Centos6.3 下使用 Tomcat-6.0.43 非root用户 jsvc模式部署 生产环境 端口80 vsftp

czhtr

　　一、安装JDK环境
　　官方下载链接
　　http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
　　64位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-x64.tar.gz
　　32位：http://download.oracle.com/otn-pub/java/jdk/7u71-b14/jdk-7u71-linux-i586.tar.gz



# tar -zxvf jdk-7u71-linux-x64.tar.gz //解压
# cp -r jdk-7u71-linux-x64/ /usr/local/jdk7 //拷贝到指定目录
# vi /etc/profile  //编辑系统环境变量配置文件
　　
　　在最后面添加如下配置：



export JAVA_HOME=/usr/local/jdk7
export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export PATH=$PATH:$JAVA_HOME/bin


# source  /etc/profile //启用变量
# java -version //查看java版本


java version "1.7.0_71"
Java(TM) SE Runtime Environment (build 1.7.0_71-b14)
Java HotSpot(TM) 64-Bit Server VM (build 24.71-b01, mixed mode)
　　配置生效，JDK已经安装完毕。
　　
　　二、安装Tomcat
　　下载链接：
　　http://mirrors.cnnic.cn/apache/tomcat/tomcat-6/v6.0.43/bin/apache-tomcat-6.0.43.zip
　　http://apache.fayea.com/tomcat/tomcat-7/v7.0.57/bin/apache-tomcat-7.0.57.zip
　　http://apache.fayea.com/tomcat/tomcat-8/v8.0.15/bin/apache-tomcat-8.0.15.zip
　　1.上传下载好的tomcat包，解压并拷贝到你需要安装的目录下，同时新建软链接指向tomcat目录。



# unzip apache-tomcat-6.0.43.zip
# cp -r  apache-tomcat-6.0.43  /usr/local/tomcat-6.0.43
# ln -s  /usr/local/tomcat-6.0.43 /user/local/tomcat
　　2.新建tomcat用户用于启动tomcat，主要是从安全上考虑，毕竟root用户权限太大，，，



# mkdir /webroot/testapp //新建项目存放目录
# groupadd tomcat  //添加tomcat用户组
# useradd -d /webroot/testapp  -g tomcat tomcat //添加tomcat用户到tomcat用户组，并设定用户home目录为/webroot/testapp
# usermod -s /sbin/nologin //禁止用户远程登录SSH
　　3.编译生成jsvc文件，以服务项启动。



# cd /user/local/tomcat/bin
# tar zxvf commons-daemon-native.tar.gz
# cd commons-daemon-1.0.15-native-src/
# cd unix/
# yum -y install gcc //此时需要联网安装gcc
# ./configure  //编译
# make  //此时会编译并生成一个jsvc
# cp jsvc /usr/local/tomcat/bin/jsvc //拷贝
# ln -s /usr/local/tomcat/bin/daemon.sh /etc/init.d/tomcat6 //创建软链接
# chmod 755 /usr/local/tomcat/bin/daemon.sh //配置可执行权限
# chmod +x /usr/local/tomcat/bin/*.sh  //可能需要配置其他文件的可执行权限
# chown -R tomcat:tomcat /usr/local/tomcat //设置目录权限


# vi /usr/local/tomcat/bin/daemon.sh //设置随机启动必要环境参数
　　编辑文件内容如下：



#!/bin/sh
//加入以下内容
# tomcatd This shell script takes care of starting and stopping
# standalone tomcat
# chkconfig: 345 91 10
# description: tomcat service
# processname: tomcatd
# config file:
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
if [ "${NETWORKING}" = "no" ]; then
echo "Network is stoped! Please open the network!";
exit 0
fi
//加入以上内容

# Licensed to the Apache Software Foundation (ASF) under one or more


# chkconfig tomcat6 on 235  //设置随机启动
　　如果chkconfig命令执行失败，请参考如下链接内容：
　　http://www.iyunv.com/niocai/archive/2012/07/12/2587780.html
　　http://www.iyunv.com/goodspeed/archive/2012/10/18/2729615.html
　　
　　设定JDK路径，大约在95行：



