Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What will be the recommended way to ensure that a Tomcat7 instance is running as the tomcat7 (or any other) user?

I suppose that I can modify tomcat7-instance/bin/ and tomcat7-instance/bin/ and add 'su tomcat7' at the top.

In Tomcat6 I think it was the environment variable TOMCAT6_USER.

share|improve this question
If you are asking for the "secure way" most likely will provoke debates. Now if you ask "how to set a different user for tomcat7?" that is answerable. BTW, tomcat starts with user tomcat, as far I remember if you installed the deb package.. – Braiam Nov 6 '13 at 0:56
up vote 10 down vote accepted

The most common way is to install the standard tomcat7 package with apt-get and to start it using:

sudo service tomcat7 start

The default user and group are configured in /etc/default/tomcat7 as you can see in this excerpt:

# Run Tomcat as this user ID. Not setting this or leaving it blank will use the
# default of tomcat7.

# Run Tomcat as this group ID. Not setting this or leaving it blank will use
# the default of tomcat7.
share|improve this answer
TOMCAT7_USER and TOMCAT7_GROUP was what I was looking for. Thanks – Adrian Ber Nov 6 '13 at 13:19
I modified TOMCAT7_USER in tomcat7-instance/bin/ and started the server. But if I display the process using ps the user is not the one specified in TOMCAT7_USER. – Adrian Ber Nov 7 '13 at 1:17
Why don't you modify it directly in /etc/default/tomcat7? – David Levesque Nov 7 '13 at 3:19
Let's say that I have two Tomcat user instances and I want to launch them as different users. – Adrian Ber Nov 7 '13 at 9:56
That's a scenario I'm not familiar with, but in this case I don't think you can run Tomcat as a service and the above config does not apply. Maybe you should ask a separate question about that. – David Levesque Nov 7 '13 at 15:03

EDIT: Please read comments below! This solution may not be applicable to all situations.

The accepted answer is great but since I run Tomcat 7 on Ubuntu 14.04 there were some additional things I needed to do in order to get everything running:

  1. You need to stop the tomcat service before editing the file /etc/default/tomcat7. Once you change the user and group, it will no longer be possible to stop a service using the old user.
  2. Change the user and group in the file /etc/default/tomcat7

  3. You need to change ownership of the folder /var/log/tomcat7 and all of it's files. Please note that it is an advantage to keep the adm group so that all adm users can read the logs.

    sudo chown -R newuser:adm /var/log/tomcat7

  4. Change ownership of the folder /var/lib/tomcat7/webapps

    sudo chown -R newuser:newgroup /var/lib/tomcat7/webapps

  5. If running on port 80/443 on Ubuntu 14.04 you need to change ownership of the authbind files:

    sudo chown newuser /etc/authbind/byport/80

    sudo chown newgroup /etc/authbind/byport/443

  6. Change ownership of the working folder

    sudo chown newuser:adm /var/cache/tomcat7

    sudo chown -R newuser:newgroup /var/cache/tomcat7/Catalina

  7. Make config files readable. Here you have two options: Either add you new user to the tomcat7 group by:

    sudo usermod -a -G tomcat7 newuser

    ...or change ownership of the config files:

    sudo chown -R :newgroup /var/lib/tomcat7/conf/*

  8. If you have other files that your web-apps are accessing such as log files configuration files etc. then you need to change ownership of those files as well.

  9. Now, everything should be ready to fire up the service again with the new user.
share|improve this answer
There si a huge problem with your answer. Upon the next tomcat7 package upgrade (security fix/bugfix), your setup will break because apt will install the new tomcat7 package version using the same user (tomcat7) again. So you can't do unattended upgrades and have to remember to chown after each upgrade. – user323094 Aug 11 '15 at 12:13
I did not realize that and I don't have any good solution for it either at the moment. Any suggestions, anyone? – stenix Aug 13 '15 at 6:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.