DEV Community

Cover image for Installing Apache Tomcat on Ubuntu 24.04
Vultr profile image Sanskriti Harmukh
Sanskriti Harmukh for Vultr

Posted on with Aashish Chaurasiya Originally published at docs.vultr.com

Installing Apache Tomcat on Ubuntu 24.04

#tomcat #java #devops #linux

Apache Tomcat is an open-source web server application that lets developers run Java applications in a secure, efficient environment. It implements the Java Servlet and JavaServer Pages (JSP) specifications to deploy and manage Java-based web applications, and it supports load balancing, clustering, and high availability for different workloads. This guide installs Apache Tomcat on Ubuntu 24.04, secures it with a trusted SSL certificate, and deploys a sample Java web application. By the end, you'll have a working Apache Tomcat server running dynamic web applications over HTTPS.

Prerequisites

  • An Ubuntu 24.04 server with a non-root user configured for SSH access with sudo privileges.
  • A domain A record with your DNS provider pointing to the server's IP address (for example, tomcat.example.com).
  • SSH access to the server.
  • The server's package index already updated.

Install Java OpenJDK

Apache Tomcat requires JDK version 17 or later.

1. Install OpenJDK 17:

$ sudo apt install openjdk-17-jdk -y
Enter fullscreen mode Exit fullscreen mode

2. View the installed Java version:

$ java -version
Enter fullscreen mode Exit fullscreen mode

Output:

openjdk version "17.0.13" 2024-10-15
OpenJDK Runtime Environment (build 17.0.13+11-Ubuntu-2ubuntu124.04)
OpenJDK 64-Bit Server VM (build 17.0.13+11-Ubuntu-2ubuntu124.04, mixed mode, sharing)
Enter fullscreen mode Exit fullscreen mode

3. Create a new tomcat group to use with the Apache Tomcat service:

$ sudo groupadd tomcat
Enter fullscreen mode Exit fullscreen mode

4. Create a new tomcat user with /opt/tomcat as the home directory and membership in the tomcat group:

$ sudo useradd -s /bin/false -g tomcat -d /opt/tomcat tomcat
Enter fullscreen mode Exit fullscreen mode

Install Apache Tomcat

Apache Tomcat isn't available in the default Ubuntu package repositories, so download the release archive directly.

1. Visit the Apache Tomcat releases page and download the latest Apache Tomcat 11 release file:

$ wget -O tomcat.tar.gz https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.1/bin/apache-tomcat-11.0.1.tar.gz
Enter fullscreen mode Exit fullscreen mode

This downloads Tomcat release version 11.0.1. Check the releases page for the latest version before downloading.

2. Create a tomcat directory in a system-wide location such as /opt:

$ sudo mkdir /opt/tomcat
Enter fullscreen mode Exit fullscreen mode

3. Extract the downloaded archive into /opt/tomcat:

$ sudo tar -xvzf tomcat.tar.gz -C /opt/tomcat --strip-components=1
Enter fullscreen mode Exit fullscreen mode

The --strip-components=1 option removes the top-level directory in the archive so the contents land directly in /opt/tomcat.

4. Remove the downloaded archive to free up disk space:

$ sudo rm -rf tomcat.tar.gz
Enter fullscreen mode Exit fullscreen mode

5. Grant the tomcat user and group ownership of /opt/tomcat:

$ sudo chown -R tomcat:tomcat /opt/tomcat
Enter fullscreen mode Exit fullscreen mode

6. Grant the tomcat group read privileges to the conf directory:

$ sudo chmod -R g+r /opt/tomcat/conf
Enter fullscreen mode Exit fullscreen mode

7. Grant the tomcat group execute permissions on the /opt/tomcat/conf directory:

$ sudo chmod g+x /opt/tomcat/conf
Enter fullscreen mode Exit fullscreen mode

Create Apache Tomcat Users

Apache Tomcat requires dedicated accounts with administrative privileges to access the manager and host-manager web applications.