//设定JDK路径
JAVA_HOME=/usr/java/jdk7
if [ -z "$JAVA_HOME" ]; then


# service tomcat6 start  //启动tomcat
　　
　　4.优化tomcat内存设定
　　打开/usr/local/tomcat/bin/daemon.sh 文件，修改内容如下，大约在167左右：



##修复Tomcat容器乱码问题##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"
##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"
# ----- Execute The Requested Command -----------------------------------------
　　JAVA_OPTS="-server -Xms2048m -Xmx2048m -Xss1024k -XX:PermSize=256M -XX:MaxNewSize=1024m -XX:MaxPermSize=1024m -Djava.awt.headless=true"
　　红色字体请根据自己服务器的实际配置酌情增大或减小。
　　
　　daemon.sh完整的配置内容：





#!/bin/sh
# tomcatd This shell script takes care of starting and stopping
# standalone tomcat
# chkconfig: 345 91 10
# description: tomcat service
# processname: tomcatd
# config file:
# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network
# Check that networking is up.
if [ "${NETWORKING}" = "no" ]; then
echo "Network is stoped! Please open the network!";
exit 0
fi
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# -----------------------------------------------------------------------------
# Commons Daemon wrapper script.
# -----------------------------------------------------------------------------
#
# resolve links - $0 may be a softlink
ARG0="$0"
while [ -h "$ARG0" ]; do
ls=`ls -ld "$ARG0"`
link=`expr "$ls" : '.*-> \(.*\)$'`
if expr "$link" : '/.*' > /dev/null; then
ARG0="$link"
else
ARG0="`dirname $ARG0`/$link"
fi
done
DIRNAME="`dirname $ARG0`"
PROGRAM="`basename $ARG0`"
while [ ".$1" != . ]
do
case "$1" in
--java-home )
JAVA_HOME="$2"
shift; shift;
continue
;;
--catalina-home )
CATALINA_HOME="$2"
shift; shift;
continue
;;
--catalina-base )
CATALINA_BASE="$2"
shift; shift;
continue
;;
--catalina-pid )
CATALINA_PID="$2"
shift; shift;
continue
;;
--tomcat-user )
TOMCAT_USER="$2"
shift; shift;
continue
;;
--service-start-wait-time )
SERVICE_START_WAIT_TIME="$2"
shift; shift;
continue
;;
* )
break
;;
esac
done
# OS specific support (must be 'true' or 'false').
cygwin=false;
darwin=false;
case "`uname`" in
CYGWIN*)
cygwin=true
;;
Darwin*)
darwin=true
;;
esac
# Use the maximum available, or set MAX_FD != -1 to use that
test ".$MAX_FD" = . && MAX_FD="maximum"
# Setup parameters for running the jsvc
#
test ".$TOMCAT_USER" = . && TOMCAT_USER=tomcat
# Set JAVA_HOME to working JDK or JRE
# JAVA_HOME=/opt/jdk-1.6.0.22
# If not set we'll try to guess the JAVA_HOME
# from java binary if on the PATH
#
###CHANGE BY PHPDRAGON###
JAVA_HOME=/usr/java/jdk7
###CHANGE BY PHPDRAGON###
if [ -z "$JAVA_HOME" ]; then
JAVA_BIN="`which java 2>/dev/null || type java 2>&1`"
test -x "$JAVA_BIN" && JAVA_HOME="`dirname $JAVA_BIN`"
test ".$JAVA_HOME" != . && JAVA_HOME=`cd "$JAVA_HOME/.." >/dev/null; pwd`
else
JAVA_BIN="$JAVA_HOME/bin/java"
fi
# Only set CATALINA_HOME if not already set
test ".$CATALINA_HOME" = . && CATALINA_HOME=`cd "$DIRNAME/.." >/dev/null; pwd`
test ".$CATALINA_BASE" = . && CATALINA_BASE="$CATALINA_HOME"
test ".$CATALINA_MAIN" = . && CATALINA_MAIN=org.apache.catalina.startup.Bootstrap
test ".$JSVC" = . && JSVC="$CATALINA_BASE/bin/jsvc"
# Set the default service-start wait time if necessary
test ".$SERVICE_START_WAIT_TIME" = . && SERVICE_START_WAIT_TIME=10
# Ensure that any user defined CLASSPATH variables are not used on startup,
# but allow them to be specified in setenv.sh, in rare case when it is needed.
CLASSPATH=
JAVA_OPTS=
if [ -r "$CATALINA_BASE/bin/setenv.sh" ]; then
. "$CATALINA_BASE/bin/setenv.sh"
elif [ -r "$CATALINA_HOME/bin/setenv.sh" ]; then
. "$CATALINA_HOME/bin/setenv.sh"
fi
# Add on extra jar files to CLASSPATH
# tomcat-juli.jar can be over-ridden per instance
test ".$CLASSPATH" != . && CLASSPATH="${CLASSPATH}:"
if [ "$CATALINA_BASE" != "$CATALINA_HOME" ] && [ -r "$CATALINA_BASE/bin/tomcat-juli.jar" ] ; then
