Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp
一、安装JDK环境
官方下载链接
http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
64位:http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-x64.tar.gz
32位:http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-i586.tar.gz
# tar -zxvf jdk-7u71-linux-x64.tar.gz //解压 # cp -r jdk-7u71-linux-x64/ /usr/local/jdk7 //拷贝到指定目录 # vi /etc/profile/ //编辑系统环境变量配置文件
在最后面添加如下配置:
export JAVA_HOME=/usr/local/jdk7 export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar export PATH=$PATH:$JAVA_HOME/bin
# source /etc/profile //启用变量 # java -version //查看java版本
java version "1.7.0_71" Java(TM) SE Runtime Environment (build 1.7.0_71-b14) Java HotSpot(TM) 64-Bit Server VM (build 24.71-b01, mixed mode)
配置生效,JDK已经安装完毕。
二、安装Tomcat
下载链接:
http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip
http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip
http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15.zip
1.上传下载好的tomcat包,解压并拷贝到你需要安装的目录下,同时新建软链接指向tomcat目录。
# unzip apache-tomcat-6.0.43.zip # cp -r apache-tomcat-6.0.43 /usr/local/tomcat-6.0.43 # ln -s /usr/local/tomcat-6.0.43 /user/local/tomcat
2.新建tomcat用户用于启动tomcat,主要是从安全上考虑,毕竟root用户权限太大,,,
# mkdir /webroot/testapp //新建项目存放目录 # groupadd tomcat //添加tomcat用户组 # useradd -d /webroot/testapp -g tomcat tomcat //添加tomcat用户到tomcat用户组,并设定用户home目录为/webroot/testapp # usermod -s /sbin/nologin //禁止用户远程登录SSH
3.编译生成jsvc文件,以服务项启动。
# cd /user/local/tomcat/bin # tar zxvf commons-daemon-native.tar.gz # cd commons-daemon-1.0.15-native-src/ # cd unix/ # yum -y install gcc //此时需要联网安装gcc # ./configure //编译 # make //此时会编译并生成一个jsvc # cp jsvc /usr/local/tomcat/bin/jsvc //拷贝 # ln -s /usr/local/tomcat/bin/daemon.sh /etc/init.d/tomcat6 //创建软链接 # chmod 755 /usr/local/tomcat/bin/daemon.sh //配置可执行权限 # chmod +x /usr/local/tomcat/bin/*.sh //可能需要配置其他文件的可执行权限
# chown -R tomcat:tomcat /usr/local/tomcat //设置目录权限
# vi /usr/local/tomcat/bin/daemon.sh //设置随机启动必要环境参数
编辑文件内容如下:
#!/bin/sh //加入以下内容 # tomcatd This shell script takes care of starting and stopping # standalone tomcat # chkconfig: 345 91 10 # description: tomcat service # processname: tomcatd # config file: # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. if [ "${NETWORKING}" = "no" ]; then echo "Network is stoped! Please open the network!"; exit 0 fi //加入以上内容 # Licensed to the Apache Software Foundation (ASF) under one or more
# chkconfig tomcat6 on 235 //设置随机启动
如果chkconfig命令执行失败,请参考如下链接内容:
http://www.cnblogs.com/niocai/archive/2012/07/12/2587780.html
http://www.cnblogs.com/goodspeed/archive/2012/10/18/2729615.html
设定JDK路径,大约在95行:
//设定JDK路径 JAVA_HOME=/usr/java/jdk7 if [ -z "$JAVA_HOME" ]; then
# service tomcat6 start //启动tomcat
4.优化tomcat内存设定
打开/usr/local/tomcat/bin/daemon.sh 文件,修改内容如下,大约在167左右:
##修复Tomcat容器乱码问题## CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8" ##Tomcat optimization## JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true" # ----- Execute The Requested Command -----------------------------------------
JAVA_OPTS="-server -Xms2048m -Xmx2048m -Xss1024k -XX:PermSize=256M -XX:MaxNewSize=1024m -XX:MaxPermSize=1024m -Djava.awt.headless=true"
红色字体请根据自己服务器的实际配置酌情增大或减小。
daemon.sh完整的配置内容:
