Skip to content

Commit c83f7a1

Browse files
sboldyrevasboldyreva
committed
Update Apache Tomcat libraries and application pages
1 parent b5eae12 commit c83f7a1

File tree

2 files changed

+390
-132
lines changed

2 files changed

+390
-132
lines changed

‎docs/els-for-applications/apache-tomcat/README.md‎

Lines changed: 213 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -3,175 +3,256 @@
33
TuxCare's Endless Lifecycle Support (ELS) for Apache Tomcat provides security patches, and selected bug fixes, that are integral to the stable operation of applications running on these versions of Apache Tomcat core components such as Coyote, Catalina, Jasper etc.. These components have either reached their end of standard support from vendors or have reached End of Life (EOL).
44
Our ELS for Apache Tomcat service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Tomcat applications.
55

6+
This guide outlines the steps needed for Apache Tomcat server setup and configuration.
7+
8+
:::tip
9+
Apache Tomcat is also available for installation as a library for Maven and Gradle projects. See [ELS for Apache Tomcat Libraries](/els-for-libraries/apache-tomcat/) for integration instructions.
10+
:::
11+
612
## Supported Versions
713

8-
* Apache Tomcat 9.0.75, 9.0.83, 8.5.100
14+
* Apache Tomcat 8.5.100, 9.0.75, 9.0.83
915

10-
## Connection to ELS for Apache Tomcat Repository
16+
## Prerequisities
1117

12-
This guide outlines the steps needed to integrate the TuxCare ELS for Apache Tomcat repository into your Java application. The repository provides trusted Java libraries that can be easily integrated into your **Maven** and **Gradle** projects.
18+
* **Java Development Kit (JDK)**
1319

14-
### Step 1: Get user credentials
20+
Ensure you have a compatible version of Java Development Kit (JDK) installed. Apache Tomcat 8.5.x and 9.0.x require JDK 8 or later. To verify if JDK is already installed on your system, open a terminal or command prompt and run:
1521

16-
You need username and password in order to use TuxCare ELS Apache Tomcat repository. Anonymous access is disabled. To receive username and password please contact [[email protected]](mailto:[email protected]).
22+
<CodeWithCopy>
1723

18-
### Step 2: Configure Registry
24+
```text
25+
java -version
26+
```
1927

20-
1. Navigate to the directory depending on your operating system.
21-
* Windows
22-
```text
23-
Maven: C:\Users\{username}\.m2
24-
Gradle: C:\Users\{username}\.gradle
25-
```
26-
* macOS
27-
```text
28-
Maven: /Users/{username}/.m2
29-
Gradle: /Users/{username}/.gradle
30-
```
31-
* Linux
32-
```text
33-
Maven: /home/{username}/.m2
34-
Gradle: /home/{username}/.gradle
35-
```
28+
</CodeWithCopy>
3629

37-
2. Add the TuxCare repository and plugin repository to your build configuration.
30+
If JDK is installed, you should see version information. If not, you'll need to install it.
3831

39-
:::tip
40-
For Maven, you may choose any valid `<id>` value instead of `tuxcare-tomcat-registry`, but the same value must be used in both `settings.xml` and `pom.xml`.
41-
:::
32+
* **Repository Access**
4233

43-
<CodeTabs :tabs="[
44-
{ title: 'Maven (~/.m2/settings.xml)', content: mavencreds },
45-
{ title: 'Gradle (~/.gradle/gradle.properties)', content: gradlecreds }
46-
]" />
34+
You need username and password to access the TuxCare ELS Apache Tomcat repository. Anonymous access is disabled.
35+
To obtain credentials, please contact [[email protected]](mailto:[email protected]). Once you have credentials, you can access the repository at: [https://nexus.repo.tuxcare.com/repository/els_tomcat/](https://nexus.repo.tuxcare.com/repository/els_tomcat/)
4736

48-
Here `USERNAME` and `PASSWORD` are your credentials mentioned in the [Step 1](#step-1-get-user-credentials).
37+
## Installation
4938

50-
### Step 3: Update Build Configuration
39+
### Create Tomcat User (Linux Only)
5140

52-
Add the TuxCare Apache Tomcat repository and plugins to your build configuration:
41+
* For security purposes, create a dedicated tomcat group:
5342

54-
<CodeTabs :tabs="[
55-
{ title: 'Maven (pom.xml)', content: mavenrepo },
56-
{ title: 'Gradle (build.gradle)', content: gradlerepo }
57-
]" />
43+
<CodeWithCopy>
5844

59-
* To fully switch from the official Apache Tomcat repository, replace it with the TuxCare repository.
60-
* To keep both, add TuxCare after the official one.
45+
```text
46+
sudo groupadd tomcat
47+
```
6148

62-
Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables.
63-
* [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)
64-
* [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)
49+
</CodeWithCopy>
6550

66-
### Step 4: Update Dependencies
51+
* And a new tomcat user as a member of the tomcat group, with a home directory of `/opt/tomcat` and with a shell of `/bin/false`:
6752

