tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brett Delle Grazie <brett.dellegra...@gmail.com>
Subject Re: tomcat 7 with APR connector on ubuntu
Date Thu, 16 Jan 2014 23:21:21 GMT
Mubeen,


On 16 January 2014 08:53, Mubeen Shah <mubeenshah@gmail.com> wrote:

> Thank you Brett for your comments.
>
> You're welcome.
However as per list convention, please do not top post (
http://tomcat.apache.org/lists.html)


> Here is tomcat startup script (/etc/init.d/tomcat7)
>
> #!/bin/bash
> # tomcat start/stop script
>
> export JAVA_HOME=/usr/lib/jvm/java-7-oracle
> export CATALINA_HOME=/opt/tomcat7
>
> start() {
>    su tomcat7 -s /bin/sh -c $CATALINA_HOME/bin/startup.sh
> }
>
> stop() {
>    su tomcat7 -s /bin/sh -c $CATALINA_HOME/bin/shutdown.sh
> }
>
> case $1 in
>   start|stop) $1;;
>   restart) stop; start;;
>   *) echo "Run as $0 <start|stop|restart>"; exit 1;;
> esac
>
> I made slight change in "startup.sh" file too (replaced old exec line):
> exec authbind --deep "$PRGDIR"/"$EXECUTABLE" start "$@"
>

Which version of authbind is being used?

What does your <connector> element in server.xml look like?
Are there any other <connector> elements in server.xml?


>
> my setenv.sh file:
> CATALINA_OPTS="-Djava.awt.headless=true -Djava.net.preferIPv4Stack=true
> -Xmx512m -XX:+UseConcMarkSweepGC"
> export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/usr/local/apr/lib"
>

You might need to add -Djava.library.path=/usr/local/apr/lib into
CATALINA_OPTS as well
I take it you compiled libtcnative locally?



>
> I installed authbind previously and executed following lines:
> sudo touch /etc/authbind/byport/80
> sudo chmod 500 /etc/authbind/byport/80
> sudo chown tomcat7 /etc/authbind/byport/80


> When I am removing APR connector from server.xml, tomcat working fine with
> tomcat7 user.
>

Leaving the authbind call in place, can you test with your APR connector at
port > 1024 (e.g. the default 8080).
Does Tomcat start? If not, what is the error?


>
> Regards,
> Mubeen
>
> On Thu, Jan 16, 2014 at 5:41 AM, Brett Delle Grazie <
> brett.dellegrazie@gmail.com> wrote:
>
> > Hi,
> >
> > See interleaved.
> >
> >
> > On 15 January 2014 16:53, Mubeen Shah <mubeenshah@gmail.com> wrote:
> >
> > > Hello,
> > >
> > > I am trying to configure tomcat 7 on ubuntu machine and wanted to run
> it
> > as
> > > non-root on port 80, Here is what I did so far:
> > >
> > > OS (Ubuntu 12.04 LTS):
> > >
> > > - installed oracle JDK 1.7.0_45 using "apt-get"
> > > - downloaded and extracted tomcat 7.0.50 (.gz format)
> > > - created ubuntu user 'tomcat' and granted 'chown -R CATALINA_HOME' to
> > this
> > > user
> > > - changed tomcat default port to 80 in server.xml
> > > - installed and configured authbind tool
> > > - created sh script "/etc/init.d/tomcat7" to start tomcat as tomcat
> user.
> > >
> >
> > What was in this script?
> >
> >
> > > - tomcat 7 was working as expected on 80 port as non-root user.
> > >
> >
> > That is surprising, see further below.
> >
> >
> > > - later I configured APR 1.5.0 and tried to run tomcat again, I got
> this
> > > error:
> > >
> > > Jan 15, 2014 6:24:45 AM org.apache.catalina.core.AprLifecycleListener
> > init
> > > INFO: Loaded APR based Apache Tomcat Native library 1.1.29 using APR
> > > version 1.5.0.
> > > Jan 15, 2014 6:24:45 AM org.apache.catalina.core.AprLifecycleListener
> > init
> > > INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters
> > > [false], random [true].
> > > Jan 15, 2014 6:24:46 AM org.apache.catalina.core.AprLifecycleListener
> > > initializeSSL
> > > INFO: OpenSSL successfully initialized (OpenSSL 1.0.1 14 Mar 2012)
> > > Jan 15, 2014 6:24:46 AM org.apache.coyote.AbstractProtocol init
> > > INFO: Initializing ProtocolHandler ["http-apr-80"]
> > > Jan 15, 2014 6:24:46 AM org.apache.coyote.AbstractProtocol init
> > > SEVERE: Failed to initialize end point associated with ProtocolHandler
> > > ["http-apr-80"]
> > > java.lang.Exception: Socket bind failed: [13] Permission denied
> > >     at
> org.apache.tomcat.util.net.AprEndpoint.bind(AprEndpoint.java:430)
> > >     at
> > >
> >
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:640)
> > >     at
> org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:434)
> > >     at
> > >
> org.apache.catalina.connector.Connector.initInternal(Connector.java:981)
> > >     at
> > org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > >     at
> > >
> >
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
> > >     at
> > org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > >     at
> > >
> >
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:814)
> > >     at
> > org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > >     at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
> > >     at org.apache.catalina.startup.Catalina.load(Catalina.java:664)
> > >     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > >     at
> > >
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> > >     at
> > >
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> > >     at java.lang.reflect.Method.invoke(Method.java:606)
> > >     at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
> > >     at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:455)
> > >
> >
> > This is expected.
> >
> >
> > >
> > > If I am removing out this line from server.xml:
> > > <Listener className="org.apache.catalina.core.AprLifecycleListener"
> > > SSLEngine="on" />
> > >
> > > Tomcat working on 80 port as non-root user and starting "http-bio-80"
> > > properly.
> > >
> > > Another thing is if I am trying to run tomcat as "root" along with APR
> > > support, its working just fine.
> > >
> > > Any advise why its working on "http-bio-80" while throwing bind
> exception
> > > on "http-apr-80"??
> > >
> >
> > Linux will not allow anything but root to bind on ports < 1024.
> > Usually the process starts as root, binds to the port and then drops it's
> > privileges back to the desired user.
> > You'll need to use jsvc to start Tomcat and drop privileges. It is simply
> > apache commons daemon and you should use version 1.0.15 or higher, I'm
> not
> > sure what version is in 12.04 LTS so you may need to compile it.
> >
> > Some documentation is here:
> > http://tomcat.apache.org/tomcat-7.0-doc/setup.html
> > http://commons.apache.org/proper/commons-daemon/jsvc.html
> >
> > There are a couple of other options described here:
> >
> >
> http://wiki.apache.org/tomcat/HowTo#How_to_run_Tomcat_without_root_privileges.3F
> >
> > But the best one is commons daemon / jsvc.
> >
> >
> > > Regards,
> > > Mubeen
> > >
> >
> >
> > --
> > Kind regards,
> >
> > Brett
> >
>

-- 
Kind regards,

Brett

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message