Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp

时间：2021-10-04 17:30:41

一、安装JDK环境

方法一、

官方下载链接

http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

64位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-x64.tar.gz

32位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-i586.tar.gz

# tar -zxvf jdk-7u71-linux-x64.tar.gz //解压

# cp -r jdk-7u71-linux-x64/ /usr/local/jdk7 //拷贝到指定目录

# vi /etc/profile  //编辑系统环境变量配置文件

在最后面添加如下配置：

export JAVA_HOME=/usr/local/jdk7

export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar

export PATH=$PATH:$JAVA_HOME/bin
# source  /etc/profile //启用变量

# java -version //查看java版本
java version "1.7.0_71"

Java(TM) SE Runtime Environment (build 1.7.0_71-b14)

Java HotSpot(TM) 64-Bit Server VM (build 24.71-b01, mixed mode)

配置生效，JDK已经安装完毕。

方法二、

wget --no-check-certificate --no-cookie --header "Cookie: oraclelicense=accept-securebackup-cookie;" http://download.oracle.com/otn-pub/java/jdk/8u45-b14/jdk-8u45-linux-x64.rpm

因为oracle现在要同意协议才能下载，直接使用wget加链接下载不到，所以要加上前面的那些代码.

rpm -ivh jdk-8u45-linux-x64.rpm

命令执行完毕即安装完成，使用java -version 检查是否安装成功。

二、安装Tomcat

下载链接：

http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip

http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip

http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15.zip

1.上传下载好的tomcat包，解压并拷贝到你需要安装的目录下，同时新建软链接指向tomcat目录。

# unzip apache-tomcat-6.0.43.zip

# cp -r  apache-tomcat-6.0.43  /usr/local/tomcat-6.0.43

# ln -s  /usr/local/tomcat-6.0.43 /user/local/tomcat

2.新建tomcat用户用于启动tomcat，主要是从安全上考虑，毕竟root用户权限太大，，，

# mkdir /webroot/testapp //新建项目存放目录

# groupadd tomcat  //添加tomcat用户组

# useradd -d /webroot/testapp  -g tomcat tomcat //添加tomcat用户到tomcat用户组，并设定用户home目录为/webroot/testapp

# usermod -s /sbin/nologin tomcat//禁止用户远程登录SSH

3.编译生成jsvc文件，以服务项启动。

# cd /user/local/tomcat/bin

# tar zxvf commons-daemon-native.tar.gz

# cd commons-daemon-1.0.-native-src/

# cd unix/

# yum -y install gcc //此时需要联网安装gcc

# ./configure  //编译

# make  //此时会编译并生成一个jsvc

# cp jsvc /usr/local/tomcat/bin/jsvc //拷贝

# ln -s /usr/local/tomcat/bin/daemon.sh /etc/init.d/tomcat6 //创建软链接

# chmod  /usr/local/tomcat/bin/daemon.sh //配置可执行权限

# chmod +x /usr/local/tomcat/bin/*.sh  //可能需要配置其他文件的可执行权限
# chown -R tomcat:tomcat /usr/local/tomcat //设置目录权限
# vi /usr/local/tomcat/bin/daemon.sh //设置随机启动必要环境参数

编辑文件内容如下：

#!/bin/sh

//加入以下内容

# tomcatd This shell script takes care of starting and stopping

# standalone tomcat

# chkconfig:

# description: tomcat service

# processname: tomcatd

# config file:

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

if [ "${NETWORKING}" = "no" ]; then

    echo "Network is stoped! Please open the network!";

    exit

fi

//加入以上内容

# Licensed to the Apache Software Foundation (ASF) under one or more
# chkconfig tomcat6 on   //设置随机启动

如果chkconfig命令执行失败，请参考如下链接内容：

http://www.cnblogs.com/niocai/archive/2012/07/12/2587780.html

http://www.cnblogs.com/goodspeed/archive/2012/10/18/2729615.html

设定JDK路径，大约在95行：

//设定JDK路径

JAVA_HOME=/usr/java/jdk7

if [ -z "$JAVA_HOME" ]; then
# service tomcat6 start  //启动tomcat

4.优化tomcat内存设定

打开/usr/local/tomcat/bin/daemon.sh 文件，修改内容如下，大约在167左右：

##修复Tomcat容器乱码问题##

CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"

