymous said...

Just wanted to say thank you for a comprehensive installation notes. It's hard to find something this details and allowed to complete tomcat installation and its service in a couple hour. One note to add, I found the most current tomcat download link is to go directly to apache tomcat website, http://tomcat.apache.org/download-70.cgi, then copy the link to use with wget.

Nicola said...

Lavoro eccellente, infinitamente grazie.

Damir Vadas said...


Anonymous said...

Thanks for a great tut - really easy to follow your clear instructions :)