Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp

一、安装JDK环境

官方下载链接

http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

64位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-x64.tar.gz

32位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-i586.tar.gz

# tar -zxvf jdk-7u71-linux-x64.tar.gz //解压
# cp -r jdk-7u71-linux-x64/ /usr/local/jdk7 //拷贝到指定目录
# vi /etc/profile/  //编辑系统环境变量配置文件

在最后面添加如下配置：

export JAVA_HOME=/usr/local/jdk7
export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export PATH=$PATH:$JAVA_HOME/bin
# source  /etc/profile //启用变量
# java -version //查看java版本
java version "1.7.0_71"
Java(TM) SE Runtime Environment (build 1.7.0_71-b14)
Java HotSpot(TM) 64-Bit Server VM (build 24.71-b01, mixed mode)

配置生效，JDK已经安装完毕。

二、安装Tomcat

下载链接：

http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip

http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip

http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15.zip

1.上传下载好的tomcat包，解压并拷贝到你需要安装的目录下，同时新建软链接指向tomcat目录。

# unzip apache-tomcat-6.0.43.zip
# cp -r  apache-tomcat-6.0.43  /usr/local/tomcat-6.0.43
# ln -s  /usr/local/tomcat-6.0.43 /user/local/tomcat

2.新建tomcat用户用于启动tomcat，主要是从安全上考虑，毕竟root用户权限太大，，，

# mkdir /webroot/testapp //新建项目存放目录
# groupadd tomcat  //添加tomcat用户组
# useradd -d /webroot/testapp  -g tomcat tomcat //添加tomcat用户到tomcat用户组，并设定用户home目录为/webroot/testapp
# usermod -s /sbin/nologin //禁止用户远程登录SSH

3.编译生成jsvc文件，以服务项启动。

# cd /user/local/tomcat/bin
# tar zxvf commons-daemon-native.tar.gz
# cd commons-daemon-1.0.15-native-src/
# cd unix/
# yum -y install gcc //此时需要联网安装gcc
# ./configure  //编译
# make  //此时会编译并生成一个jsvc
# cp jsvc /usr/local/tomcat/bin/jsvc //拷贝
# ln -s /usr/local/tomcat/bin/daemon.sh /etc/init.d/tomcat6 //创建软链接
# chmod 755 /usr/local/tomcat/bin/daemon.sh //配置可执行权限
# chmod +x /usr/local/tomcat/bin/*.sh  //可能需要配置其他文件的可执行权限# chown -R tomcat:tomcat /usr/local/tomcat //设置目录权限
# vi /usr/local/tomcat/bin/daemon.sh //设置随机启动必要环境参数

编辑文件内容如下：

#!/bin/sh

//加入以下内容
# tomcatd This shell script takes care of starting and stopping
# standalone tomcat
# chkconfig: 345 91 10
# description: tomcat service
# processname: tomcatd
# config file:
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
if [ "${NETWORKING}" = "no" ]; then
    echo "Network is stoped! Please open the network!";
    exit 0
fi
//加入以上内容

# Licensed to the Apache Software Foundation (ASF) under one or more
# chkconfig tomcat6 on 235  //设置随机启动

如果chkconfig命令执行失败，请参考如下链接内容：

http://www.cnblogs.com/niocai/archive/2012/07/12/2587780.html

http://www.cnblogs.com/goodspeed/archive/2012/10/18/2729615.html

设定JDK路径，大约在95行：

//设定JDK路径
JAVA_HOME=/usr/java/jdk7

if [ -z "$JAVA_HOME" ]; then
# service tomcat6 start  //启动tomcat

4.优化tomcat内存设定

打开/usr/local/tomcat/bin/daemon.sh 文件，修改内容如下，大约在167左右：

##修复Tomcat容器乱码问题##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"
##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"

# ----- Execute The Requested Command -----------------------------------------

JAVA_OPTS="-server -Xms2048m -Xmx2048m -Xss1024k -XX:PermSize=256M -XX:MaxNewSize=1024m -XX:MaxPermSize=1024m -Djava.awt.headless=true"

红色字体请根据自己服务器的实际配置酌情增大或减小。

daemon.sh完整的配置内容：

#!/bin/sh

# tomcatd This shell script takes care of starting and stopping
# standalone tomcat
# chkconfig: 345 91 10
# description: tomcat service
# processname: tomcatd
# config file:
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
if [ "${NETWORKING}" = "no" ]; then
    echo "Network is stoped! Please open the network!";
    exit 0
fi

