Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it a good idea to run tomcat (tcServer from spring source) directly on port 80 (or 443) as root

One could use mod_proxy or mod_jk from apache2 to work around it. I have also seen iptables based solution (ie iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080)

Are there any pros/cons which one should know when it comes to production use?

share|improve this question
up vote 3 down vote accepted

you most definitely don't want to run your web application as root! never-ever!!

make it as secure as possible, - it will be hacked, it's just a matter of time (and popularity :) )

run tomcat as another user ('tomcat' or such) that can only read/write (if required) to it's own dir.

as for port redirection, I'd recommend using iptables, just as you showed.

alternatively you can do apache redirect as described here.

if you have a larger site and use hardware loadbalancers, you might map port 80 on the VIP to port 8080 on your web servers, in which case you don't have to do anything on the server side, and tbh, this is the best approach.

share|improve this answer

As pulegium stated, do never ever run your webserver (which Tomcat will be if you use the HTTP connector as root! Instead, deactiveta HTTp for Tomcat (see server.xml) and use the AJP/1.3 connector with apache2 mod_proxy_ajp (or lighttpd which also offers a AJP proxy). This would be the recoomended setup for a production environment. Plus it offers you the benefits of mod_proxy_balancer and all the other apache stuff (or lighttpd).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.