Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was trying to install tomcat 7 on Wheezy

Looking at several guides, I noticed that almost all of them suggest to create a dedicated user.. why?

I am also asking that because I have installed tomcat 7 through the repository and I looked that I have already a user suitable for that, I guess maybe the tomcat installation itself created it

cat /etc/passwd
tomcat7:x:103:106::/usr/share/tomcat7:/bin/false

So my question is, do I need to create an (additional) user for my tomcat?

root@j51391:~# /usr/share/tomcat7/bin/version.sh 
Using CATALINA_BASE:   /usr/share/tomcat7
Using CATALINA_HOME:   /usr/share/tomcat7
Using CATALINA_TMPDIR: /usr/share/tomcat7/temp
Using JRE_HOME:        /usr/lib/jvm/java-7-oracle
Using CLASSPATH:       /usr/share/tomcat7/bin/bootstrap.jar:/usr/share/tomcat7/bin/tomcat-juli.jar
Server version: Apache Tomcat/7.0.28
Server built:   Dec 8 2012 06:51:43
Server number:  7.0.28.0
OS Name:        Linux
OS Version:     3.10.13-x86_64-jb1
Architecture:   amd64
JVM Version:    1.7.0_45-b18
JVM Vendor:     Oracle Corporation
share|improve this question
    
I think you guess correctly, and I think that user will be fine. –  MadHatter Dec 27 '13 at 12:26

1 Answer 1

up vote 2 down vote accepted

It's a good practice to create a dedicated account for some services, specially when they are accessible over the internet or any untrusted network. So if somebody exploits a security flaw in Tomcat it's not going to compromise the whole system. (Unless he manages to escalate privileges, but that's another story)

From the Security Considerations section of Tomcat documentation:

Tomcat should not be run under the root user. Create a dedicated user for the Tomcat process and provide that user with the minimum necessary permissions for the operating system. For example, it should not be possible to log on remotely using the Tomcat user.

In your case, it seems like the package installer has already taken care of creating the dedicated user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.