Linux Apache Tomcat 8信息安全培训.docxVIP

LinuxApacheTomcat8.5安装与配置

生产环境:

Serverversion:ApacheTomcat/8.5.16

\oCentOSCentOS?Linuxrelease7.3.1611(Core)x86-64

1.ApacheTomcat/8.5.16依赖jre7及以上版本，不过jdk高版本已经包含jre，关于jdkjre的安装请查看《LinuxJAVAJDKJRE环境变量安装与配置》

2.创建tomcat专有用户

#groupaddtomcat

#useradd-gtomcat-s/bin/falsetomcat

或

#useradd-gtomcat-s/sbin/nologintomcat

注意：

-gtomcat用户隶属于tomcat组

-s/bin/false禁用shell访问

3.ApacheTomcat8.5下载安装与配置设置用户组权限并创建软连接

#cd/tmp

#wget/tomcat/tomcat-8/v8.5.16/bin/apache-tomcat-8.5.16.tar.gz

#tarzxvfapache-tomcat-8.5.16.tar.gz

#mvapache-tomcat-8.5.16/usr/local/

#cd/usr/local/

#chown-hRtomcat:tomcatapache-tomcat-8.5.16

#ln-sapache-tomcat-8.5.16tomcat

4.添加tomcat自启动systemd服务单元文件

#vim/lib/systemd/system/tomcat.service

[Unit]

Description=ApacheTomcat8

After=syslog.targetnetwork.target

[Service]

Type=forking

User=tomcat

Group=tomcat

Environment=JAVA_HOME=/usr/local/jdk/jre

Environment=CATALINA_PID=/usr/local/tomcat/temp/tomcat.pid

Environment=CATALINA_HOME=/usr/local/tomcat

Environment=CATALINA_BASE=/usr/local/tomcat

Environment=CATALINA_OPTS=-Xms512M-Xmx4096M-server-XX:+UseParallelGC

Environment=CATALINA_OPTS=-Dfile.encoding=UTF-8-server-Xms2048m-Xmx2048m-Xmn1024m-XX:SurvivorRatio=10-XX:MaxTenuringThreshold=15-XX:NewRatio=2-XX:+DisableExplicitGC

Environment=JAVA_OPTS=-Djava.awt.headless=true-Djava.security.egd=file:/dev/./urandom

ExecStart=/usr/local/tomcat/bin/startup.sh

ExecStop=/bin/kill-15$MAINPID

Restart=on-failure

[Install]

WantedBy=multi-user.target

5.重载systemd服务单元，给予软连接目录权限，启动ApacheTomcat服务并设置Tomcat为开机自启动

#systemctldaemon-reload

#cd/usr/local/

#chown-hRtomcat:tomcattomcat

#systemctlstarttomcat

#systemctlenabletomcat

6.配置ApacheTomcat用户实现远程登录

在tomcat-users.xml文件tomcat-users/tomcat-users中间添加；

#vim/usr/local/tomcat/conf/tomcat-users.xml

rolerolename=manager-gui/

userusername=tomcatpassword=s3cretroles=manager-gui/

tomcat8.5之后的版本，已经增强远程登录安全过滤规则，默认不支持远程登录，需要修改配置文件。

修改文件:

/host-manager/META-INF/conte