#!/bin/sh # tomcatd This shell script takes care of starting and stopping # standalone tomcat # chkconfig: 345 91 10 # description: tomcat service # processname: tomcatd # config file: # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. if [ "${NETWORKING}" = "no" ]; then echo "Network is stoped! Please open the network!"; exit 0 fi # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to You under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # ----------------------------------------------------------------------------- # Commons Daemon wrapper script. # ----------------------------------------------------------------------------- # # resolve links - $0 may be a softlink ARG0="$0" while [ -h "$ARG0" ]; do ls=`ls -ld "$ARG0"` link=`expr "$ls" : ‘.*-> \(.*\)$‘` if expr "$link" : ‘/.*‘ > /dev/null; then ARG0="$link" else ARG0="`dirname $ARG0`/$link" fi done DIRNAME="`dirname $ARG0`" PROGRAM="`basename $ARG0`" while [ ".$1" != . ] do case "$1" in --java-home ) JAVA_HOME="$2" shift; shift; continue ;; --catalina-home ) CATALINA_HOME="$2" shift; shift; continue ;; --catalina-base ) CATALINA_BASE="$2" shift; shift; continue ;; --catalina-pid ) CATALINA_PID="$2" shift; shift; continue ;; --tomcat-user ) TOMCAT_USER="$2" shift; shift; continue ;; --service-start-wait-time ) SERVICE_START_WAIT_TIME="$2" shift; shift; continue ;; * ) break ;; esac done # OS specific support (must be ‘true‘ or ‘false‘). cygwin=false; darwin=false; case "`uname`" in CYGWIN*) cygwin=true ;; Darwin*) darwin=true ;; esac # Use the maximum available, or set MAX_FD != -1 to use that test ".$MAX_FD" = . && MAX_FD="maximum" # Setup parameters for running the jsvc # test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat # Set JAVA_HOME to working JDK or JRE # JAVA_HOME=/opt/jdk-1.6.0.22 # If not set we‘ll try to guess the JAVA_HOME # from java binary if on the PATH # ###CHANGE BY PHPDRAGON### JAVA_HOME=/usr/java/jdk7 ###CHANGE BY PHPDRAGON### if [ -z "$JAVA_HOME" ]; then JAVA_BIN="`which java 2>/dev/null || type java 2>&1`" test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`" test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd` else JAVA_BIN="$JAVA_HOME/bin/java" fi # Only set CATALINA_HOME if not already set test ".$CATALINA_HOME" = . && CATALINA_HOME=`cd "$DIRNAME/.." >/dev/null; pwd` test ".$CATALINA_BASE" = . && CATALINA_BASE="$CATALINA_HOME" test ".$CATALINA_MAIN" = . && CATALINA_MAIN=org.apache.catalina.startup.Bootstrap test ".$JSVC" = . && JSVC="$CATALINA_BASE/bin/jsvc" # Set the default service-start wait time if necessary test ".$SERVICE_START_WAIT_TIME" = . && SERVICE_START_WAIT_TIME=10 # Ensure that any user defined CLASSPATH variables are not used on startup, # but allow them to be specified in setenv.sh, in rare case when it is needed. CLASSPATH= JAVA_OPTS= if [ -r "$CATALINA_BASE/bin/setenv.sh" ]; then . "$CATALINA_BASE/bin/setenv.sh" elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then . "$CATALINA_HOME/bin/setenv.sh" fi # Add on extra jar files to CLASSPATH # tomcat-juli.jar can be over-ridden per instance test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:" if [ "$CATALINA_BASE" != "$CATALINA_HOME" ] && [ -r "$CATALINA_BASE/bin/tomcat-juli.jar" ] ; then CLASSPATH="$CLASSPATH$CATALINA_BASE/bin/tomcat-juli.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar" else CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar" fi test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out" test ".$CATALINA_TMP" = . && CATALINA_TMP="$CATALINA_BASE/temp" # Set juli LogManager config file if it is present and an override has not been issued if [ -z "$LOGGING_CONFIG" ]; then if [ -r "$CATALINA_BASE/conf/logging.properties" ]; then LOGGING_CONFIG="-Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties" else # Bugzilla 45585 LOGGING_CONFIG="-Dnop" fi fi test ".$LOGGING_MANAGER" = . && LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager" JAVA_OPTS="$JAVA_OPTS $LOGGING_MANAGER" # Set -pidfile test ".