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# -----------------------------------------------------------------------------
# Commons Daemon wrapper script.
# -----------------------------------------------------------------------------
#
# resolve links - $0 may be a softlink
ARG0="$0"
while [ -h "$ARG0" ]; do
  ls=`ls -ld "$ARG0"`
  link=`expr "$ls" : ‘.*-> \(.*\)$‘`
  if expr "$link" : ‘/.*‘ > /dev/null; then
    ARG0="$link"
  else
    ARG0="`dirname $ARG0`/$link"
  fi
done
DIRNAME="`dirname $ARG0`"
PROGRAM="`basename $ARG0`"
while [ ".$1" != . ]
do
  case "$1" in
    --java-home )
        JAVA_HOME="$2"
        shift; shift;
        continue
    ;;
    --catalina-home )
        CATALINA_HOME="$2"
        shift; shift;
        continue
    ;;
    --catalina-base )
        CATALINA_BASE="$2"
        shift; shift;
        continue
    ;;
    --catalina-pid )
        CATALINA_PID="$2"
        shift; shift;
        continue
    ;;
    --tomcat-user )
        TOMCAT_USER="$2"
        shift; shift;
        continue
    ;;
    --service-start-wait-time )
        SERVICE_START_WAIT_TIME="$2"
        shift; shift;
        continue
    ;;
    * )
        break
    ;;
  esac
done
# OS specific support (must be ‘true‘ or ‘false‘).
cygwin=false;
darwin=false;
case "`uname`" in
    CYGWIN*)
        cygwin=true
        ;;
    Darwin*)
        darwin=true
        ;;
esac

# Use the maximum available, or set MAX_FD != -1 to use that
test ".$MAX_FD" = . && MAX_FD="maximum"
# Setup parameters for running the jsvc
#
test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat
# Set JAVA_HOME to working JDK or JRE
# JAVA_HOME=/opt/jdk-1.6.0.22
# If not set we‘ll try to guess the JAVA_HOME
# from java binary if on the PATH
#

###CHANGE BY PHPDRAGON###
JAVA_HOME=/usr/java/jdk7
###CHANGE BY PHPDRAGON###

if [ -z "$JAVA_HOME" ]; then
    JAVA_BIN="`which java 2>/dev/null || type java 2>&1`"
    test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`"
    test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd`
else
    JAVA_BIN="$JAVA_HOME/bin/java"
fi

# Only set CATALINA_HOME if not already set
test ".$CATALINA_HOME" = . && CATALINA_HOME=`cd "$DIRNAME/.." >/dev/null; pwd`
test ".$CATALINA_BASE" = . && CATALINA_BASE="$CATALINA_HOME"
test ".$CATALINA_MAIN" = . && CATALINA_MAIN=org.apache.catalina.startup.Bootstrap
test ".$JSVC" = . && JSVC="$CATALINA_BASE/bin/jsvc"
# Set the default service-start wait time if necessary
test ".$SERVICE_START_WAIT_TIME" = . && SERVICE_START_WAIT_TIME=10

# Ensure that any user defined CLASSPATH variables are not used on startup,
# but allow them to be specified in setenv.sh, in rare case when it is needed.
CLASSPATH=
JAVA_OPTS=
if [ -r "$CATALINA_BASE/bin/setenv.sh" ]; then
  . "$CATALINA_BASE/bin/setenv.sh"
elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then
  . "$CATALINA_HOME/bin/setenv.sh"
fi

# Add on extra jar files to CLASSPATH
# tomcat-juli.jar can be over-ridden per instance
test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:"
if [ "$CATALINA_BASE" != "$CATALINA_HOME" ] && [ -r "$CATALINA_BASE/bin/tomcat-juli.jar" ] ; then
  CLASSPATH="$CLASSPATH$CATALINA_BASE/bin/tomcat-juli.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
else
  CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
fi

test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out"
test ".$CATALINA_TMP" = . && CATALINA_TMP="$CATALINA_BASE/temp"

# Set juli LogManager config file if it is present and an override has not been issued
if [ -z "$LOGGING_CONFIG" ]; then
  if [ -r "$CATALINA_BASE/conf/logging.properties" ]; then
    LOGGING_CONFIG="-Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties"
  else
    # Bugzilla 45585
    LOGGING_CONFIG="-Dnop"
  fi
fi

test ".$LOGGING_MANAGER" = . && LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"
JAVA_OPTS="$JAVA_OPTS $LOGGING_MANAGER"

# Set -pidfile
test ".$CATALINA_PID" = . && CATALINA_PID="$CATALINA_BASE/logs/catalina-daemon.pid"

# Increase the maximum file descriptors if we can
if [ "$cygwin" = "false" ]; then
    MAX_FD_LIMIT=`ulimit -H -n`
    if [ "$?" -eq 0 ]; then
        # Darwin does not allow RLIMIT_INFINITY on file soft limit
        if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then
            MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc`
        fi
        test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT"
        ulimit -n $MAX_FD
        if [ "$?" -ne 0 ]; then
            echo "$PROGRAM: Could not set maximum file descriptor limit: $MAX_FD"
        fi
    else
        echo "$PROGRAM: Could not query system maximum file descriptor limit: $MAX_FD_LIMIT"
    fi
fi