CLASSPATH="$CLASSPATH$CATALINA_BASE/bin/tomcat-juli.jar:$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
else
CLASSPATH="$CLASSPATH$CATALINA_HOME/bin/commons-daemon.jar:$CATALINA_HOME/bin/bootstrap.jar"
fi
test ".$CATALINA_OUT" = . && CATALINA_OUT="$CATALINA_BASE/logs/catalina-daemon.out"
test ".$CATALINA_TMP" = . && CATALINA_TMP="$CATALINA_BASE/temp"
# Set juli LogManager config file if it is present and an override has not been issued
if [ -z "$LOGGING_CONFIG" ]; then
if [ -r "$CATALINA_BASE/conf/logging.properties" ]; then
LOGGING_CONFIG="-Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties"
else
# Bugzilla 45585
LOGGING_CONFIG="-Dnop"
fi
fi
test ".$LOGGING_MANAGER" = . && LOGGING_MANAGER="-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager"
JAVA_OPTS="$JAVA_OPTS $LOGGING_MANAGER"
# Set -pidfile
test ".$CATALINA_PID" = . && CATALINA_PID="$CATALINA_BASE/logs/catalina-daemon.pid"
# Increase the maximum file descriptors if we can
if [ "$cygwin" = "false" ]; then
MAX_FD_LIMIT=`ulimit -H -n`
if [ "$?" -eq 0 ]; then
# Darwin does not allow RLIMIT_INFINITY on file soft limit
if [ "$darwin" = "true" -a "$MAX_FD_LIMIT" = "unlimited" ]; then
MAX_FD_LIMIT=`/usr/sbin/sysctl -n kern.maxfilesperproc`
fi
test ".$MAX_FD" = ".maximum" && MAX_FD="$MAX_FD_LIMIT"
ulimit -n $MAX_FD
if [ "$?" -ne 0 ]; then
echo "$PROGRAM: Could not set maximum file descriptor limit: $MAX_FD"
fi
else
echo "$PROGRAM: Could not query system maximum file descriptor limit: $MAX_FD_LIMIT"
fi
fi
###CHANGE BY PHPDRAGON###
##Repair of Tomcat container Garbled problem##
CATALINA_OPTS="$CATALINA_OPTS -Dfile.encoding=UTF-8"
##Tomcat optimization##
JAVA_OPTS="$JAVA_OPTS -server -Xms2560m -Xmx2560m -Xss1280k -XX:PermSize=320M -XX:MaxNewSize=1280m -XX:MaxPermSize=1280m -Djava.awt.headless=true"
###CHANGE BY PHPDRAGON###
# ----- Execute The Requested Command -----------------------------------------
case "$1" in
run     )
shift
"$JSVC" $* \
$JSVC_OPTS \
-java-home "$JAVA_HOME" \
-pidfile "$CATALINA_PID" \
-wait "$SERVICE_START_WAIT_TIME" \
-nodetach \
-outfile "&1" \
-errfile "&2" \
-classpath "$CLASSPATH" \
"$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
-Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
-Dcatalina.base="$CATALINA_BASE" \
-Dcatalina.home="$CATALINA_HOME" \
-Djava.io.tmpdir="$CATALINA_TMP" \
$CATALINA_MAIN
exit $?
;;
start   )
"$JSVC" $JSVC_OPTS \
-java-home "$JAVA_HOME" \
-user $TOMCAT_USER \
-pidfile "$CATALINA_PID" \
-wait "$SERVICE_START_WAIT_TIME" \
-outfile "$CATALINA_OUT" \
-errfile "&1" \
-classpath "$CLASSPATH" \
"$LOGGING_CONFIG" $JAVA_OPTS $CATALINA_OPTS \
-Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
-Dcatalina.base="$CATALINA_BASE" \
-Dcatalina.home="$CATALINA_HOME" \
-Djava.io.tmpdir="$CATALINA_TMP" \
$CATALINA_MAIN
exit $?
;;
stop    )
"$JSVC" $JSVC_OPTS \
-stop \
-pidfile "$CATALINA_PID" \
-classpath "$CLASSPATH" \
-Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
-Dcatalina.base="$CATALINA_BASE" \
-Dcatalina.home="$CATALINA_HOME" \
-Djava.io.tmpdir="$CATALINA_TMP" \
$CATALINA_MAIN
exit $?
;;
version  )
"$JSVC" \
-java-home "$JAVA_HOME" \
-pidfile "$CATALINA_PID" \
-classpath "$CLASSPATH" \
-errfile "&2" \
-version \
-check \
$CATALINA_MAIN
if [ "$?" = 0 ]; then
"$JAVA_BIN" \
-classpath "$CATALINA_HOME/lib/catalina.jar" \
org.apache.catalina.util.ServerInfo
fi
exit $?
;;
*       )
echo "Unknown command: \`$1'"
echo "Usage: $PROGRAM ( commands ... )"
echo "commands:"
echo "  run               Start Tomcat without detaching from console"
echo "  start             Start Tomcat"
echo "  stop              Stop Tomcat"
echo "  version           What version of commons daemon and Tomcat"
echo "                    are you running?"
exit 1
;;
esac
View Code　　
　　三、安装vsftpd



