Tomcat – Start as Non-Root User Following Security Manuals

linuxSecuritytomcatUbuntu

i read the manuals by tomcat apache, where they tell to run tomcat as non-root, but i should give root the ownership and the group tomcat should only have the read permission. Give i the group tomcat only the read permission, how can i start the service as non root ?
Is not that a contradiction ?

Source:

Tomcat should not be run under the root user. Create a dedicated user for the 
Tomcat process and provide that user with the minimum necessary permissions 
for the operating system. For example, it should not be possible to log on 
remotely using the Tomcat user.
aking the Tomcat instances at the ASF as an example (where auto-deployment is 
disabled and web applications are deployed as exploded directories), the 
standard configuration is to have all Tomcat files owned by root with group 
Tomcat and whilst owner has read/write privileges, group only has read and 
world has no permissions. The exceptions are the logs, temp and work 
directory that are owned by the Tomcat user rather than root.

i run the service currently as tomcat with the permission 750 and ownership tomcat:tomcat for the folder /tomcat .

Best Answer

You should make a distinction between two concepts:

  • The credentials of the Tomcat process. This should run as an unprivileged user: user tomcat, group tomcat in your example. This way Tomcat can not perform any operation reserved to user root (cf. capabilities for an incomplete list).
  • The file permissions on Tomcat's files (cf. Unix modes). Most of these files can easily be read-only for the Tomcat process and probably should. This is usually obtained by setting the owner of these files to root (only the owner can change file permissions), the group to tomcat and removing the w permission flag for the group and others.

So inside $CATALINA_BASE:

  • almost all folders should be read-only for Tomcat, especially bin, conf and lib,
  • webapps could be read-write, but it is only necessary during app deployment, afterwards it can be set to read-only,
  • temp and work should be read-write for the Tomcat process (and probably just the Tomcat process).
Related Topic