###CHANGE BY PHPDRAGON###
##Repair of Tomcat container Garbled problem##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"
##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"
###CHANGE BY PHPDRAGON###

# ----- Execute The Requested Command -----------------------------------------
case "$1" in
    run     )
      shift
      "$JSVC" $*       $JSVC_OPTS       -java-home "$JAVA_HOME"       -pidfile "$CATALINA_PID"       -wait "$SERVICE_START_WAIT_TIME"       -nodetach       -outfile "&1"       -errfile "&2"       -classpath "$CLASSPATH"       "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS       -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS"       -Dcatalina.base="$CATALINA_BASE"       -Dcatalina.home="$CATALINA_HOME"       -Djava.io.tmpdir="$CATALINA_TMP"       $CATALINA_MAIN
      exit $?
    ;;
    start   )
      "$JSVC" $JSVC_OPTS       -java-home "$JAVA_HOME"       -user $TOMCAT_USER       -pidfile "$CATALINA_PID"       -wait "$SERVICE_START_WAIT_TIME"       -outfile "$CATALINA_OUT"       -errfile "&1"       -classpath "$CLASSPATH"       "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS       -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS"       -Dcatalina.base="$CATALINA_BASE"       -Dcatalina.home="$CATALINA_HOME"       -Djava.io.tmpdir="$CATALINA_TMP"       $CATALINA_MAIN
      exit $?
    ;;
    stop    )
      "$JSVC" $JSVC_OPTS       -stop       -pidfile "$CATALINA_PID"       -classpath "$CLASSPATH"       -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS"       -Dcatalina.base="$CATALINA_BASE"       -Dcatalina.home="$CATALINA_HOME"       -Djava.io.tmpdir="$CATALINA_TMP"       $CATALINA_MAIN
      exit $?
    ;;
    version  )
      "$JSVC"       -java-home "$JAVA_HOME"       -pidfile "$CATALINA_PID"       -classpath "$CLASSPATH"       -errfile "&2"       -version       -check       $CATALINA_MAIN
      if [ "$?" = 0 ]; then
        "$JAVA_BIN"         -classpath "$CATALINA_HOME/lib/catalina.jar"         org.apache.catalina.util.ServerInfo
      fi
      exit $?
    ;;
    *       )
      echo "Unknown command: \`$1‘"
      echo "Usage: $PROGRAM ( commands ... )"
      echo "commands:"
      echo "  run               Start Tomcat without detaching from console"
      echo "  start             Start Tomcat"
      echo "  stop              Stop Tomcat"
      echo "  version           What version of commons daemon and Tomcat"
      echo "                    are you running?"
      exit 1
    ;;
esac

三、安装vsftpd

# yum -y install vsftpd
# vi /etc/vsftpd/vsftpd.conf  //编辑配置文件

12行 anonymous_enable=YES 改为 NO 静止匿名用户登录

允许ascii码上传下载文件

81行 ascii_upload_enable=YES  去除 #

82行 ascii_download_enable=YES  去除 #

将登录后的用户限制在本地家目录下：

97行chroot_list_enable=YES 去除 # 
99行chroot_list_file=/etc/vsftpd/chroot_list 去除 #

# echo "tomcat" >> /etc/vsftpd/chroot_list  //将tomcat登录后限制在/webroot/testapp/目录下，该目录在创建tomcat用户时已经指定
#echo "tomcat" >>  /etc/vsftpd/user_list //添加tomcat可登录ftp

好了，安全方面，项目使用的是tomcat普通用户运行，禁止了SSH远程登录，同时使用ftp进行代码文件的上传。

这么做的初衷是之前的项目使用的80端口转发8080端口，导致程序的任务脚本CURL访问自身报错误[java.lang.Exception: Connection refused],

