How to Install Tomcat 9 on Debian 9

Apache Tomcat is an open-source application server that supports Java Servlet, JavaServer Pages, Java Expression Language, and Java WebSocket technologies. It is one of the most widely used applications and web servers in the world today.

This tutorial will show you how to install Apache Tomcat 9.0 on Debian 9 and configure the Tomcat web management interface.

Prerequisites #

Before continuing with this tutorial, make sure you are logged in as a user with sudo privileges .

We will download the Tomcat zip file using wget . If you don’t have wget installed on your system you can do it by typing:

sudo apt install wgetCopy

Installing OpenJDK #

Tomcat 9.0 requires Java SE 8 or later. To install the default OpenJDK package from the Debian 9 repositories run the following command:

sudo apt install default-jdkCopy

Creating a Tomcat user #

Running Tomcat as a root user is a security risk and is not recommended.

Create a new system user and group with a home directory of /opt/tomcat by running the following command:

sudo useradd -m -U -d /opt/tomcat -s /bin/false tomcatCopy

This user will be used to run the Tomcat service.

Downloading Tomcat #

We will download the latest version of Tomcat 9.0.x from the Tomcat downloads page .

At the time of writing, the latest Tomcat version is 9.0.27. Before continuing with the next step, you should check the Tomcat 9 download page to see if a newer version is available.

Change to the /tmp directory and download the zip file with wget:

cd /tmpwget https://www-eu.apache.org/dist/tomcat/tomcat-9/v9.0.27/bin/apache-tomcat-9.0.27.tar.gzCopyCopy

When the download is complete, extract the tar file :

tar -xf apache-tomcat-9.0.27.tar.gzCopy

Move the Tomcat source files to it to the /opt/tomcat directory:

sudo mv apache-tomcat-9.0.27 /opt/tomcat/Copy

Tomcat 9 is updated frequently. To have more control over versions and updates, create a symbolic link called latest, that points to the Tomcat installation directory:

sudo ln -s /opt/tomcat/apache-tomcat-9.0.27 /opt/tomcat/latestCopy

Later, when upgrading the Tomcat version, you can simply unpack the newer version and change the symlink to point to the latest version.

Change the ownership of the /opt/tomcat directory to user and group tomcat so the user can have access to the tomcat installation:

sudo chown -R tomcat: /opt/tomcatCopy

also make the scripts inside bin directory executable :

sudo sh -c 'chmod +x /opt/tomcat/latest/bin/*.sh'Copy

Create a systemd unit file #

Create a new tomcat.service unit file in the /etc/systemd/system/ directory with the following contents:

[Unit]
Description=Tomcat 9.0 servlet container
After=network.target

[Service]
Type=forking

User=tomcat
Group=tomcat

Environment="JAVA_HOME=/usr/lib/jvm/default-java"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"

Environment="CATALINA_BASE=/opt/tomcat/latest"
Environment="CATALINA_HOME=/opt/tomcat/latest"
Environment="CATALINA_PID=/opt/tomcat/latest/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

ExecStart=/opt/tomcat/latest/bin/startup.sh
ExecStop=/opt/tomcat/latest/bin/shutdown.sh

[Install]
WantedBy=multi-user.target

Notify systemd that we created a new unit file and start the Tomcat service by executing:

sudo systemctl daemon-reloadsudo systemctl start tomcatCopyCopy

Check the Tomcat service status by typing:

sudo systemctl status tomcatCopy

● tomcat.service - Tomcat 9 servlet container
   Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2018-12-01 20:47:50 UTC; 4s ago
  Process: 1759 ExecStart=/opt/tomcat/latest/bin/startup.sh (code=exited, status=0/SUCCESS)
 Main PID: 1767 (java)
   CGroup: /system.slice/tomcat.service
Copy

If there are no errors, you can enable the Tomcat service to be automatically started at boot time:

sudo systemctl enable tomcatCopy

You can start, stop and restart Tomcat same as any other systemd unit service:

sudo systemctl start tomcatsudo systemctl stop tomcatsudo systemctl restart tomcatCopyCopyCopy

Adjust the Firewall #

If your firewall running on your Debian system and you want to access the tomcat interface from the outside of your local network you’ll need to open the port 8080:

sudo ufw allow 8080/tcpCopy

Configure Tomcat Web Management Interface #

Now that Tomcat is installed on your Debian server, the next step is to create a user with access to the web management interface.

Tomcat users and their roles are defined in the tomcat-users.xml file.

If you open the file, you will notice that it is filled with comments and examples describing how to configure the file.

sudo vim /opt/tomcat/latest/conf/tomcat-users.xmlCopy

We will define a new user with access to the tomcat web interface (manager-gui and admin-gui) in the tomcat-users.xml file, as shown below. Be sure you change the username and password to something more secure:

<tomcat-users>
<!--
    Comments
-->
   <role rolename="admin-gui"/>
   <role rolename="manager-gui"/>
   <user username="admin" password="admin_password" roles="admin-gui,manager-gui"/>
</tomcat-users>

By default the Tomcat web management interface allows access only from the localhost. If you want to access the web interface from a remote IP or from anywhere which is not recommended because it is a security risk you can open the following files and make the following changes.

If you need to access the web interface from anywhere open the following files and comment or remove the lines highlighted in yellow:

<Context antiResourceLocking="false" privileged="true" >
<!--
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
-->
</Context>

<Context antiResourceLocking="false" privileged="true" >
<!--
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
-->
</Context>

If you need to access the web interface only from a specific IP, instead of commenting the blocks add your public IP to the list. Let’s say your public IP is 32.32.32.32 and you want to allow access only from that IP:

<Context antiResourceLocking="false" privileged="true" >
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1|32.32.32.32" />
</Context>

<Context antiResourceLocking="false" privileged="true" >
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1|32.32.32.32" />
</Context>

The list of allowed IP addresses is a list separated with vertical bar |. You can add single IP addresses or use a regular expressions.

Restart the Tomcat service for changes to take effect:

sudo systemctl restart tomcatCopy

Test the Installation #

Open your browser and type: http://<your_domain_or_IP_address>:8080

If the installation is successful, a screen similar to the following will appear:

Tomcat web application manager dashboard is available at http://<your_domain_or_IP_address>:8080/manager/html. From here, you can deploy, undeploy, start, stop ,and reload your applications.

Tomcat virtual host manager dashboard is available at http://<your_domain_or_IP_address>:8080/host-manager/html. From here, you can create, delete ,and manage Tomcat virtual hosts.

Conclusion #

You have successfully installed Tomcat 9.0 on your Debian 9 system. You can now visit the official Apache Tomcat 9.0 Documentation and learn more about the Apache Tomcat features.

If you hit a problem or have feedback, leave a comment below.