Apache Tomcat

Apache Tomcat is an open-source servlet container that runs Java web applications. It implements the Jakarta Servlet, JSP, and WebSocket specifications and serves WAR files over HTTP, making it a standard choice for hosting Java backends.

Software included

Component	Version
Apache Tomcat	11.0.24
OpenJDK	21 (JRE)
Ubuntu	24.04 LTS

Getting started

1. Connect to your VM

ssh ubuntu@<your-vm-ip>

2. Wait for first-boot configuration

On the first boot, a setup script creates the Manager and Host Manager administrator, starts Tomcat, and writes the credentials to disk. This takes about a minute. Track progress:

journalctl -u tomcat-first-boot.service -f

The login message (MOTD) confirms when Tomcat is ready.

3. Verify Apache Tomcat is running

systemctl status tomcat
curl -I http://localhost:8080

4. Access Apache Tomcat

Open a browser and navigate to:

http://<your-vm-ip>:8080

Retrieve the Manager credentials:

sudo cat /root/.credentials/tomcat.txt

Field	Value
Username	`admin`
Password	From `/root/.credentials/tomcat.txt`

The Manager and Host Manager apps accept localhost connections only. Use the SSH tunnel shown in the credentials file to access them.

Managing Apache Tomcat

# Check service status
systemctl status tomcat

# Restart
sudo systemctl restart tomcat

# View logs
sudo journalctl -u tomcat -f

Path	Purpose
`/opt/tomcat/conf/tomcat-users.xml`	Manager users and roles
`/opt/tomcat/webapps/`	Deployed applications and WAR files
`/opt/tomcat/logs/`	Tomcat logs

Security

Port 8080 is accessible on the VM’s network interface. UFW is enabled and allows SSH (port 22) and Tomcat (port 8080) by default. The Manager and Host Manager apps remain restricted to localhost by Tomcat.

To restrict Tomcat to a specific IP:

sudo ufw delete allow 8080/tcp
sudo ufw allow from <trusted-ip> to any port 8080

To access Tomcat without exposing port 8080, use an SSH tunnel:

# Run this on your local machine
ssh -L 8080:localhost:8080 ubuntu@<your-vm-ip>

# Then open in your browser
http://localhost:8080
http://localhost:8080/manager/html

For production use, place Tomcat behind a reverse proxy such as Nginx or HAProxy so you can serve it on port 443 with a TLS certificate.