Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp

一、安装JDK环境

官方下载链接

http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

64位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-x64.tar.gz

32位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-i586.tar.gz

# tar -zxvf jdk-7u71-linux-x64.tar.gz //解压
# cp -r jdk-7u71-linux-x64/ /usr/local/jdk7 //拷贝到指定目录
# vi /etc/profile  //编辑系统环境变量配置文件

 

在最后面添加如下配置：

export JAVA_HOME=/usr/local/jdk7
export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export PATH=$PATH:$JAVA_HOME/bin

# source  /etc/profile //启用变量
# java -version //查看java版本

java version "1.7.0_71"
Java(TM) SE Runtime Environment (build 1.7.0_71-b14)
Java HotSpot(TM) 64-Bit Server VM (build 24.71-b01, mixed mode)

配置生效，JDK已经安装完毕。

 

二、安装Tomcat

下载链接：

http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip

http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip

http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15.zip

1.上传下载好的tomcat包，解压并拷贝到你需要安装的目录下，同时新建软链接指向tomcat目录。

# unzip apache-tomcat-6.0.43.zip
# cp -r  apache-tomcat-6.0.43  /usr/local/tomcat-6.0.43 # ln -s /usr/local/tomcat-6.0.43 /user/local/tomcat

2.新建tomcat用户用于启动tomcat，主要是从安全上考虑，毕竟root用户权限太大，，，

# mkdir /webroot/testapp //新建项目存放目录
# groupadd tomcat  //添加tomcat用户组
# useradd -d /webroot/testapp  -g tomcat tomcat //添加tomcat用户到tomcat用户组，并设定用户home目录为/webroot/testapp
# usermod -s /sbin/nologin //禁止用户远程登录SSH

3.编译生成jsvc文件，以服务项启动。

# cd /user/local/tomcat/bin
# tar zxvf commons-daemon-native.tar.gz
# cd commons-daemon-1.0.15-native-src/
# cd unix/
# yum -y install gcc //此时需要联网安装gcc
# ./configure  //编译
# make  //此时会编译并生成一个jsvc
# cp jsvc /usr/local/tomcat/bin/jsvc //拷贝
# ln -s /usr/local/tomcat/bin/daemon.sh /etc/init.d/tomcat6 //创建软链接
# chmod 755 /usr/local/tomcat/bin/daemon.sh //配置可执行权限
# chmod +x /usr/local/tomcat/bin/*.sh  //可能需要配置其他文件的可执行权限
# chown -R tomcat:tomcat /usr/local/tomcat //设置目录权限

# vi /usr/local/tomcat/bin/daemon.sh //设置随机启动必要环境参数

编辑文件内容如下：

#!/bin/sh

//加入以下内容
# tomcatd This shell script takes care of starting and stopping 
# standalone tomcat 
# chkconfig: 345 91 10 
# description: tomcat service 
# processname: tomcatd 
# config file:
# Source function library. 
. /etc/rc.d/init.d/functions
# Source networking configuration. 
. /etc/sysconfig/network
# Check that networking is up. 
if [ "${NETWORKING}" = "no" ]; then
    echo "Network is stoped! Please open the network!";
    exit 0
fi
//加入以上内容

# Licensed to the Apache Software Foundation (ASF) under one or more

# chkconfig tomcat6 on 235  //设置随机启动

如果chkconfig命令执行失败，请参考如下链接内容：

http://www.cnblogs.com/niocai/archive/2012/07/12/2587780.html

http://www.cnblogs.com/goodspeed/archive/2012/10/18/2729615.html

 

设定JDK路径，大约在95行：

//设定JDK路径
JAVA_HOME=/usr/java/jdk7

if [ -z "$JAVA_HOME" ]; then

# service tomcat6 start  //启动tomcat

 

4.优化tomcat内存设定

打开/usr/local/tomcat/bin/daemon.sh 文件，修改内容如下，大约在167左右：

##修复Tomcat容器乱码问题##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8" ##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"

# ----- Execute The Requested Command -----------------------------------------

JAVA_OPTS="-server -Xms2048m -Xmx2048m -Xss1024k -XX:PermSize=256M -XX:MaxNewSize=1024m -XX:MaxPermSize=1024m -Djava.awt.headless=true"

红色字体请根据自己服务器的实际配置酌情增大或减小。

 

daemon.sh完整的配置内容：

#!/bin/sh

# tomcatd This shell script takes care of starting and stopping 
# standalone tomcat 
# chkconfig: 345 91 10 
# description: tomcat service 
# processname: tomcatd 
# config file:
# Source function library. 
. /etc/rc.d/init.d/functions
# Source networking configuration. 
. /etc/sysconfig/network
# Check that networking is up. 
if [ "${NETWORKING}" = "no" ]; then
    echo "Network is stoped! Please open the network!";
    exit 0
fi

