Environment Setup and Installation

1. Deploying Java Environment

Install the OpenJDK runtime environment using the system package manager.

yum install java-1.8.0-openjdk -y
java -version

2. Installing Tomcat

Download the binary distribution from the Apache mirror, extract it, and configure the environment variables.

mkdir -p /data/software
cd /data/software
wget https://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-8/v8.5.53/bin/apache-tomcat-8.5.53.tar.gz
tar -zxf apache-tomcat-8.5.53.tar.gz -C /opt/
cd /opt
ln -s apache-tomcat-8.5.53 tomcat
echo 'export TOMCAT_HOME=/opt/tomcat' >> /etc/profile

Start the service and verify the status:

/opt/tomcat/bin/startup.sh
netstat -lntup | grep 8080
ps -ef | grep tomcat
tail -1 /opt/tomcat/logs/catalina.out
curl -I 127.0.0.1:8080

3. Directory Structure Overview

The Tomcat installation directory contains several critical subdirectories:

• bin: Contains startup, shutdown, and other executable scripts (e.g., catalina.sh, startup.sh).
• conf: Stores configuration files such as server.xml and tomcat-users.xml.
• lib: Holds JAR files required for Tomcat runtime.
• logs: Log files are stored here.
• temp: Temporary file storage.
• webapps: The default directory for web applications (ROOT, docs, examples, manager).
• work: Stores compiled Servlets generated from JSPs.

4. Managing Tomcat Services

Tomcat can be started or stopped using the shell scripts directly or via a systemd service unit.

Method 1: Using Scripts

/opt/tomcat/bin/startup.sh
/opt/tomcat/bin/shutdown.sh

Method 2: Using Catalina Script

/opt/tomcat/bin/catalina.sh start
/opt/tomcat/bin/catalina.sh stop

Method 3: Systemd Service

Create a service file at /usr/lib/systemd/system/tomcat.service:

[Unit]
Description=Apache Tomcat Web Application Container
After=syslog.target network.target

[Service]
Type=forking
ExecStart=/opt/tomcat/bin/catalina.sh start
ExecReload=/opt/tomcat/bin/catalina.sh restart
ExecStop=/opt/tomcat/bin/catalina.sh stop
User=tomcat

[Install]
WantedBy=multi-user.target

Reload the daemon and manage the service:

systemctl daemon-reload
systemctl start tomcat
systemctl stop tomcat

Configuration File Analysis

1. Core Configuration Files

• server.xml: The primary configuration file containing port definitions, connectors, and virtual hosts.
• tomcat-users.xml: Defines user roles and credentials for the Manager and Host Manager apps.

2. Enabling Manager Access

Edit conf/tomcat-users.xml to add administrative roles:

<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">
  <role rolename="admin-gui"/>
  <role rolename="host-gui"/>
  <role rolename="manager-gui"/>
  <user username="admin" password="securepassword" roles="admin-gui,host-gui,manager-gui"/>
</tomcat-users>

Modify webapps/manager/META-INF/context.xml to allow remote access by adjusting the IP allow list.

3. Server.xml Architecture

The configuration follows a hierarchical structure:

<Server>
    <Service>
        <Connector />
        <Engine>
            <Host>
                <Context />
            </Host>
        </Engine>
    </Service>
</Server>

Key Components:

• Server: Top-level element representing the entire JVM instance.
• Service: Associates one or more Connectors with a single Engine.
• Connector: Handles client connections (HTTP, AJP).
• Engine: Request processing mechanism that directs traffic to the appropriate Host.
• Host: Represents a virtual host.
• Context: Represents a specific web application.

4. Key Configuration Parameters

Element	Attribute	Description
Server	port	Shutdown listening port (default 8005).
Server	shutdown	Command string to trigger shutdown.
Connector	port	Port for incoming requests (e.g., 8080).
Connector	protocol	Protocol type (HTTP/1.1 or AJP/1.3).
Connector	maxThreads	Maximum number of request processing threads.
Connector	connectionTimeout	Timeout for connections in milliseconds.
Host	name	Hostname (e.g., localhost).
Host	appBase	Application base directory (e.g., webapps).
Host	autoDeploy	Automatically deploy new WAR files.
Context	docBase	Document base directory for the web app.

Web Application Deployment

1. Standard Port Assignments

• 8080: HTTP listener port.
• 8443: HTTPS listener port.
• 8005: Shutdown command port.
• 8009: AJP port for reverse proxy integration.