1. Open the tomcat-users.xml configuration file:

$ sudo nano /opt/tomcat/conf/tomcat-users.xml
Enter fullscreen mode Exit fullscreen mode

2. Add the following above the </tomcat-users> directive. Replace manager_password and admin_password with your own values:

<role rolename="manager-gui" />
<user username="manager" password="manager_password" roles="manager-gui" />

<role rolename="admin-gui" />
<user username="admin" password="admin_password" roles="manager-gui,admin-gui" />
Enter fullscreen mode Exit fullscreen mode

Save and close the file. This creates a manager user and an admin user with manager and administrator privileges respectively for the Tomcat web management dashboard.

3. Open the manager context.xml file to remove restrictions on the manager application:

$ sudo nano /opt/tomcat/webapps/manager/META-INF/context.xml
Enter fullscreen mode Exit fullscreen mode

4. Comment out the following Valve directive:

<!--  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> -->
Enter fullscreen mode Exit fullscreen mode

Save and close the file.

5. Open the host-manager context.xml file to remove restrictions on the host-manager application:

$ sudo nano /opt/tomcat/webapps/host-manager/META-INF/context.xml
Enter fullscreen mode Exit fullscreen mode

6. Comment out the same Valve directive:

<!--  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />  -->
Enter fullscreen mode Exit fullscreen mode

Save and close the file.

Set Up Apache Tomcat as a System Service

1. View and note the Java installation path:

$ sudo update-java-alternatives -l
Enter fullscreen mode Exit fullscreen mode

Output:

java-1.17.0-openjdk-amd64      1711       /usr/lib/jvm/java-1.17.0-openjdk-amd64
Enter fullscreen mode Exit fullscreen mode

2. Create a new tomcat.service system service file:

$ sudo nano /etc/systemd/system/tomcat.service
Enter fullscreen mode Exit fullscreen mode

3. Add the following configuration. Modify JAVA_HOME if your Java installation path differs:

[Unit]
Description=Tomcat
After=network.target

[Service]
Type=forking

User=tomcat
Group=tomcat

Environment="JAVA_HOME=/usr/lib/jvm/java-1.17.0-openjdk-amd64"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"
Environment="CATALINA_BASE=/opt/tomcat"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh

RestartSec=10
Restart=always

[Install]
WantedBy=multi-user.target
Enter fullscreen mode Exit fullscreen mode

Save and close the file. This service runs the startup.sh and shutdown.sh scripts in the Tomcat installation directory to manage the application's processes.

4. Reload the systemd daemon:

$ sudo systemctl daemon-reload
Enter fullscreen mode Exit fullscreen mode

5. Enable the Apache Tomcat service to start at boot:

$ sudo systemctl enable tomcat
Enter fullscreen mode Exit fullscreen mode

6. Start the Apache Tomcat service:

$ sudo systemctl start tomcat
Enter fullscreen mode Exit fullscreen mode

7. View the Apache Tomcat service status and verify that it's running:

$ sudo systemctl status tomcat
Enter fullscreen mode Exit fullscreen mode

Output:

● tomcat.service - Tomcat
     Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; preset: enabled)
     Active: active (running) since Thu 2024-12-05 12:12:25 UTC; 6s ago
    Process: 12213 ExecStart=/opt/tomcat/bin/startup.sh (code=exited, status=0/SUCCESS)
   Main PID: 12220 (java)
      Tasks: 31 (limit: 2269)
     Memory: 112.5M (peak: 115.7M)
        CPU: 2.430s
     CGroup: /system.slice/tomcat.service
             └─12220 /usr/lib/jvm/java-1.17.0-openjdk-amd64/bin/java -Djava.util.logging.config.file=/opt/tomcat/conf/logging.proper>
Enter fullscreen mode Exit fullscreen mode

Secure Apache Tomcat with Trusted SSL Certificates

Apache Tomcat listens on the insecure HTTP port 8080 and the HTTPS port 8443. Use Let's Encrypt certificates via Certbot to enable secure connections.

