Linux从入门到放弃 tomcat安全优化降权启动

1. 添加用户 tomcat
2. 修改 tomcat 所有者
3. 通过普通用户管理

#	1. 添加用户  tomcat 
[root@7 tomcat]# useradd tomcat

#	2. 修改 tomcat 所有者 
[root@7 app]# chown tomcat. /app/tomcat/ -R

[root@7 app]# ll
total 0
drwxr-xr-x 9 tomcat tomcat 220 Feb  7 10:27 apache-tomcat-8.5.50
lrwxrwxrwx 1 root   root    13 Feb  7 10:27 jdk -> jdk1.8.0_241/
drwxr-xr-x 7  10143  10143 245 Dec 11 18:39 jdk1.8.0_241
drwxr-x--- 2 root   root    24 Feb 10 10:42 logs
lrwxrwxrwx 1 root   root    20 Feb  7 10:27 tomcat -> apache-tomcat-8.5.50
drwxr-xr-x 2 root   root    93 Feb  7 12:20 tools

#	3. 通过普通用户管理
[root@7 app]# su - tomcat

[tomcat@7 ~]$ /app/tomcat/bin/shutdown.sh 

[tomcat@7 ~]$ ss -lntp | grep java

[tomcat@7 ~]$ /app/tomcat/bin/startup.sh 
Using CATALINA_BASE:   /app/tomcat
Using CATALINA_HOME:   /app/tomcat
Using CATALINA_TMPDIR: /app/tomcat/temp
Using JRE_HOME:        /app/jdk
Using CLASSPATH:       /app/tomcat/bin/bootstrap.jar:/app/tomcat/bin/tomcat-juli.jar
Tomcat started.

[tomcat@7 ~]$ ss -lntp | grep java
LISTEN   0         50                  0.0.0.0:12345            0.0.0.0:*        users:(("jav",pid=4248,fd=21))                                                
LISTEN   0         50                  0.0.0.0:40417            0.0.0.0:*        users:(("jav",pid=4248,fd=22))                                                
LISTEN   0         100                 0.0.0.0:8080             0.0.0.0:*        users:(("jav",pid=4248,fd=58))                                                
LISTEN   0         50                  0.0.0.0:34417            0.0.0.0:*        users:(("jav",pid=4248,fd=20))                                                

[tomcat@7 ~]$ ps aux | grep java
tomcat    4248 24.6 17.4 2645036 135496 pts/0  Sl   09:57   0:04 /app/jdk/bin/java -Djava.util.logging.config.file=/app/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=39.105.190.251 -Dignore.endorsed.dirs= -classpath /app/tomcat/bin/bootstrap.jar:/app/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/app/tomcat -Dcatalina.home=/app/tomcat -Djava.io.tmpdir=/app/tomcat/temp org.apache.catalina.startup.Bootstrap start
tomcat    4307  0.0  0.1  12112   932 pts/0    S+   09:58   0:00 grep --color=auto java

[root@7 app]# vim /etc/profile
su - tomcat -c "/app/tomcat/bin/startup.sh" #	添加

[root@7 app]# reboot

[root@7 ~]# ps -aux | grep java
tomcat    1192 12.0 16.7 2645168 130456 ?      Sl   10:25   0:04 /app/jdk/bin/java -Djava.util.logging.config.file=/app/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=12345 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Djava.rmi.server.hostname=39.105.190.251 -Dignore.endorsed.dirs= -classpath /app/tomcat/bin/bootstrap.jar:/app/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/app/tomcat -Dcatalina.home=/app/tomcat -Djava.io.tmpdir=/app/tomcat/temp org.apache.catalina.startup.Bootstrap start
root      1410  0.0  0.1  12112  1052 pts/1    S+   10:26   0:00 grep --color=auto java