同时使用SecureFXPortable上传脚本导致项目上下文乱码。

打算不采用jsvc模式部署的，请参考我的另一篇文章

Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境 端口转发方式

借鉴：

http://www.linuxidc.com/Linux/2012-09/70481.htm

http://www.cnblogs.com/ebs-blog/archive/2010/10/14/2167288.html

http://blog.csdn.net/cnfixit/article/details/7030666

http://blog.csdn.net/wuyigong111/article/details/17410661

http://wenku.baidu.com/link?url=yZXEqZFAG4WNVhiAOoh4uHy_eQ5FV3JSiNPRa9zbAZ1Wj3hNS6h2upCv0TgCqAcJnqNnxqAf5nRpYD_5r_-4JJRa4mdnkqqZwuvwg4gAmbG

http://www.cnblogs.com/panjun-Donet/archive/2010/08/10/1796873.html

http://www.jb51.net/article/34332.htm

http://blog.sina.com.cn/s/blog_5c4532e50100vhbv.html

时间： 2024-10-06 05:16:48

Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp的相关文章

Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境

一.安装Tomcat 下载链接: http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15

Ubuntu下配置Tomcat以指定（非root）身份运行

My Blog:http://www.outflush.com/ 通常情况下,在配置Tomcat生产环境时,通常会配置Tomcat以特定的身份运行(非root),这样有利于提高安全性,防止网站被黑后的进一步权限提升. 本文依赖的环境: Ubuntu(其实大部分同样适用于CentOS) JVM(安装并已配置好环境变量) gcc.make等编译工具 JAVA_HOME=/usr/lib/jvm/jdk1.7.0_55 CATALINA_HOME=/usr/local/apache-tomcat-7.

Linux下MySQL无法在本地以非root用户身份连接数据库

标题有点罗嗦,目前出现的问题如下: 当以非root身份登录数据库时,会报错 mysql -u root -p Enter password: ERROR 1698 (28000): Access denied for user 'root'@'localhost' 而使用root身份访问就没有问题 问题探究 查看root用户使用的认证插件: mysql> select user,plugin from user where user = 'root'; +------+-------------

tomcat加入service启动,非root用户启动tomcat

启动文件 拷贝tomcat6.tomcat6-1.tomcat6-1.conf文件到相应目录,并命名成相应名称(见附件) /etc/init.d/tomcat6-1 /etc/tomcat6/tomcat6-1.conf   注意修改启动内存 加到/etc/tomcat6/tomcat6-1.conf /usr/sbin/tomcat6 配置 /etc/tomcat6/tomcat6-1.conf文件 # Where your tomcat installation livesCATALINA_

CentOS6.2下安装Qt5.1.0

因为要将程序实现跨平台,所以只能在CentOS6.2上再安装一次Qt,为了保证一致性,我使用了和windows下版本一样的Qt5.1.0,可以到此处下载. 下载好,复制到虚拟机上后,直接双击运行,一切良好,安装完毕,可是却无法启动,于是在网上搜解决方案,将遇到的问题及解决办法记下来. 1.从application>Programming>Qt Creator点击,结果没有反应,只能使用命令行到安装目录下,启动,提示错误如下: /usr/lib64/libstdc++.so.6: version

CentOS6.7下使用非root用户(普通用户)编译安装与配置mysql数据库并使用shell脚本定时任务方式实现mysql数据库服务随机自动启动

CentOS6.7下使用非root用户(普通用户)编译安装与配置mysql数据库并使用shell脚本定时任务方式实现mysql数据库服务随机自动启动1.关于mysql?MySQL是一个关系型数据库管理系统,由瑞典MySQL AB公司开发,目前属于Oracle公司.MySQL是一种关联数据库管理系统,关联数据库将数据保存在不同的表中,而不是将所有数据放在一个大仓库内,这样就增加了速度并提高了灵活性.特点: Mysql是开源的,所以你不需要支付额外的费用.Mysql支持大型的数据库.可以处理拥有上千

linux系统非ROOT用户80端口不能启动tomcat问题的变通办法——通过Iptables端口转发

2010-07-17 13:21:42 org.apache.tomcat.util.digester.SetPropertiesRule begin 警告: [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property. 2010-07-17 13:21:42  org.apache.catalina.core.Ap

linux下非root用户的sudo问题

linux下的root用户是个超级管理员,一般是不用这个用户登录进行操作的,但有时候需要root权限,又不想切换用户的话可以使用sudo命令.但是不是所有的用户都可以使用sudo命令的. 首先可能会遇到下面的提示: ××× is not in the sudoers file.  This incident will be reported. 解决办法: 1.修改/etc/sudoers 文件 #su - #chmod u+w /etc/sudoers 在 root    ALL=(ALL) 

Mac下新安装的MySQL无法登陆root用户解决方法

一 设置MySQL命令行搜索路径 0.苹果->系统偏好设置->最下边点mysql 在弹出页面中 启动mysql服务 1.打开终端,输入: sudo vi ~/.bash_profile 如果已存在删除:  sudo rm -rf .bash_* 2.输入 i 3.然后粘贴以下内容 # mysql alias mysql='/usr/local/mysql/bin/mysql' alias mysqladmin='/usr/local/mysql/bin/mysqladmin' # ls ali