2. Deploying a WAR File

Simply place the .war file into the webapps directory. Tomcat will automatically extract and deploy it.

cd /opt/tomcat/webapps
# Copy memtest.war to this directory
curl http://192.168.1.11:8080/memtest/meminfo.jsp

3. Customizing the Default Web Root

To change the default applicasion path, edit server.xml inside the <Host> element:

<Context path="" docBase="/opt/tomcat/webapps/memtest" debug="0" reloadable="false" crossContext="true"/>

Practical Deployment: JPress

1. Database Preparation

Install MariaDB and configure the database user:

yum install mariadb mariadb-server -y
systemctl start mariadb.service
mysqladmin password 'DbPass123'

mysql -uroot -p'DbPass123' -e "create database jpress DEFAULT CHARACTER SET utf8;"
mysql -uroot -p'DbPass123' -e "grant all on jpress.* to 'jpress'@'192.168.1.%' identified by 'DbPass123';"
mysql -uroot -p'DbPass123' -e "flush privileges;"

2. Application Deployment

Upload the WAR file and restart Tomcat:

cd /opt/tomcat/webapps
# Upload jpress-web-newest.war
mv jpress-web-newest.war jpress.war
/opt/tomcat/bin/shutdown.sh
/opt/tomcat/bin/startup.sh

Access the installation wizard via browser at http://SERVER_IP:8080/jpress/.

Monitoring with Zabbix

1. Enabling JMX Remote Monitoring

Edit bin/catalina.sh and add the following options at the beginning:

CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote
  -Dcom.sun.management.jmxremote.port=12345
  -Dcom.sun.management.jmxremote.authenticate=false
  -Dcom.sun.management.jmxremote.ssl=false
  -Djava.rmi.server.hostname=192.168.1.11"

2. Configuring Zabbix Java Gateway

On the Zabbix server, install the Java Gateway:

yum install zabbix-java-gateway -y
systemctl start zabbix-java-gateway.service

Edit /etc/zabbix/zabbix_server.conf:

JavaGateway=127.0.0.1
JavaGatewayPort=10052
StartJavaPollers=5

Restart Zabbix server and add the JMX interface to the host configuration in the frontend.

Multi-Instance Configuration

1. Directory Duplication

Create copies of the Tomcat installation directory:

cp -a apache-tomcat-8.5.43 tomcat_instance_1
cp -a apache-tomcat-8.5.43 tomcat_instance_2

2. Port Modification

Modify the server.xml in each instance to avoid port conflicts:

• Instance 1: Server port 8006, HTTP 8081, AJP 8010.
• Instance 2: Server port 8007, HTTP 8082, AJP 8011.

3. Startup

/opt/tomcat_instance_1/bin/startup.sh
/opt/tomcat_instance_2/bin/startup.sh

Nginx Load Balancing

1. Nginx Configuration

Create a reverse proxy configuration in Nginx:

upstream java_backend {
    server 192.168.1.11:8081;
    server 192.168.1.11:8082;
}

server {
    listen 80;
    server_name www.test.com;

    location / {
        proxy_pass http://java_backend;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Start Nginx to begin routing traffic.

Security Hardening

1. Principle of Least Privilege

Never run Tomcat as root. Create a dedicated user:

useradd -r -s /sbin/nologin tomcat
chown -R tomcat:tomcat /opt/tomcat
su - tomcat -c '/opt/tomcat/bin/startup.sh'

2. Protecting Management Ports

• Shutdown Port: Change the default port (8005) and the shutdown command string.
• AJP Port: Change the default port (8009) or disable it if not used.

3. Removing Default Applications

Delete default web applications to reduce the attack surface:

rm -rf /opt/tomcat/webapps/{docs,examples,host-manager,manager,ROOT}

4. Performance and Security Tuning

Disable DNS lookups in server.xml to improve performance:

<Connector port="8080" protocol="HTTP/1.1" enableLookups="false" />

To speed up startup, modify jre/lib/security/java.security:

securerandom.source=file:/dev/urandom

JVM Optimization

Configure JVM memory settings in catalina.sh:

JAVA_OPTS="-server -Xms2048m -Xmx2048m -XX:MetaspaceSize=256m -XX:MaxMetaspaceSize=512m"

Parameter Explanations:

• -server: Optimizes JVM for server environments.
• -Xms / -Xmx: Initial and maximum heap memory. Setting them equal prevents resizing overhead.
• -XX:MetaspaceSize: Defines the initial size of the class metadata area (Java 8+).
• -XX:+UseG1GC: Recommended garbage collector for modern multi-core servers.

Operational Tools

1. Systemd Service Management

Use the previously defined systemd unit file for robust process management.

2. Ansible Automation

Example playbook to start Tomcat:

- name: Manage Tomcat
  hosts: app_servers
  tasks:
    - name: Ensure Tomcat is running
      shell: chdir=/opt/tomcat/bin nohup ./startup.sh start &