68-
Replace the Apache Tomcat dependencies in your build file with the TuxCare-maintained versions to cover both direct and transitive dependencies.
53+
<CodeWithCopy>
6954

70-
<CodeTabs :tabs="[
71-
{ title: 'Maven (pom.xml)', content: mavendeps },
72-
{ title: 'Gradle (build.gradle)', content: gradledeps }
73-
]" />
55+
```text
56+
sudo useradd -s /bin/false -g tomcat -d /opt/tomcat tomcat
57+
```
7458

75-
You can find a specific artifact version in your TuxCare account on [Nexus](https://nexus.repo.tuxcare.com/repository/els_tomcat/) (anonymous access is restricted).
59+
</CodeWithCopy>
7660

77-
### Step 5: Verify and Build
61+
### Download Apache Tomcat
7862

79-
1. To confirm the TuxCare Apache Tomcat repository is set up correctly, use your build tool to list the project's dependencies. It shows both direct and transitive dependencies in the classpath.
63+
Download the archive file from the TuxCare repository manually or via terminal using your credentials:
8064

81-
<CodeTabs :tabs="[
82-
{ title: 'Maven', content: `mvn dependency:tree -Dverbose` },
83-
{ title: 'Gradle', content: `./gradlew dependencies --configuration runtimeClasspath` }
84-
]" />
65+
<CodeWithCopy>
8566

86-
2. After reviewing the dependencies, include any library from the repository into your project and then run a build:
67+
```text
68+
curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els_tomcat/org/apache/tomcat/tomcat/8.5.100-tuxcare.3/apache-tomcat-8.5.100-tuxcare.3.tar.gz
69+
```
8770

88-
<CodeTabs :tabs="[
89-
{ title: 'Maven', content: `mvn clean install` },
90-
{ title: 'Gradle', content: `./gradlew build` }
91-
]" />
71+
</CodeWithCopy>
9272

93-
The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Tomcat repository.
73+
Replace `USERNAME` and `PASSWORD` with your actual credentials, and adjust the version number as needed.
9474

95-
### Conclusion
75+
### Extract the Archive
9676

97-
You've successfully integrated the TuxCare ELS for Apache Tomcat repository into your project. You can now benefit from the secure and vetted Apache Tomcat libraries it provides.
77+
**Linux/macOS:**
9878

99-
## Vulnerability Exploitability eXchange (VEX)
79+
Unpack the downloaded file into a directory of your choice (e.g., `/opt/tomcat`).
10080

101-
VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives, helps prioritize real risks.
81+
<CodeWithCopy>
10282

103-
TuxCare provides VEX for Apache Tomcat ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/).
83+
```text
84+
sudo tar -xvzf ~/v8.5.100-tuxcare.3/bin/apache-tomcat-8.5.100-tuxcare.3.tar.gz -C /opt/tomcat --strip-components=1
85+
```
86+
87+
</CodeWithCopy>
88+
89+
**Windows:**
90+
91+
Extract the downloaded `.zip` file to your desired location (e.g., `C:\Tomcat`).
92+
93+
### Update Permissions
94+
95+
The tomcat user that we set up needs to have access to the Tomcat installation. We’ll set that up now.
96+
97+
Change to the directory where we unpacked the Tomcat installation:
98+
99+
<CodeWithCopy>
100+
101+
```text
102+
cd /opt/tomcat
103+
```
104+
105+
</CodeWithCopy>
106+
107+
Give the tomcat group ownership over the entire installation directory:
108+
109+
<CodeWithCopy>
110+
111+
```text
112+
sudo chgrp -R tomcat /opt/tomcat
113+
```
114+
115+
</CodeWithCopy>
116+
117+
Next, give the tomcat group read access to the conf directory and all of its contents, and execute access to the directory itself:
118+
119+
<CodeWithCopy>
120+
121+
```text
122+
sudo chmod -R g+r conf
123+
sudo chmod g+x conf
124+
```
125+
126+
</CodeWithCopy>
127+
128+
Make the tomcat user the owner of the webapps, work, temp, and logs directories:
129+
130+
<CodeWithCopy>
131+
132+
```text
133+
sudo chown -R tomcat webapps/ work/ temp/ logs/
134+
```
135+
136+
</CodeWithCopy>
137+
138+
### Configure Environment Variables
139+
140+
**Linux/macOS:**
141+
142+
Add the following to your `~/.bashrc` or `~/.bash_profile`:
143+
144+
<CodeWithCopy>
145+
146+
```text
147+
export CATALINA_HOME=/opt/tomcat
148+
export JAVA_HOME=/usr/lib/jvm/java-11-openjdk
149+
```
150+
151+
</CodeWithCopy>
152+
153+
Then reload:
154+
155+
<CodeWithCopy>
156+
157+
```text
158+
source ~/.bashrc
159+
```
160+
161+
</CodeWithCopy>
104162

105-
## How to Upgrade to a Newer Version of TuxCare Packages
163+
**Windows:**
106164

