CentOS 部署 Tomcat 9 與 JBoss EAP 7：JDK 安裝、服務配置、防火牆與管理控制台安全加固

Java 應用服務器是企業級中間件棧核心。本文記錄 CentOS 7/8 上 Oracle JDK 11/17、Apache Tomcat 9、JBoss EAP 7.4 的標準化部署流程、Systemd 服務管理、端口配置、管理控制台安全加固與典型排錯。

第一步：安裝 Oracle JDK (推薦 LTS 版本)

# 下載 Oracle JDK 17 (需 Oracle 賬號登錄接受許可協議)
# 或使用 OpenJDK 17 (生產環境建議 Oracle/Adoptium/Temurin 以獲長期支持)
wget https://download.oracle.com/java/17/latest/jdk-17_linux-x64_bin.rpm
rpm -ivh jdk-17_linux-x64_bin.rpm

# 驗證
java -version
# openjdk version "17.0.9" 2023-10-17 LTS
# OpenJDK Runtime Environment (build 17.0.9+8-LTS)
# OpenJDK 64-Bit Server VM (build 17.0.9+8-LTS, mixed mode, sharing)

# 配置環境變量 (/etc/profile.d/java.sh)
cat > /etc/profile.d/java.sh <<'EOF'
export JAVA_HOME=/usr/java/jdk-17
export JRE_HOME=$JAVA_HOME
export PATH=$JAVA_HOME/bin:$PATH
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
EOF
source /etc/profile.d/java.sh

第二步：部署 Apache Tomcat 9

1. 解壓與目錄規範

wget https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.85/bin/apache-tomcat-9.0.85.tar.gz
tar xzf apache-tomcat-9.0.85.tar.gz
mv apache-tomcat-9.0.85 /usr/local/tomcat9
chown -R tomcat:tomcat /usr/local/tomcat9  # 建議創建專用用戶

2. 核心配置調優 (conf/server.xml)

3. JVM 參數優化 (bin/setenv.sh)

cat > /usr/local/tomcat9/bin/setenv.sh <<'EOF'
#!/bin/bash
# Heap: 物理內存 50-75%，預留給 OS、Metaspace、CodeCache、DirectMemory
export CATALINA_OPTS="-Xms4g -Xmx4g \
-XX:MetaspaceSize=512m -XX:MaxMetaspaceSize=1g \
-XX:+UseG1GC -XX:MaxGCPauseMillis=200 \
-XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/tomcat/heapdump.hprof \
-XX:+UseStringDeduplication \
-Djava.security.egd=file:/dev/./urandom \
-Dfile.encoding=UTF-8 \
-Duser.timezone=Asia/Shanghai"
EOF
chmod +x /usr/local/tomcat9/bin/setenv.sh

4. Systemd 服務單元 (/usr/lib/systemd/system/tomcat9.service)

[Unit]
Description=Apache Tomcat 9
After=network.target syslog.target

[Service]
Type=forking
User=tomcat
Group=tomcat
Environment=CATALINA_HOME=/usr/local/tomcat9
Environment=CATALINA_BASE=/usr/local/tomcat9
Environment=CATALINA_PID=/usr/local/tomcat9/temp/tomcat.pid
ExecStart=/usr/local/tomcat9/bin/startup.sh
ExecStop=/usr/local/tomcat9/bin/shutdown.sh
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutStartSec=120
TimeoutStopSec=60
Restart=on-failure
RestartSec=10
LimitNOFILE=65535
LimitNPROC=65535

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now tomcat9
systemctl status tomcat9

第三步：部署 JBoss EAP 7.4 (WildFly 核心)

1. 解壓與管理用戶創建

wget https://developers.redhat.com/content-gateway/file/jboss-eap-7.4.0.zip
unzip jboss-eap-7.4.0.zip
mv jboss-eap-7.4 /usr/local/jboss-eap7
/usr/local/jboss-eap7/bin/add-user.sh
# 選擇 a) Management User
# 用戶名: admin
# 密碼: StrongAdminPass123!
# 組: ManagementRealm

2. 綁定地址與管理控制台安全 (standalone.xml)

關鍵：管理控制台 (9990/9993) 僅綁定 127.0.0.1，外部通過 SSH 隧道或 VPN 訪問：

ssh -L 9990:127.0.0.1:9990 user@jboss-server
# 瀏覽器訪問 https://localhost:9990/console

3. Systemd 服務 (/usr/lib/systemd/system/jboss-eap7.service)

[Unit]
Description=JBoss EAP 7
After=network.target

[Service]
Type=simple
User=jboss
Group=jboss
Environment=JBOSS_HOME=/usr/local/jboss-eap7
Environment=JAVA_HOME=/usr/java/jdk-17
ExecStart=/usr/local/jboss-eap7/bin/standalone.sh -b 0.0.0.0 -bmanagement 127.0.0.1
ExecStop=/usr/local/jboss-eap7/bin/jboss-cli.sh --connect --controller=127.0.0.1:9990 command=:shutdown
TimeoutStartSec=300
TimeoutStopSec=60
Restart=on-failure
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target

第四步：防火牆與 Nginx 反向代理

# 僅開放業務端口 80/443 (由 Nginx 終結 SSL)
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# Nginx 反向代理 Tomcat (AJP) / JBoss (HTTP)
upstream tomcat_backend {
    server 127.0.0.1:8009;
    keepalive 64;
}
upstream jboss_backend {
    server 127.0.0.1:8080;
    keepalive 64;
}

server {
    listen 80;
    server_name app.example.com;
    location / {
        proxy_pass https://tomcat_backend;  # 或 jboss_backend
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

常見排錯清單