Archive for the ‘Tomcat’ Category
Restricting Access to Tomcat via IP Address or Hostname
To restrict access to a standalone Tomcat instance by IP address:
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1"/>
The above will restrict access to the surrounding Engine, Host, or Context element in
If you want to deny access to one or more IP addresses, you would do something like this:
<Valve className="org.apache.catalina.valves.RemoteAddrValve" deny="127.0.0.1"/>
To restrict by host name:
<Valve className="org.apache.catalina.valves.RemoteHostValve" allow="yahoo.com"/>
You use the same allow or deny attributes and the RemoteHostValve class instead of RemoteAddrValve.
Tomcat and Log4J
After battling with several different configurations when it comes to logging and Tomcat 5.5.x, I decided to put together this guide for a simplistic approach. This assumes that you would like to use Log4J for both Tomcat’s internal logging as well as your deployed web application’s logging needs.
For the impatient, here are the steps:
- Place a log4j.properties file which uses the RollingFileAppender in common/classes.
- Add your log4j.jar to the common/lib directory.
- Add commons-logging.jar (1.0.4 or later) and log4j.jar to your application’s WEB-INF/lib directory.
- Add a log4j.properties OR log4j.xml file to your application’s WEB-INF/classes directory.
20 Tips for Using Tomcat in Production
I’ve been working with Apache Tomcat for years and always seem to stumble upon new information related to the proper setup and configuration for a production environment. I’ve decided to put the instructions and tips I’ve collected together in one place.
So here are some helpful hints for running Tomcat in a production environment:
3 Ways to Run a Servlet Container on Port 80 as Non-Root
This is a very brief outline of how to run the Apache Tomcat servlet container on port 80 (the standard web server port) on a Linux operating system. The steps illustrated here are specific to Tomcat but similar steps can be implemented for other servlet containers.
The issue is that the linux kernel has a security precaution built in to the kernel to only allow the root user to bind to a port under 1024. Since it’s a bad idea to run a network server as root, most startup scripts bind to the initial listening socket, then drop down to a non-privileged user. Since Tomcat is written in Java, it does not have the ability to switch users like this.