Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

tl;dr - I have a rooted linux box that I want to run tomcat on as a server (No Apache Web Server) how would you set this up avoiding common security pitfalls?

I've written a Grails App that I want to run on a VPS I rent. The VPS has very little memory and I am using it for the sole purpose of running this application so I don't need the apache web server.

This is my first venture into Server administration and I'm sure to fall into some well known traps.

  • Should I use iptables to redirect requests from port 80 to 8080?
  • Should I run tomcat as root or as its own user?
  • What configuration settings would be good for a low memory system expecting less than 10 concurrent users?

Hopefully an easy one for you! Anyone who could link to a tutorial would be a personal hero destined for great things no doubt.


share|improve this question
What do you mean by "rooted linux box"? Why did you put "too long; didn't read" on your own question? – Dennis Williamson Mar 28 '10 at 22:22
"rooted linux box" - linux box for which I have root access. tl;dr - I got used to seeing/adding these on reddit, it's for those of you with short attention spans, you can understand what it is that I want to know quickly without reading my life story. – gav Mar 29 '10 at 7:42
up vote 2 down vote accepted

Run tomcat as the tomcat user. I don't think you should ever run tomcat as root. It exposes the potential for a larger security risk than running it as an unprivileged user.

Tomcat's HTTP serving is a bit lacking for some stuff, so i'd always suggest that you have a http server as a frontend. If you don't want apache, there's always Nginx. This is especially true if you wanted HTTP Basic or Digest auth.

I'd suggest that you start off with tomcat's default memory settings, then tune them as and when you need to. With no knowledge of the app's memory profile, it's difficult to give you any hard and fast figures.

If you're using Ubuntu on your vps, you can just apt-get install tomcat6 and it should work out of the "box". Even on Centos5.4, the tomcat5 package from yum works with minimal config changes.

I seriously advise that you use a lightweight server in front of your tomcat instance though. This gives you better granular control over security than Tomcat's "Security Manager"

I have Tomcat6 running on a Virtual Machine which runs my hudson CI server, I think i've given it about 256MB of RAM, and it's perfectly happy.

share|improve this answer
I ended up using iptables and running tomcat with a dedicated non-root user. – gav Mar 30 '10 at 12:21
That's an infinitely better option than running tomcat as root. – Tom O'Connor Mar 30 '10 at 13:17

Even if you do not have enough space to run a full-fledge web-server in front of Tomcat, you can consider running a reverse-proxy like pound. At the very least, it can quickly stop random connections to your server if configured correctly. Just point pound to the internal port 8080 that Tomcat listens on.

share|improve this answer
pound, nginx, lightttpd, varnish, even Ugh. Squid might do. – Tom O'Connor Mar 30 '10 at 13:17
true, there are lots to use. i suggested pound because it is simple to use. – sybreon Mar 31 '10 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.