# yum -y install vsftpd


# vi /etc/vsftpd/vsftpd.conf  //编辑配置文件
　　12行 anonymous_enable=YES 改为 NO 静止匿名用户登录
　　允许ascii码上传下载文件
　　81行 ascii_upload_enable=YES  去除 #
　　82行 ascii_download_enable=YES  去除 #
　　将登录后的用户限制在本地家目录下：
　　97行chroot_list_enable=YES 去除 #
99行chroot_list_file=/etc/vsftpd/chroot_list 去除 #
　　121行userlist_enable=YES 修改 为 NO



#echo "tomcat" >> /etc/vsftpd/chroot_list  //将tomcat登录后限制在/webroot/testapp/目录下，该目录在创建tomcat用户时已经指定


#echo "tomcat" >>  /etc/vsftpd/user_list //添加tomcat可登录ftp
　　
　　好了，安全方面，项目使用的是tomcat普通用户运行，禁止了SSH远程登录，同时使用ftp进行代码文件的上传。
　　这么做的初衷是之前的项目使用的80端口转发8080端口，导致程序的任务脚本CURL访问自身报错误[java.lang.Exception: Connection refused],
　　同时使用SecureFXPortable上传脚本导致项目上下文乱码。
　　
　　打算不采用jsvc模式部署的，请参考我的另一篇文章

Centos6.3 下使用 Tomcat-6.0.43 非root用户 部署 生产环境 端口转发方式
　　
　　借鉴：
　　http://www.iyunv.com/Linux/2012-09/70481.htm
　　http://www.iyunv.com/ebs-blog/archive/2010/10/14/2167288.html
　　http://blog.iyunv.com/cnfixit/article/details/7030666
　　http://blog.iyunv.com/wuyigong111/article/details/17410661
　　http://wenku.baidu.com/link?url=yZXEqZFAG4WNVhiAOoh4uHy_eQ5FV3JSiNPRa9zbAZ1Wj3hNS6h2upCv0TgCqAcJnqNnxqAf5nRpYD_5r_-4JJRa4mdnkqqZwuvwg4gAmbG
　　http://www.iyunv.com/panjun-Donet/archive/2010/08/10/1796873.html
　　http://www.iyunv.com/article/34332.htm
　　http://blog.sina.com.cn/s/blog_5c4532e50100vhbv.html