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# -----------------------------------------------------------------------------
# Commons Daemon wrapper script.
# -----------------------------------------------------------------------------
#
# resolve links - $0 may be a softlink
ARG0="$0"
while [ -h "$ARG0" ]; do
  ls=`ls -ld "$ARG0"`
  link=`expr "$ls" : '.*-> \(.*\)$'`
  if expr "$link" : '/.*' > /dev/null; then
    ARG0="$link"
  else
    ARG0="`dirname $ARG0`/$link"
  fi
done
DIRNAME="`dirname $ARG0`"
PROGRAM="`basename $ARG0`"
while [ ".$1" != . ]
do
  case "$1" in
    --java-home )
        JAVA_HOME="$2"
        shift; shift;
        continue
    ;;
    --catalina-home )
        CATALINA_HOME="$2"
        shift; shift;
        continue
    ;;
    --catalina-base )
        CATALINA_BASE="$2"
        shift; shift;
        continue
    ;;
    --catalina-pid )
        CATALINA_PID="$2"
        shift; shift;
        continue
    ;;
    --tomcat-user )
        TOMCAT_USER="$2"
        shift; shift;
        continue
    ;;
    --service-start-wait-time )
        SERVICE_START_WAIT_TIME="$2"
        shift; shift;
        continue
    ;;
    * )
        break
    ;;
  esac
done
# OS specific support (must be 'true' or 'false').
cygwin=false;
darwin=false;
case "`uname`" in
    CYGWIN*)
        cygwin=true
        ;;
    Darwin*)
        darwin=true
        ;;
esac

# Use the maximum available, or set MAX_FD != -1 to use that
test ".$MAX_FD" = . && MAX_FD="maximum"
# Setup parameters for running the jsvc
#
test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat
# Set JAVA_HOME to working JDK or JRE
# JAVA_HOME=/opt/jdk-1.6.0.22
# If not set we'll try to guess the JAVA_HOME
# from java binary if on the PATH
#

###CHANGE BY PHPDRAGON###
JAVA_HOME=/usr/java/jdk7
###CHANGE BY PHPDRAGON###

if [ -z "$JAVA_HOME" ]; then
    JAVA_BIN="`which java 2>/dev/null || type java 2>&1`"
    test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`"
    test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd`
else
    JAVA_BIN="$JAVA_HOME/bin/java"
fi

# Only set CATALINA_HOME if not already set
test ".$CATALINA_HOME" = . && CATALINA_HOME=`cd "$DIRNAME/.." >/dev/null; pwd`
test ".$CATALINA_BASE" = . && CATALINA_BASE="$CATALINA_HOME"
test ".$CATALINA_MAIN" = . && CATALINA_MAIN=org.apache.catalina.startup.Bootstrap
test ".$JSVC" = . && JSVC="$CATALINA_BASE/bin/jsvc"
# Set the default service-start wait time if necessary
test ".$SERVICE_START_WAIT_TIME" = . && SERVICE_START_WAIT_TIME=10

# Ensure that any user defined CLASSPATH variables are not used on startup,
# but allow them to be specified in setenv.sh, in rare case when it is needed.
CLASSPATH=
JAVA_OPTS=
if [ -r "$CATALINA_BASE/bin/setenv.sh" ]; then
  . "$CATALINA_BASE/bin/setenv.sh"
elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then
  . "$CATALINA_HOME/bin/setenv.sh"
fi

# Add on extra jar files to CLASSPATH
# tomcat-juli.jar can be over-ridden per instance
test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:"
if [ "$CATALINA_BASE" != "$CATALINA_HOME" ] && [ -r "$CATALINA_BASE/bin/tomcat-juli.jar" ] ; then
  CLASSPATH="$CLASSPATH$CATALINA_BASE/bin/tomcat-juli.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
else
  CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
fi

test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out"
test ".$CATALINA_TMP" = . && CATALINA_TMP="$CATALINA_BASE/temp"

# Set juli LogManager config file if it is present and an override has not been issued
if [ -z "$LOGGING_CONFIG" ]; then
  if [ -r "$CATALINA_BASE/conf/logging.properties" ]; then
    LOGGING_CONFIG="-Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties"
  else
    # Bugzilla 45585
    LOGGING_CONFIG="-Dnop"
  fi
fi

test ".$LOGGING_MANAGER" = . && LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"
JAVA_OPTS="$JAVA_OPTS $LOGGING_MANAGER"

# Set -pidfile
test ".$CATALINA_PID" = . && CATALINA_PID="$CATALINA_BASE/logs/catalina-daemon.pid"

# Increase the maximum file descriptors if we can
if [ "$cygwin" = "false" ]; then
    MAX_FD_LIMIT=`ulimit -H -n`
    if [ "$?" -eq 0 ]; then
        # Darwin does not allow RLIMIT_INFINITY on file soft limit
        if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then
            MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc`
        fi
        test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT"
        ulimit -n $MAX_FD
        if [ "$?" -ne 0 ]; then
            echo "$PROGRAM: Could not set maximum file descriptor limit: $MAX_FD"
        fi
    else
        echo "$PROGRAM: Could not query system maximum file descriptor limit: $MAX_FD_LIMIT"
    fi
fi