##Tomcat optimization##

JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"

# ----- Execute The Requested Command -----------------------------------------

JAVA_OPTS="-server -Xmsm -Xmxm -Xssk -XX:PermSize=M -XX:MaxNewSize=m -XX:MaxPermSize=m -Djava.awt.headless=true"

红色字体请根据自己服务器的实际配置酌情增大或减小。

daemon.sh完整的配置内容：

#!/bin/sh

# tomcatd This shell script takes care of starting and stopping

# standalone tomcat

# chkconfig:

# description: tomcat service

# processname: tomcatd

# config file:

# Source function library.

. /etc/rc.d/init.d/functions

# Source networking configuration.

. /etc/sysconfig/network

# Check that networking is up.

if [ "${NETWORKING}" = "no" ]; then

    echo "Network is stoped! Please open the network!";

    exit

fi

# Licensed to the Apache Software Foundation (ASF) under one or more

# contributor license agreements.  See the NOTICE file distributed with

# this work for additional information regarding copyright ownership.

# The ASF licenses this file to You under the Apache License, Version 2.0

# (the "License"); you may not use this file except in compliance with

# the License.  You may obtain a copy of the License at

#

#     http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

# -----------------------------------------------------------------------------

# Commons Daemon wrapper script.

# -----------------------------------------------------------------------------

#

# resolve links - $ may be a softlink

ARG0="$0"

while [ -h "$ARG0" ]; do

  ls=`ls -ld "$ARG0"`

  link=`expr "$ls" : '.*-> \(.*\)$'`

  if expr "$link" : '/.*' > /dev/null; then

    ARG0="$link"

  else

    ARG0="`dirname $ARG0`/$link"

  fi

done

DIRNAME="`dirname $ARG0`"

PROGRAM="`basename $ARG0`"

while [ ".$1" != . ]

do

  case "$1" in

    --java-home )

        JAVA_HOME="$2"

        shift; shift;

        continue

    ;;

    --catalina-home )

        CATALINA_HOME="$2"

        shift; shift;

        continue

    ;;

    --catalina-base )

        CATALINA_BASE="$2"

        shift; shift;

        continue

    ;;

    --catalina-pid )

        CATALINA_PID="$2"

        shift; shift;

        continue

    ;;

    --tomcat-user )

        TOMCAT_USER="$2"

        shift; shift;

        continue

    ;;

    --service-start-wait-time )

        SERVICE_START_WAIT_TIME="$2"

        shift; shift;

        continue

    ;;

    * )

        break

    ;;

  esac

done

# OS specific support (must be 'true' or 'false').

cygwin=false;

darwin=false;

case "`uname`" in

    CYGWIN*)

        cygwin=true

        ;;

    Darwin*)

        darwin=true

        ;;

esac

# Use the maximum available, or set MAX_FD != - to use that

test ".$MAX_FD" = . && MAX_FD="maximum"

# Setup parameters for running the jsvc

#

test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat

# Set JAVA_HOME to working JDK or JRE

# JAVA_HOME=/opt/jdk-1.6.0.22

# If not set we'll try to guess the JAVA_HOME

# from java binary if on the PATH

#

###CHANGE BY PHPDRAGON###

JAVA_HOME=/usr/java/jdk7

###CHANGE BY PHPDRAGON###

if [ -z "$JAVA_HOME" ]; then

    JAVA_BIN="`which java 2>/dev/null || type java 2>&1`"

    test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`"

    test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd`

else

    JAVA_BIN="$JAVA_HOME/bin/java"

fi

# Only set CATALINA_HOME if not already set

test ".$CATALINA_HOME" = . && CATALINA_HOME=`cd "$DIRNAME/.." >/dev/null; pwd`

test ".$CATALINA_BASE" = . && CATALINA_BASE="$CATALINA_HOME"

test ".$CATALINA_MAIN" = . && CATALINA_MAIN=org.apache.catalina.startup.Bootstrap

test ".$JSVC" = . && JSVC="$CATALINA_BASE/bin/jsvc"

