« Good CSS Design at... | Main | iCal for Denver JUG »
20030904 Thursday September 04, 2003

How to run Tomcat on Port 80 I've had people ask me how to run Tomcat on Port 80 before (as a non-root user). I've never had an answer until now. Today I found that Holger Klawitter has a solution using Kernel space port forwarding. I don't have a need to try this at the moment, but if someone is using it - please share your experiences.

As an FYI, Tomcat 5 will use commons-daemon making this much easier to do. Also, the first Beta of Tomcat 5 (5.0.9) has been released. Posted in Java at Sep 04 2003, 09:45:16 AM MDT 8 Comments

Comments:

Just change server.xml: 
    <!-- Define a non-SSL HTTP/1.1 Connector on port 8080 --&g;
    <Connector className="org.apache.catalina.connector.http.HttpConnector"
               port="8080" minProcessors="5" maxProcessors="75"
               enableLookups="true" redirectPort="8443"
               acceptCount="10" debug="0" connectionTimeout="60000"/>

Posted by Garrett Smith on September 04, 2003 at 12:44 PM MDT #

This works great for Windows, but if you do it on *nix, you have to run it as root (any ports < 1024). Apache starts as root and then runs as "nobody." This is a way to replicate that feature on Tomcat.

Posted by Matt Raible on September 04, 2003 at 12:53 PM MDT #

OK. Just read through the article. I'm using OS X and Tomcat as standalone. Works fine, though I haven't tried running in my user space. Running it under root.

Posted by Garrett Smith on September 04, 2003 at 01:00 PM MDT #

There is an easy option to redirect 8080->80 using xinetd, and of course using iptables (kernel space) is a standard technique. The latter is more efficient, no process required. A nice article can be found on dW.

Posted by Greg Klebus on September 04, 2003 at 02:55 PM MDT #

I have been using the iptables solution for quite a while and it works well. Beware however, since the REDIRECT target doesn't play nice with ip aliases. It redirects port 80 of *any* alias to port 8080 on the unaliased 'main' ip. I had to rewrite it like this for the original ip to be preserved :

<code>/sbin/iptables -t nat -I PREROUTING -p tcp -d w.x.y.z --dport 80 -j DNAT --to-destination w.x.y.z:8080</code>

Posted by Geert Bevin on September 05, 2003 at 12:03 AM MDT #

Yes, iptables or ipchains works great. I've been involved with putting that kind of solution in production. commons-daemon is IMO not the simplest solution (it's a separate tool that you have to compile and learn), but rather the cleanest (only one port used, etc) and most generic (it is meant to work the same - eventually - on all *nix and Cygwin).

Posted by Remy Maucherat on September 06, 2003 at 11:09 AM MDT #

I've found the iptable solution works really well as well.

Posted by James on October 08, 2003 at 07:09 AM MDT #

We were using the iptables solution on my last web site but that was running Orion Application Server instead of Tomcat. You'll notice pretty quickly if you set up Tomcat with iptables redirection that you'll start getting redirect URLs like http://mysite.com:8080/ instead of http://mysite.com/ ... it would probably help to explain to readers how to do this since the web sites all appear to overlook it.

Posted by Trejkaz Xaoza on November 09, 2003 at 06:06 PM MST #

Post a Comment:
  • HTML Syntax: Allowed