###CHANGE BY PHPDRAGON###
##Repair of Tomcat container Garbled problem##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"
##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"
###CHANGE BY PHPDRAGON###

# ----- Execute The Requested Command -----------------------------------------
case "$1" in
    run     )
      shift
      "$JSVC" $* \
      $JSVC_OPTS \
      -java-home "$JAVA_HOME" \
      -pidfile "$CATALINA_PID" \
      -wait "$SERVICE_START_WAIT_TIME" \
      -nodetach \
      -outfile "&1" \
      -errfile "&2" \
      -classpath "$CLASSPATH" \
      "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
      -Dcatalina.base="$CATALINA_BASE" \
      -Dcatalina.home="$CATALINA_HOME" \
      -Djava.io.tmpdir="$CATALINA_TMP" \
      $CATALINA_MAIN
      exit $?
    ;;
    start   )
      "$JSVC" $JSVC_OPTS \
      -java-home "$JAVA_HOME" \
      -user $TOMCAT_USER \
      -pidfile "$CATALINA_PID" \
      -wait "$SERVICE_START_WAIT_TIME" \
      -outfile "$CATALINA_OUT" \
      -errfile "&1" \
      -classpath "$CLASSPATH" \
      "$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
      -Dcatalina.base="$CATALINA_BASE" \
      -Dcatalina.home="$CATALINA_HOME" \
      -Djava.io.tmpdir="$CATALINA_TMP" \
      $CATALINA_MAIN
      exit $?
    ;;
    stop    )
      "$JSVC" $JSVC_OPTS \
      -stop \
      -pidfile "$CATALINA_PID" \
      -classpath "$CLASSPATH" \
      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
      -Dcatalina.base="$CATALINA_BASE" \
      -Dcatalina.home="$CATALINA_HOME" \
      -Djava.io.tmpdir="$CATALINA_TMP" \
      $CATALINA_MAIN
      exit $?
    ;;
    version  )
      "$JSVC" \
      -java-home "$JAVA_HOME" \
      -pidfile "$CATALINA_PID" \
      -classpath "$CLASSPATH" \
      -errfile "&2" \
      -version \
      -check \
      $CATALINA_MAIN
      if [ "$?" = 0 ]; then
        "$JAVA_BIN" \
        -classpath "$CATALINA_HOME/lib/catalina.jar" \
        org.apache.catalina.util.ServerInfo
      fi
      exit $?
    ;;
    *       )
      echo "Unknown command: \`$1'"
      echo "Usage: $PROGRAM ( commands ... )"
      echo "commands:"
      echo "  run               Start Tomcat without detaching from console"
      echo "  start             Start Tomcat"
      echo "  stop              Stop Tomcat"
      echo "  version           What version of commons daemon and Tomcat"
      echo "                    are you running?"
      exit 1
    ;;
esac

View Code

 

三、安装vsftpd

# yum -y install vsftpd

# vi /etc/vsftpd/vsftpd.conf  //编辑配置文件

12行 anonymous_enable=YES 改为 NO 静止匿名用户登录

允许ascii码上传下载文件

81行 ascii_upload_enable=YES  去除 # 

82行 ascii_download_enable=YES  去除 #

将登录后的用户限制在本地家目录下：

97行chroot_list_enable=YES 去除 # 
99行chroot_list_file=/etc/vsftpd/chroot_list 去除 # 

121行userlist_enable=YES 修改 为 NO

#echo "tomcat" >> /etc/vsftpd/chroot_list  //将tomcat登录后限制在/webroot/testapp/目录下，该目录在创建tomcat用户时已经指定

#echo "tomcat" >>  /etc/vsftpd/user_list //添加tomcat可登录ftp

 

好了，安全方面，项目使用的是tomcat普通用户运行，禁止了SSH远程登录，同时使用ftp进行代码文件的上传。

这么做的初衷是之前的项目使用的80端口转发8080端口，导致程序的任务脚本CURL访问自身报错误[java.lang.Exception: Connection refused],

同时使用SecureFXPortable上传脚本导致项目上下文乱码。

 

打算不采用jsvc模式部署的，请参考我的另一篇文章

Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境 端口转发方式

 

借鉴：

http://www.linuxidc.com/Linux/2012-09/70481.htm

http://www.cnblogs.com/ebs-blog/archive/2010/10/14/2167288.html

http://blog.csdn.net/cnfixit/article/details/7030666

http://blog.csdn.net/wuyigong111/article/details/17410661

http://wenku.baidu.com/link?url=yZXEqZFAG4WNVhiAOoh4uHy_eQ5FV3JSiNPRa9zbAZ1Wj3hNS6h2upCv0TgCqAcJnqNnxqAf5nRpYD_5r_-4JJRa4mdnkqqZwuvwg4gAmbG

http://www.cnblogs.com/panjun-Donet/archive/2010/08/10/1796873.html

http://www.jb51.net/article/34332.htm

http://blog.sina.com.cn/s/blog_5c4532e50100vhbv.html