使用用户帐户启动 tomcat 时出现异常

Question

我正在使用 Centos6 64 位。我启动 tomcat 并使用 root 帐户使用 SSL => 好的，没问题。

现在我需要使用用户（不是 root）帐户启动 tomcat。
使用非 SSL => OK。使用SSL，启动tomcat后会出现一些异常。

14-Jul-2014 10:43:28.123 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-443"]
14-Jul-2014 10:43:28.138 SEVERE [main] org.apache.coyote.AbstractProtocol.init Failed to initialize end point associated with ProtocolHandler ["http-nio-443"]
 java.net.SocketException: Permission denied
    at sun.nio.ch.Net.bind0(Native Method)
    at sun.nio.ch.Net.bind(Net.java:414)
    at sun.nio.ch.Net.bind(Net.java:406)
    at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:214)
    at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74)
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:343)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:727)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:456)
    at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:120)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:960)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:567)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:834)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:576)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:599)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:310)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:484)
14-Jul-2014 10:43:28.140 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-443]]
 org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-443]]
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:567)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:834)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:576)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:599)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:310)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:484)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:962)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    ... 12 more
Caused by: java.net.SocketException: Permission denied
    at sun.nio.ch.Net.bind0(Native Method)
    at sun.nio.ch.Net.bind(Net.java:414)
    at sun.nio.ch.Net.bind(Net.java:406)
    at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:214)
    at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74)
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:343)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:727)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:456)
    at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:120)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:960)
    ... 13 more

如何解决？

Answer 1

我发现这里的步骤很完美。

如果使用 Linux 2.6.24 或更高版本，您可以在 java 可执行文件上设置文件功能，以提供提升的权限以仅允许打开特权端口，而不允许其他超级用户权限：

# setcap cap_net_bind_service+ep /path/to/bin/java

设置此项后，您可能会在像这样启动 Java 时注意到错误，例如：

$ java -version
/path/to/bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory

这意味着库是从动态路径导入的，而不是在受信任的 ld.so 路径中。有关详细信息，请参阅 http://bugs.sun.com/view_bug.do?bug_id=7157699。要解决此问题，您需要找到该库，并将其路径添加到 ld.so 配置中。请注意，以下是一个示例，这可能会因 Linux 发行版而异。将 JAVA_HOME 替换为正确的位置：

$ find JAVA_HOME -name 'libjli.so'
JAVA_HOME/lib/amd64/jli/libjli.so


# echo "JAVA_HOME/lib/amd64/jli" > /etc/ld.so.conf.d/java-libjli.conf
# ldconfig -v