$CATALINA_PID" = . && CATALINA_PID="$CATALINA_BASE/logs/catalina-daemon.pid" # Increase the maximum file descriptors if we can if [ "$cygwin" = "false" ]; then MAX_FD_LIMIT=`ulimit -H -n` if [ "$?" -eq 0 ]; then # Darwin does not allow RLIMIT_INFINITY on file soft limit if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc` fi test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT" ulimit -n $MAX_FD if [ "$?" -ne 0 ]; then echo "$PROGRAM: Could not set maximum file descriptor limit: $MAX_FD" fi else echo "$PROGRAM: Could not query system maximum file descriptor limit: $MAX_FD_LIMIT" fi fi ###CHANGE BY PHPDRAGON### ##Repair of Tomcat container Garbled problem## CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8" ##Tomcat optimization## JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true" ###CHANGE BY PHPDRAGON### # ----- Execute The Requested Command ----------------------------------------- case "$1" in run ) shift "$JSVC" $* $JSVC_OPTS -java-home "$JAVA_HOME" -pidfile "$CATALINA_PID" -wait "$SERVICE_START_WAIT_TIME" -nodetach -outfile "&1" -errfile "&2" -classpath "$CLASSPATH" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -Dcatalina.base="$CATALINA_BASE" -Dcatalina.home="$CATALINA_HOME" -Djava.io.tmpdir="$CATALINA_TMP" $CATALINA_MAIN exit $? ;; start ) "$JSVC" $JSVC_OPTS -java-home "$JAVA_HOME" -user $TOMCAT_USER -pidfile "$CATALINA_PID" -wait "$SERVICE_START_WAIT_TIME" -outfile "$CATALINA_OUT" -errfile "&1" -classpath "$CLASSPATH" "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -Dcatalina.base="$CATALINA_BASE" -Dcatalina.home="$CATALINA_HOME" -Djava.io.tmpdir="$CATALINA_TMP" $CATALINA_MAIN exit $? ;; stop ) "$JSVC" $JSVC_OPTS -stop -pidfile "$CATALINA_PID" -classpath "$CLASSPATH" -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -Dcatalina.base="$CATALINA_BASE" -Dcatalina.home="$CATALINA_HOME" -Djava.io.tmpdir="$CATALINA_TMP" $CATALINA_MAIN exit $? ;; version ) "$JSVC" -java-home "$JAVA_HOME" -pidfile "$CATALINA_PID" -classpath "$CLASSPATH" -errfile "&2" -version -check $CATALINA_MAIN if [ "$?" = 0 ]; then "$JAVA_BIN" -classpath "$CATALINA_HOME/lib/catalina.jar" org.apache.catalina.util.ServerInfo fi exit $? ;; * ) echo "Unknown command: \`$1‘" echo "Usage: $PROGRAM ( commands ... )" echo "commands:" echo " run Start Tomcat without detaching from console" echo " start Start Tomcat" echo " stop Stop Tomcat" echo " version What version of commons daemon and Tomcat" echo " are you running?" exit 1 ;; esac
三、安装vsftpd
# yum -y install vsftpd
# vi /etc/vsftpd/vsftpd.conf //编辑配置文件
12行 anonymous_enable=YES 改为 NO 静止匿名用户登录
允许ascii码上传下载文件
81行 ascii_upload_enable=YES 去除 #
82行 ascii_download_enable=YES 去除 #
将登录后的用户限制在本地家目录下:
97行chroot_list_enable=YES 去除 #
99行chroot_list_file=/etc/vsftpd/chroot_list 去除 #
# echo "tomcat" >> /etc/vsftpd/chroot_list //将tomcat登录后限制在/webroot/testapp/目录下,该目录在创建tomcat用户时已经指定
#echo "tomcat" >> /etc/vsftpd/user_list //添加tomcat可登录ftp
好了,安全方面,项目使用的是tomcat普通用户运行,禁止了SSH远程登录,同时使用ftp进行代码文件的上传。
这么做的初衷是之前的项目使用的80端口转发8080端口,导致程序的任务脚本CURL访问自身报错误[java.lang.Exception: Connection refused],
同时使用SecureFXPortable上传脚本导致项目上下文乱码。
打算不采用jsvc模式部署的,请参考我的另一篇文章
Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境 端口转发方式
借鉴:
http://www.linuxidc.com/Linux/2012-09/70481.htm
http://www.cnblogs.com/ebs-blog/archive/2010/10/14/2167288.html
http://blog.csdn.net/cnfixit/article/details/7030666
http://blog.csdn.net/wuyigong111/article/details/17410661
http://wenku.baidu.com/link?url=yZXEqZFAG4WNVhiAOoh4uHy_eQ5FV3JSiNPRa9zbAZ1Wj3hNS6h2upCv0TgCqAcJnqNnxqAf5nRpYD_5r_-4JJRa4mdnkqqZwuvwg4gAmbG
http://www.cnblogs.com/panjun-Donet/archive/2010/08/10/1796873.html
http://www.jb51.net/article/34332.htm
http://blog.sina.com.cn/s/blog_5c4532e50100vhbv.html
郑重声明:本站内容如果来自互联网及其他传播媒体,其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享,并不代表本站赞同其观点和对其真实性负责,也不构成任何其他建议。