Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're running a (cPanel/WHM based) server which contains mainly PHP applications. They are executed with the permissions of their owner with the suExec component of Apache.

We're looking into moving some of our core applications to Java, running in Tomcat (with Apache proxying), which can apparently be easily installed from within WHM. However, is there a way to preserve the suExec functionality there, so Java applications also get executed with the correct permissions?

share|improve this question
up vote 2 down vote accepted

Tomcat only runs as a single (multi-threaded) process, so there's no way to have apps deployed to the same $CATALINA_BASE run as different users.

You'll have to install separate Tomcat instances (or at least set up separate $CATALINA_BASE directories) if you have to run different webapps under different users.

If you want to run as different users because some applications need specific security permissions, then you might also investigate using a security manager.

share|improve this answer

In all the Tomcat deployments I have done the Tomcat instance runs as user 'tomcat' on a high-number port, such as 8080. Then using a front-end webserver (Apache?), we proxy the incoming connections to the high-number port.

That would allow for non-root Tomcat, and I think it's default in most Linux distros these days.

Or are you looking to run multiple applications inside Tomcat, each as it's own user?

share|improve this answer
To your last question: yes :) – Bart van Heukelom Jun 30 '10 at 10:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.