# Set the default service-start wait time if necessary

test ".$SERVICE_START_WAIT_TIME" = . && SERVICE_START_WAIT_TIME=

# Ensure that any user defined CLASSPATH variables are not used on startup,

# but allow them to be specified in setenv.sh, in rare case when it is needed.

CLASSPATH=

JAVA_OPTS=

if [ -r "$CATALINA_BASE/bin/setenv.sh" ]; then

  . "$CATALINA_BASE/bin/setenv.sh"

elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then

  . "$CATALINA_HOME/bin/setenv.sh"

fi

# Add on extra jar files to CLASSPATH

# tomcat-juli.jar can be over-ridden per instance

test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:"

if [ "$CATALINA_BASE" != "$CATALINA_HOME" ] && [ -r "$CATALINA_BASE/bin/tomcat-juli.jar" ] ; then

  CLASSPATH="$CLASSPATH$CATALINA_BASE/bin/tomcat-juli.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"

else

  CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"

fi

test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out"

test ".$CATALINA_TMP" = . && CATALINA_TMP="$CATALINA_BASE/temp"

# Set juli LogManager config file if it is present and an override has not been issued

if [ -z "$LOGGING_CONFIG" ]; then

  if [ -r "$CATALINA_BASE/conf/logging.properties" ]; then

    LOGGING_CONFIG="-Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties"

  else

    # Bugzilla

    LOGGING_CONFIG="-Dnop"

  fi

fi

test ".$LOGGING_MANAGER" = . && LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"

JAVA_OPTS="$JAVA_OPTS $LOGGING_MANAGER"

# Set -pidfile

test ".$CATALINA_PID" = . && CATALINA_PID="$CATALINA_BASE/logs/catalina-daemon.pid"

# Increase the maximum file descriptors if we can

if [ "$cygwin" = "false" ]; then

    MAX_FD_LIMIT=`ulimit -H -n`

    if [ "$?" -eq  ]; then

        # Darwin does not allow RLIMIT_INFINITY on file soft limit

        if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then

            MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc`

        fi

        test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT"

        ulimit -n $MAX_FD

        if [ "$?" -ne  ]; then

            echo "$PROGRAM: Could not set maximum file descriptor limit: $MAX_FD"

        fi

    else

        echo "$PROGRAM: Could not query system maximum file descriptor limit: $MAX_FD_LIMIT"

    fi

fi

###CHANGE BY PHPDRAGON###

##Repair of Tomcat container Garbled problem##

CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"

##Tomcat optimization##

JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"

###CHANGE BY PHPDRAGON###

# ----- Execute The Requested Command -----------------------------------------

case "$1" in

    run     )

      shift

      "$JSVC" $* \

      $JSVC_OPTS \

      -java-home "$JAVA_HOME" \

      -pidfile "$CATALINA_PID" \

      -wait "$SERVICE_START_WAIT_TIME" \

      -nodetach \

      -outfile "&1" \

      -errfile "&2" \

      -classpath "$CLASSPATH" \

      "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \

      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \

      -Dcatalina.base="$CATALINA_BASE" \

      -Dcatalina.home="$CATALINA_HOME" \

      -Djava.io.tmpdir="$CATALINA_TMP" \

      $CATALINA_MAIN

      exit $?

