1

I was trying to install tomcat 7 on Wheezy

Looking at several guides, I noticed that almost all of them suggest to create a dedicated user.. why?

I am also asking that because I have installed tomcat 7 through the repository and I looked that I have already a user suitable for that, I guess maybe the tomcat installation itself created it

cat /etc/passwd
tomcat7:x:103:106::/usr/share/tomcat7:/bin/false

So my question is, do I need to create an (additional) user for my tomcat?

root@j51391:~# /usr/share/tomcat7/bin/version.sh 
Using CATALINA_BASE:   /usr/share/tomcat7
Using CATALINA_HOME:   /usr/share/tomcat7
Using CATALINA_TMPDIR: /usr/share/tomcat7/temp
Using JRE_HOME:        /usr/lib/jvm/java-7-oracle
Using CLASSPATH:       /usr/share/tomcat7/bin/bootstrap.jar:/usr/share/tomcat7/bin/tomcat-juli.jar
Server version: Apache Tomcat/7.0.28
Server built:   Dec 8 2012 06:51:43
Server number:  7.0.28.0
OS Name:        Linux
OS Version:     3.10.13-x86_64-jb1
Architecture:   amd64
JVM Version:    1.7.0_45-b18
JVM Vendor:     Oracle Corporation
1
  • I think you guess correctly, and I think that user will be fine.
    – MadHatter
    Dec 27, 2013 at 12:26

1 Answer 1

2

It's a good practice to create a dedicated account for some services, specially when they are accessible over the internet or any untrusted network. So if somebody exploits a security flaw in Tomcat it's not going to compromise the whole system. (Unless he manages to escalate privileges, but that's another story)

From the Security Considerations section of Tomcat documentation:

Tomcat should not be run under the root user. Create a dedicated user for the Tomcat process and provide that user with the minimum necessary permissions for the operating system. For example, it should not be possible to log on remotely using the Tomcat user.

In your case, it seems like the package installer has already taken care of creating the dedicated user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .