Apache Tomcat Installation on Linux AWS EC2 (2025)

This guide explains how to install Java, set up Apache Tomcat 9, configure a custom port, and verify the installation step by step on an Ubuntu-based AWS EC2 instance.

Table of Contents

1. Environment Details
2. Connect to EC2 Instance
3. Update System Packages
4. Install Java (OpenJDK 11)
5. Create Dedicated Tomcat User
6. Download Apache Tomcat 9
7. Extract Tomcat to /opt
8. Configure Custom Tomcat Port
9. Create systemd Service
10. Verify Tomcat Service
11. Check Tomcat Version
12. AWS Security Group Configuration
13. Access Tomcat in Browser
14. Access Tomcat Manager GUI
15. Notes on /docs 403 Error
16. Final Outcome

1. Environment Details

• Cloud: AWS EC2 (Free Tier)
• Operating System: Ubuntu Server
• Java Version: OpenJDK 11
• Tomcat Version: Apache Tomcat 9.0.89
• Custom Port: 8090
• Access: SSH using PEM key

2. Connect to EC2 Instance

Connect to the Ubuntu EC2 instance using SSH:

ssh -i key.pem ubuntu@PUBLIC-IP

3. Update System Packages

sudo apt update && sudo apt upgrade -y

4. Install Java (Required for Tomcat)

Install OpenJDK 11:

sudo apt install openjdk-11-jdk -y

Verify Java installation:

java -version

Expected output:

openjdk version "11.x.x"

5. Create a Dedicated Tomcat User

For security best practices, Tomcat should not run as root:

sudo useradd -m -U -d /opt/tomcat -s /usr/sbin/nologin tomcat

Verify the user:

getent passwd tomcat

6. Download Apache Tomcat 9

cd /tmp
wget https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.89/bin/apache-tomcat-9.0.89.tar.gz

7. Extract Tomcat to /opt Directory

sudo mkdir -p /opt/tomcat
sudo tar -xzf apache-tomcat-9.0.89.tar.gz -C /opt/tomcat --strip-components=1

Set ownership and permissions:

sudo chown -R tomcat:tomcat /opt/tomcat
sudo chmod -R u+x /opt/tomcat/bin

8. Configure Custom Port for Tomcat

By default, Tomcat runs on port 8080. Here, we configure a custom port (8090).

sudo nano /opt/tomcat/conf/server.xml

Modify the Connector:

<Connector port="8090"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           connectionTimeout="20000"
           redirectPort="8443" />

Using a custom port is useful when running multiple services or following organizational security standards.

9. Create systemd Service for Tomcat

sudo nano /etc/systemd/system/tomcat.service

[Unit]
Description=Apache Tomcat Web Application Container
After=network.target

[Service]
Type=forking
User=tomcat
Group=tomcat

Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_BASE=/opt/tomcat
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid

ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh

Restart=on-failure

[Install]
WantedBy=multi-user.target

Reload systemd and start Tomcat:

sudo systemctl daemon-reload
sudo systemctl enable tomcat
sudo systemctl start tomcat

10. Verify Tomcat Service Status

sudo systemctl status tomcat

Expected status:

Active: active (running)

11. Check Apache Tomcat Version

Method 1: Using version script

/opt/tomcat/bin/version.sh

Method 2: From Manager GUI after login

Tomcat Version: Apache Tomcat/9.0.89

12. Configure AWS Security Group

Allow inbound traffic:

• 22 → SSH
• 8090 → Tomcat (custom port)

13. Access Tomcat in Browser

http://PUBLIC-IP:8090

The Tomcat welcome page should appear.

14. Access Tomcat Manager GUI

http://PUBLIC-IP:8090/manager/html

After Manager configuration:

• Login successful
• Applications visible
• Server Status working

15. Notes on /docs 403 Error

Accessing /docs may return 403 Forbidden.

• This is default Tomcat security behavior
• Documentation is restricted to localhost
• Use official online docs instead

16. Final Outcome

• Java installed and verified
• Apache Tomcat 9 installed successfully
• Custom port 8090 configured
• Tomcat running as a non-root user
• Manager GUI accessible
• AWS networking configured correctly

GhostPing Security • Educational, ethical-only cybersecurity content.