107-
If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you need to update version strings in your Maven or Gradle build file.
165+
1. Right-click *This PC* → *Properties* → *Advanced system settings* → *Environment Variables*
166+
2. Add new system variable:
167+
- Variable name: `CATALINA_HOME`
168+
- Variable value: `C:\Tomcat` (or your installation path)
169+
170+
### Start Tomcat
171+
172+
**Linux/macOS:**
173+
174+
<CodeWithCopy>
175+
176+
```text
177+
sudo -u tomcat /opt/tomcat/bin/startup.sh
178+
```
179+
180+
</CodeWithCopy>
181+
182+
**Windows:**
183+
184+
Double-click `startup.bat` in the `bin` directory.
185+
186+
### Verify Installation
187+
188+
Open a web browser and visit `http://localhost:8080/`. You should see the default Tomcat homepage.
189+
190+
Alternatively, use curl:
191+
192+
<CodeWithCopy>
193+
194+
```text
195+
curl http://localhost:8080
196+
```
197+
198+
</CodeWithCopy>
199+
200+
You should see HTML output containing:
201+
202+
<CodeWithCopy>
203+
204+
```text
205+
<h2>If you're seeing this, you've successfully installed Tomcat. Congratulations!</h2>
206+
```
207+
208+
</CodeWithCopy>
209+
210+
### Stop Tomcat
211+
212+
**Linux/macOS:**
213+
214+
<CodeWithCopy>
215+
216+
```text
217+
sudo -u tomcat /opt/tomcat/bin/shutdown.sh
218+
```
219+
220+
</CodeWithCopy>
221+
222+
**Windows:**
223+
224+
Double-click `shutdown.bat` in the `bin` directory.
225+
226+
## Upgrading to a Newer TuxCare Version
227+
228+
To upgrade to a newer TuxCare release (e.g., from `tuxcare.1` to `tuxcare.3`):
229+
230+
1. **Download and extract new version** following Steps 2-3 in the Installation section.
231+
232+
2. **Start Tomcat:**
233+
234+
<CodeWithCopy>
235+
236+
```text
237+
sudo -u tomcat /opt/tomcat/bin/startup.sh
238+
```
239+
240+
</CodeWithCopy>
241+
242+
### Logs Location
243+
244+
Check logs for detailed error information:
245+
- **Linux/macOS:** `/opt/tomcat/logs/catalina.out`
246+
- **Windows:** `C:\Tomcat\logs\catalina.[date].log`
247+
248+
## Vulnerability Exploitability eXchange (VEX)
249+
250+
VEX is a machine-readable format that indicates whether a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks.
251+
252+
TuxCare provides VEX for Apache Tomcat ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_java/](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/).
108253

109254
## Resolved CVEs in ELS for Apache Tomcat
110255

111256
<ClientOnly>
112257
<ResolvedCveTable project="apache-tomcat" />
113258
</ClientOnly>
114-
115-
<!-- data for Apache Tomcat instructions used in code blocks -->
116-
117-
<script setup>
118-
const mavencreds =
119-
`<?xml version="1.0" encoding="UTF-8"?>
120-
<settings xmlns="http://maven.apache.org/SETTINGS/1.1.0">
121-
<servers>
122-
<server>
123-
<id>tuxcare-tomcat-registry</id>
124-
<username>USERNAME</username>
125-
<password>PASSWORD</password>
126-
</server>
127-
</servers>
128-
</settings>`
129-
130-
const gradlecreds =
131-
`tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_tomcat/
132-
tuxcare_registry_user=USERNAME
133-
tuxcare_registry_password=PASSWORD`
134-
135-
const mavenrepo =
136-
`<repositories>
137-
<repository>
138-
<id>tuxcare-tomcat-registry</id>
139-
<url>https://nexus.repo.tuxcare.com/repository/els_tomcat/</url>
140-
</repository>
141-
</repositories>`
142-
143-
const gradlerepo =
144-
`repositories {
145-
maven {
146-
url = uri(providers.gradleProperty("tuxcare_registry_url").get())
147-
credentials {
148-
username = providers.gradleProperty("tuxcare_registry_user").get()
149-
password = providers.gradleProperty("tuxcare_registry_password").get()
150-
}
151-
authentication {
152-
basic(BasicAuthentication)
153-
}
154-
}
155-
mavenCentral()
156-
}`
157-
158-
const mavendeps =
159-
`<dependencies>
160-
<dependency>
161-
<groupId>org.apache.tomcat</groupId>
162-
<artifactId>tomcat-catalina</artifactId>
163-
<version>9.0.75-tuxcare.1</version>
164-
</dependency>
165-
<dependency>
166-
<groupId>org.apache.tomcat</groupId>
167-
<artifactId>tomcat-coyote</artifactId>
168-
<version>9.0.75-tuxcare.1</version>
169-
</dependency>
170-
</dependencies>`
171-
172-
const gradledeps =
173-
`dependencies {
174-
implementation "org.apache.tomcat:tomcat-catalina:9.0.75-tuxcare.1"
175-
implementation "org.apache.tomcat:tomcat-coyote:9.0.75-tuxcare.1"
176-
}`
177-
</script>

0 commit comments

Comments
 (0)