1、安装基础库
yum -y install apr-devel gcc gcc-c++ make openssl-devel openssl java-11-openjdk-* libffi-devel redhat-rpm-config lrzsz
2、编译安装native（默认tomcat中bin目录下有）
tar xf apache-tomcat-10.0..tar.gz \
&& cd apache-tomcat-10.0.2/bin \
&& tar xf tomcat-native.tar.gz \
&& cd tomcat-native-1.2.26-src/native/ \
&& ./configure --with-apr=/usr/ --with-java-home=/usr/lib/jvm/java-11-openjdk --with-ssl \
&& make \
&& make install
3、配置环境变量
echo -e 'export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/apr/lib \nexport LD_RUN_PATH=$LD_RUN_PATH:/usr/local/apr/lib' >> /etc/profile.d/jdk11.sh
Source /etc/profile.d/jdk11.sh
4、修改运行模式为APR
cat $CATALINA_HOME/conf/server.xml
<Connector port="8080" protocol="org.apache.coyote.http11.Http11AprProtocol"//将HTTP/1.1修改为当前值
connectionTimeout="20000"
redirectPort="8443" />
5、重启服务
$CATALINA_HOME/bin/catalina.sh stop
$CATALINA_HOME/bin/catalina.sh start
6、查看运行模式
查看$CATALINA_HOME/logs/catalina.out日志输出，初始化协议处理器是否为["http-apr-8080"]
7、配置模版
<?xml version='1.0' encoding='utf-8'?>
<!-- port from 9040 -9049 -->
<Server port="9041" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
<Listener className="org.apache.catalina.core.JasperListener" />
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<GlobalNamingResources>
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<Connector port="9040" protocol="HTTP/1.1"
connectionTimeout="30000"
redirectPort="9043"
URIEncoding="utf-8"
maxThreads="1000"
acceptCount="2000"
minSpareThreads="100"
maxSpareThreads="250"
enableLookups="false"
disableUploadTimeout="true"
server="devops-1.0"/>
<Engine name="Catalina" defaultHost="test.nagios.org">
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="test.devops.service" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
<Host name="stageproduct.devops.service" appBase="webapps" unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="StageProductService." suffix=".log" timestamp="true"
pattern="%h %l %u %t "%r" %s %b" resolveHosts="false"/>
<Context path="" docBase="/devops/StageProductService" caseSensitive="false" ></Context>
</Host>
<Host name="stagemobile.devops.com" appBase="webapps" unpackWARs="true" autoDeploy="true">
<Alias>stagemobile1.devops.com</Alias>
<Alias>stagemobile2.devops.com</Alias>
<Alias>stagemobile3.devops.com</Alias>
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="StageMobile." suffix=".log" timestamp="true"
pattern="%h %l %u %t "%r" %s %b" resolveHosts="false"/>
<Context path="" docBase="/devops/StageMobile" caseSensitive="false" ></Context>
</Host>
<Host name="stagemerchant.devops.service" appBase="webapps" unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="StageMerchantService." suffix=".log" timestamp="true"
pattern="%h %l %u %t "%r" %s %b" resolveHosts="false"/>
<Context path="" docBase="/devops/StageMerchantService" caseSensitive="false" ></Context>
</Host>
<Host name="stageorder.devops.service" appBase="webapps" unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="StageOrderService." suffix=".log" timestamp="true"
pattern="%h %l %u %t "%r" %s %b" resolveHosts="false"/>
<Context path="" docBase="/devops/StageOrderService" caseSensitive="false" ></Context>
</Host>
</Engine>
</Service>
</Server>
8、安全加固
1、删除默认目录
rm -rf $CATALINA_HOME/webapps/*
2、管理用户注释（默认已注释）
cat $CATALINA_HOME/conf/tomcat-users.xml
<!--
<role rolename="tomcat"/>
<role rolename="rile1"/>
<user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
<user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
<user username="role1" password="<must-be-changed>" roles="role1"/>
-->
3、隐藏版本号
cat $CATALINA_HOME/conf/server.xml
<Connector port="8080" protocol="HTTP/1.1"
connectionsTimeout="20000"
redirectPort="8443"
server="GOME1.0"/>
4、关闭自动部署
cat $CATALINA_HOME/conf/server.xml
<Host name="localhost" appBase="webapps" unpackWARs="false" autoDeploy="false"/>
5、禁止列目录（默认已关闭）
cat $CATALINA_HOME/conf/web.xml
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
6、禁用AJP端口（默认已注释）
若前端是apache，会使用AJP这个连接器；若前端是nginx做反向代理，不使用AJP连接器
<!-- <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/> -->
7、服务权限控制
chown -R devops.devops$CATALINA_HOME
sudo su - devops -c "$CATALINA_HOME/bin/catalina.sh start"
8、配置JVM
cat $CATALINA_HOME/bin/catalina.sh
JAVA_OPTS="-server
-Xmn192m
-Xms512m
-Xmx512m
-XX:MetaspaceSize=192m
-XX:MaxMetaspaceSize=192m
-XX:SurvivorRatio=65536
-XX:MaxTenuringThreshold=0
-Xnoclassgc
-XX:+DisableExplicitGC
-XX:+UseParNewGC
-XX:+UseConcMarkSweepGC
-XX:+UseCMSCompactAtFullCollection
-XX:CMSFullGCsBeforeCompaction=0
-XX:+CMSClassUnloadingEnabled
-XX:-CMSParallelRemarkEnabled
-XX:CMSInitiatingOccupancyFraction=90
-XX:SoftRefLRUPolicyMSPerMB=0
-XX:+PrintClassHistogram
-XX:+PrintGCDetails
-XX:+PrintGCTimeStamps
-XX:+PrintHeapAtGC
-Xloggc:log/gc.log"
9、限制访问
cat $CATALINA_HOME/conf/server.xml
<Context path="/myapp" reloadable="true" docBase="/var/www/myapp">
<valueclassName="org.apache.catalina.values.RemoteAddrValue"
allow="192.168.[1-5].*,192.168.[10-15].*" deny="″ />
</Context>
9、备注
参数 | 说明 |
-Xmx512m | 最大总堆内存，一般设置为物理内存的1/4 |
-Xms512m | 初始总堆内存，一般将它设置的和最大堆内存一样大，这样就不需要根据当前堆使用情况而调整堆的大小了 |
-Xmn192m | 年轻带堆内存，sun官方推荐为整个堆的3/8 |
堆内存的组成 | 总堆内存 = 年轻带堆内存 + 年老带堆内存 + 持久带堆内存 |
年轻带堆内存 | 对象刚创建出来时放在这里 |
年老带堆内存 | 对象在被真正会回收之前会先放在这里 |
持久带堆内存 | class文件，元数据等放在这里 |
-XX:PermSize=128m | 持久带堆的初始大小 |
-XX:MaxPermSize=128m | 持久带堆的最大大小，eclipse默认为256m。如果要编译jdk这种，一定要把这个设的很大，因为它的类太多了。 |