1. View the UFW status and verify that the firewall is active:

$ sudo ufw status
Enter fullscreen mode Exit fullscreen mode

If the status is inactive, allow the SSH port 22 and enable UFW:

$ sudo ufw allow 22 && sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

2. Allow HTTP connections through the firewall:

$ sudo ufw allow http
Enter fullscreen mode Exit fullscreen mode

3. Reload UFW to apply the changes:

$ sudo ufw reload
Enter fullscreen mode Exit fullscreen mode

4. Install the Snapd package:

$ sudo apt install snapd -y
Enter fullscreen mode Exit fullscreen mode

5. Install the Certbot Let's Encrypt client using Snap:

$ sudo snap install --classic certbot
Enter fullscreen mode Exit fullscreen mode

6. Generate a new SSL certificate for Apache Tomcat. Replace tomcat.example.com and admin@example.com with your actual details:

$ sudo certbot certonly --standalone -d tomcat.example.com -m admin@example.com --agree-tos
Enter fullscreen mode Exit fullscreen mode

Your output should be similar to the following when successful:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for tomcat.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/tomcat.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/tomcat.example.com/privkey.pem
This certificate expires on 2025-02-27.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Enter fullscreen mode Exit fullscreen mode

7. Copy the Let's Encrypt certificate files to the Tomcat configuration directory. Replace tomcat.example.com with your actual domain:

$ sudo bash -c 'cp /etc/letsencrypt/live/tomcat.example.com/*.pem /opt/tomcat/conf/'
Enter fullscreen mode Exit fullscreen mode

8. Grant the Tomcat user and group ownership of the .pem certificate files:

$ sudo bash -c 'chown -R tomcat:tomcat /opt/tomcat/conf/*.pem'
Enter fullscreen mode Exit fullscreen mode

9. Allow the Tomcat HTTP port 8080 and HTTPS port 8443 through the firewall:

$ sudo ufw allow 8080,8443/tcp
Enter fullscreen mode Exit fullscreen mode

10. Reload UFW to apply the changes:

$ sudo ufw reload
Enter fullscreen mode Exit fullscreen mode

11. View the UFW status and verify the firewall rules:

$ sudo ufw status
Enter fullscreen mode Exit fullscreen mode

Output:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
8080/tcp                   ALLOW       Anywhere
8443/tcp                   ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
8080/tcp                   ALLOW       Anywhere (v6)
8443/tcp (v6)              ALLOW       Anywhere (v6)
Enter fullscreen mode Exit fullscreen mode

12. Open the server.xml file to enable the SSL files in the Tomcat configuration:

$ sudo nano /opt/tomcat/conf/server.xml
Enter fullscreen mode Exit fullscreen mode

13. Add the following before the <Connector section to load your SSL certificate files:

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true">
        <SSLHostConfig>
            <Certificate certificateFile="conf/cert.pem"
                 certificateKeyFile="conf/privkey.pem"
                 certificateChainFile="conf/chain.pem" />
        </SSLHostConfig>
    </Connector>
Enter fullscreen mode Exit fullscreen mode

Save and close the file. This lets Apache Tomcat accept HTTPS connections on port 8443 using the .pem certificate files in /opt/tomcat/conf.

14. Restart the Apache Tomcat service:

$ sudo systemctl restart tomcat
Enter fullscreen mode Exit fullscreen mode

Access the Apache Tomcat Web Management Dashboard

1. Visit your Apache Tomcat domain on port 8443 in a web browser:

https://tomcat.example.com:8443
Enter fullscreen mode Exit fullscreen mode

Verify that the default Apache Tomcat page displays.

