Am 08.10.26 um 15:47 schrieb Christoph Kukulies via users:
A (hopefully) last question: previously I had my tomcat ROOT app in /var/lib/tomcat9/webapps/ROOT. Could I leave it there and symlink it to /opt/tomcat/webapps/ROOT? Would it be dangerous to rename the original /ope/tomcat/webapps/ROOT /opt/tomcat/webapps/ROOT.sometingelse ? Or should I move it totally out of the way?
Peter has already given you a good answer. I'll add my personal tweak and background story for it, and further down an answer to your previous post.
Follow Peter's advice to separate CATALINA_BASE and CATALINA_HOME as documented in RUNNING.txt
Personally, I wouldn't mix the methods and locations between the self-hosted and distro-provided variants just because they used to live there, unless you have good reasons to (established backup/restore procedures might be among them - but they'll need to be tested anyway after this change. Remember to test restore, which is more important than backup)
Am 08.10.2026 um 15:39 schrieb Christoph Kukulies <[email protected]>: OK, fixed it. Did the chown -R tomcat:tomcat /opt/apache-tomcat-9.0.122 Somewhere I read (maybe AI? :) that it would be an idea to have /opt/apache-tomcat-9.0.122 symlinked to /opt/tomcat. I did that but still got an error that the PID file couldn't be crated on catalina startup (/opt/tomcat9/temp not found). Then I additionally symlinked /opt/tomcat9 -> /opt/tomcat and that worked. I'm seeing the backend through my haproxy frontend now (which still is the Apache Tomcat/9.0.122 greeting page.)
The tomcat tree _does not_ need to be owned by tomcat, but needs to be accessible. In fact, it's safer if it isn't:
Tomcat only needs write access to a few directories, among them _temp_, _log_ and _work_ (but they don't need to be directly in the bundle - see CATALINA_HOME/BASE separation).
All other directories (unless I missed one) can be write-protected, e.g. by belonging to root or any other user, but allowing read (and potentially execute, for _bin/*.sh_). Reason: If there's any RCE vulnerability, or anything that allows attackers to upload code, they shouldn't be able to upload the code to places where it's actually executed server-side - e.g. in your _tomcat/bin_ folder, or in _webapps_.
If and only if you use the manager app to deploy updates, the webapps directory also is written to by tomcat itself, which will also open you potentially to such persistent RCE attempts. Note that these are typically not tomcat's vulnerabilities, but those of individual webapps that might allow arbitrary uploads, or their dependencies: Remember the log4j issue? Those!
Best, Olaf --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