    ;;

    start   )

      "$JSVC" $JSVC_OPTS \

      -java-home "$JAVA_HOME" \

      -user $TOMCAT_USER \

      -pidfile "$CATALINA_PID" \

      -wait "$SERVICE_START_WAIT_TIME" \

      -outfile "$CATALINA_OUT" \

      -errfile "&1" \

      -classpath "$CLASSPATH" \

      "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \

      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \

      -Dcatalina.base="$CATALINA_BASE" \

      -Dcatalina.home="$CATALINA_HOME" \

      -Djava.io.tmpdir="$CATALINA_TMP" \

      $CATALINA_MAIN

      exit $?

    ;;

    stop    )

      "$JSVC" $JSVC_OPTS \

      -stop \

      -pidfile "$CATALINA_PID" \

      -classpath "$CLASSPATH" \

      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \

      -Dcatalina.base="$CATALINA_BASE" \

      -Dcatalina.home="$CATALINA_HOME" \

      -Djava.io.tmpdir="$CATALINA_TMP" \

      $CATALINA_MAIN

      exit $?

    ;;

    version  )

      "$JSVC" \

      -java-home "$JAVA_HOME" \

      -pidfile "$CATALINA_PID" \

      -classpath "$CLASSPATH" \

      -errfile "&2" \

      -version \

      -check \

      $CATALINA_MAIN

      if [ "$?" =  ]; then

        "$JAVA_BIN" \

        -classpath "$CATALINA_HOME/lib/catalina.jar" \

        org.apache.catalina.util.ServerInfo

      fi

      exit $?

    ;;

    *       )

      echo "Unknown command: \`$1'"

      echo "Usage: $PROGRAM ( commands ... )"

      echo "commands:"

      echo "  run               Start Tomcat without detaching from console"

      echo "  start             Start Tomcat"

      echo "  stop              Stop Tomcat"

      echo "  version           What version of commons daemon and Tomcat"

      echo "                    are you running?"

      exit

    ;;

esac

三、安装vsftpd

# yum -y install vsftpd
# vi /etc/vsftpd/vsftpd.conf  //编辑配置文件

12行 anonymous_enable=YES 改为 NO 静止匿名用户登录

允许ascii码上传下载文件

81行 ascii_upload_enable=YES  去除 #

82行 ascii_download_enable=YES  去除 #

将登录后的用户限制在本地家目录下：

97行chroot_list_enable=YES 去除 # 
99行chroot_list_file=/etc/vsftpd/chroot_list 去除 #

121行userlist_enable=YES 修改 为 NO

#echo "tomcat" >> /etc/vsftpd/chroot_list  //将tomcat登录后限制在/webroot/testapp/目录下，该目录在创建tomcat用户时已经指定
#echo "tomcat" >>  /etc/vsftpd/user_list //添加tomcat可登录ftp

好了，安全方面，项目使用的是tomcat普通用户运行，禁止了SSH远程登录，同时使用ftp进行代码文件的上传。

这么做的初衷是之前的项目使用的80端口转发8080端口，导致程序的任务脚本CURL访问自身报错误[java.lang.Exception: Connection refused],

同时使用SecureFXPortable上传脚本导致项目上下文乱码。

打算不采用jsvc模式部署的，请参考我的另一篇文章

Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境 端口转发方式

借鉴：

http://www.linuxidc.com/Linux/2012-09/70481.htm

http://www.cnblogs.com/ebs-blog/archive/2010/10/14/2167288.html

http://blog.csdn.net/cnfixit/article/details/7030666

http://blog.csdn.net/*gong111/article/details/17410661

http://wenku.baidu.com/link?url=yZXEqZFAG4WNVhiAOoh4uHy_eQ5FV3JSiNPRa9zbAZ1Wj3hNS6h2upCv0TgCqAcJnqNnxqAf5nRpYD_5r_-4JJRa4mdnkqqZwuvwg4gAmbG

http://www.cnblogs.com/panjun-Donet/archive/2010/08/10/1796873.html

http://www.jb51.net/article/34332.htm

http://blog.sina.com.cn/s/blog_5c4532e50100vhbv.html

相关文章