Ubuntu – How to disable SSLv3 in tomcat

From the command line

To run your private instance of Tomcat from the command line, you need to run the startup.sh script within the private instance directory rather than the one in /usr/share/tomcat7. So, in your case, you need to run:

~/my-tomcat-instance/bin/startup.sh

This should work out-of-the-box.

From Eclipse

To run from Eclipse you should also create your Server Runtime Environment using your ~/my-tomcat-instance/ directory instead of /usr/share/tomcat7/.

However, getting this working is far harder than it should be. This is partly because Eclipse is a bit buggy, and partly because Eclipse doesn't distinguish between CATALINA_BASE and CATALINA_HOME.

Missing files

It turns out that the tomcat7-instance-create script does not set up everything that Eclipse needs. This was reported as a bug that appears to have been fixed at some point for Tomcat 6, but for whatever reason the patch is not in the tomcat7-user package. I've raised a new bug in the hope this will get fixed, but in the meantime, you need to run the following commands:

ln -s /usr/share/tomcat7/lib ~/my-tomcat-instance/lib
ln -s /usr/share/tomcat7/bin/bootstrap.jar ~/my-tomcat-instance/bin/bootstrap.jar

Then you need to grab a copy of catalina.policy which is not distributed as part of the tomcat7-user package and put it in the conf/ directory in your instance. You can get it from the code repository for the tomcat7 package:

curl http://bazaar.launchpad.net/\~ubuntu-branches/ubuntu/precise/tomcat7/precise/view/head:/conf/catalina.policy > ~/my-test-tomcat7-instance/conf/catalina.policy

New server bug

Whilst testing this, I also ran into another bug, which I solved by deleting these files:

{workspace-directory}/.metadata/.plugins/org.eclipse.core.runtime/.settings/org.eclipse.wst.server.core.prefs
{workspace-directory}/.metadata/.plugins/org.eclipse.core.runtime/.settings/org.eclipse.jst.server.tomcat.core.prefs

as per the accepted answer on Eclipse add Tomcat 7 blank server name. Obviously, only do this step if you need to.

See also Eclipse 4.2 (Juno) 'Cannot create a server using the selected type' in Tomcat 7 for getting this working using the tomcat7 package.

It's clearly written in the page you have linked:

Upstream:                               released (2.4.2)
Ubuntu 8.04 LTS (Hardy Heron):          not-affected
Ubuntu 10.04 LTS (Lucid Lynx):          not-affected
Ubuntu 11.04 (Natty Narwhal):           not-affected
Ubuntu 11.10 (Oneiric Ocelot):          not-affected
Ubuntu 12.04 LTS (Precise Pangolin):    not-affected

Also, in the same page, there's written:

jdstrand> Debian/Ubuntu packages contain 038_no_LD_LIBRARY_PATH (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276670 for more information)

And if you look at the changelog included in the bug you can see:

apache2 (2.0.52-2) unstable; urgency=high
[...]
  * Move envvars to /etc/apache2/ and add patch 038_no_LD_LIBRARY_PATH to
    remove the extraneous LD_LIBRARY_PATH from envvars (closes: #276670)

This means that the bug has been fixed in Debian since version 2.0.52.

Last but not least, if you look at your /etc/apache2/envvars or /usr/share/apache2/build/envvars-std, you'll see that they don't contain any malicious LD_LIBRARY_PATH.