2. Click Manager App to access the manager application, and sign in with your manager username and password.

3. Verify that the manager application loads correctly.

4. Click Host Manager to access the host-manager interface, and log in with your administrator credentials.

Create a Java Web Application to Run on Apache Tomcat

Create a sample Java web application with the following structure:

/home/linuxuser/example-app/
    ├── WEB-INF/
    │   ├── web.xml
    │   └── classes/
    │       └── GreetingsServlet.class
Enter fullscreen mode Exit fullscreen mode

1. Create the project directory:

$ mkdir example-app
Enter fullscreen mode Exit fullscreen mode

2. Switch to the example-app directory:

$ cd example-app
Enter fullscreen mode Exit fullscreen mode

3. Create a WEB-INF subdirectory:

$ mkdir WEB-INF
Enter fullscreen mode Exit fullscreen mode

4. Create a classes subdirectory inside WEB-INF:

$ mkdir WEB-INF/classes
Enter fullscreen mode Exit fullscreen mode

5. Create a new GreetingsServlet.java file:

$ nano GreetingsServlet.java
Enter fullscreen mode Exit fullscreen mode

6. Add the following contents:

import jakarta.servlet.*;
import jakarta.servlet.http.*;
import java.io.IOException;

public class GreetingsServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
        response.setContentType("text/html");
        response.getWriter().println("<h1 align='center'>Hello, World!</h1>");
    }
}
Enter fullscreen mode Exit fullscreen mode

Save and close the file. This creates a GreetingsServlet that extends HttpServlet and displays a Hello, World! message when it runs.

7. Create a new web.xml file in the WEB-INF directory:

$ nano WEB-INF/web.xml
Enter fullscreen mode Exit fullscreen mode

8. Add the following contents:

<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
         version="5.0">

    <servlet>
        <servlet-name>GreetingsServlet</servlet-name>
        <servlet-class>GreetingsServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>GreetingsServlet</servlet-name>
        <url-pattern>/helloworld</url-pattern>
    </servlet-mapping>
</web-app>
Enter fullscreen mode Exit fullscreen mode

Save and close the file. This maps the GreetingsServlet to the /helloworld URL pattern so Tomcat serves the example-app application at that path.

9. Compile the servlet using the Tomcat servlet-api.jar library:

$ sudo javac -cp /opt/tomcat/lib/servlet-api.jar -d . GreetingsServlet.java
Enter fullscreen mode Exit fullscreen mode

10. Move the compiled class file into WEB-INF/classes:

$ mv GreetingsServlet.class WEB-INF/classes/
Enter fullscreen mode Exit fullscreen mode

11. List files in the classes subdirectory to confirm the class file is present:

$ ls WEB-INF/classes
Enter fullscreen mode Exit fullscreen mode

Output:

GreetingsServerlet.class
Enter fullscreen mode Exit fullscreen mode

12. Switch to the parent directory:

$ cd ..
Enter fullscreen mode Exit fullscreen mode

13. Move the example-app project into the Tomcat webapps directory to deploy it:

$ sudo mv example-app /opt/tomcat/webapps/example-app
Enter fullscreen mode Exit fullscreen mode

14. Restart Apache Tomcat to apply the changes:

$ sudo systemctl restart tomcat
Enter fullscreen mode Exit fullscreen mode

15. Open the Tomcat web management interface and click Manager App to view all deployed web applications:

https://tomcat.example.com:8443
Enter fullscreen mode Exit fullscreen mode

16. Verify that example-app appears in the list of applications.

17. Visit the /example-app/helloworld path to verify the application runs correctly:

https://tomcat.example.com:8443/example-app/helloworld
Enter fullscreen mode Exit fullscreen mode

Next Steps

Apache Tomcat is installed, secured with a trusted SSL certificate, and running a sample Java web application. From here you can:

  • Deploy your own WAR files through the Tomcat manager application
  • Tune CATALINA_OPTS JVM memory settings for your workload
  • Set up log rotation and monitoring for the Tomcat service
  • Automate the Let's Encrypt certificate renewal and Tomcat restart with a cron job or systemd timer

For the full guide with additional tips, visit the original article on Vultr Docs.

Top comments (0)