安道生練功房 - 分享經驗，累積智慧

Tomcat最近發佈的安全漏洞屬於critical，故如果有使用Tomcat 5.5.20和JK Connector 1.2.19或1.2.20的網站便需要更新。

升級Tomcat
如果您跟我一樣是把不同版本的Tomcat 安裝在不同目錄下，然後再設定一個符號連結至執行用版本，並把webapps放在獨立於Tomcat安裝目錄外的統一的目錄下，則升級的動作很單純，就是安裝好新版的Tomcat，然後把舊版中的common/lib下的一些jar檔，common/classes下的一些properties檔或class檔，bin下的setenv.sh等複製過去即可。

簡單來說，前一版的Tomcat安裝的樣子
/var/apache-tomcat-5.5.20
/var/tomcat5->/var/apache-tomcat-5.5.20
/var/webapps
新版的Tomcat要安裝成
/var/apache-tomcat-5.5.23
/var/tomcat5->/var/apache-tomcat-5.5.23
/var/webapps(不動)

tomcat-upgrade.sh:

#! /bin/bash

# Name: Tomcat 5.x auto-upgrade installer

# Author: Andowson Chang (andowson [at] gmail [dot] com)

# Version: 1.4

# Since: 2006-04-30

# Last Modified: 2007-09-16

#

# check the installed version of Tomcat 5.5

#

OLD_VERSION=`ls -l /var | grep tomcat5|awk '{print $11}'|cut -d "-" -f3`

#

# check the latest stable version of Tomcat 5.5

#

wget http://tomcat.apache.org/index.html -q -t 1 -T 5 -O /tmp/tomcat.html

if [ -s /tmp/tomcat.html ]; then

   TOMCAT_VERSION=`grep "5\.5\." /tmp/tomcat.html|grep -v "5\.5\.x"|cut -d">" -f2|cut -d"<" -f1`

fi

rm -rf /tmp/tomcat.html



echo "Install Tomcat ${TOMCAT_VERSION}"

if [ ! -r apache-tomcat-${TOMCAT_VERSION}.tar.gz ]; then

   wget http://apache.ntu.edu.tw/tomcat/tomcat-5/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz

fi

tar zxvf apache-tomcat-${TOMCAT_VERSION}.tar.gz -C /var

cp /var/apache-tomcat-${OLD_VERSION}/bin/setenv.sh /var/apache-tomcat-${TOMCAT_VERSION}/bin



#

# find out old jar files that you put in common/lib yourself

#

ls -sort /var/apache-tomcat-${OLD_VERSION}/common/lib | awk '{print $9}' > /tmp/old.txt

ls -sort /var/apache-tomcat-${TOMCAT_VERSION}/common/lib | awk '{print $9}' > /tmp/new.txt

comm -23 /tmp/old.txt /tmp/new.txt > /tmp/jarlist.txt

rm -rf /tmp/old.txt /tmp/new.txt

#

# copy old jar files into new common/lib directory

#

for file in `cat /tmp/jarlist.txt`

do

   cp -rf /var/apache-tomcat-${OLD_VERSION}/common/lib/${file} /var/apache-tomcat-${TOMCAT_VERSION}/common/lib

done



#

# find out old jar files that you put in common/endorsed yourself

#

ls -sort /var/apache-tomcat-${OLD_VERSION}/common/endorsed | awk '{print $9}' > /tmp/old.txt

ls -sort /var/apache-tomcat-${TOMCAT_VERSION}/common/endorsed | awk '{print $9}' > /tmp/new.txt

comm -23 /tmp/old.txt /tmp/new.txt > /tmp/jarlist.txt

rm -rf /tmp/old.txt /tmp/new.txt

#

# copy old jar files into new common/endorsed directory

#

for file in `cat /tmp/jarlist.txt`

do

   cp -rf /var/apache-tomcat-${OLD_VERSION}/common/endorsed/${file} /var/apache-tomcat-${TOMCAT_VERSION}/common/endorsed

done

#

# copy old properties and class files into new common/classes directory

#

cp -rf /var/apache-tomcat-${OLD_VERSION}/common/classes/* /var/apache-tomcat-${TOMCAT_VERSION}/common/classes

service httpd stop

service tomcat stop

rm -rf /var/tomcat5

ln -s /var/apache-tomcat-${TOMCAT_VERSION} /var/tomcat5

service tomcat start

service httpd start

更新Tomcat JK Connector
把原始檔下載回來重新編譯make再make install即可

tomcat-connector-upgrade.sh:

#! /bin/bash

# Name: Tomcat Connector 1.2.x auto-upgrade installer

# Author: Andowson Chang (andowson [at] gmail [dot] com)

# Version: 0.1

# Since: 2007-03-17

# Last Modified: 2007-03-17

#

# check the latest stable version of Tomcat Connector 1.2

#

wget http://tomcat.apache.org/download-connectors.cgi -q -t 1 -T 5 -O /tmp/connector.html

if [ -s /tmp/connector.html ]; then

   TC_VERSION=`grep "1\.2\." /tmp/connector.html|cut -d">" -f2|cut -d"<" -f1 | grep "1.2" | cut -d" " -f2 | uniq`

fi

rm -rf /tmp/connector.html

echo "Install Tomcat Connector JK ${TC_VERSION}"

if [ ! -r tomcat-connectors-${TC_VERSION}-src.tar.gz ]; then

   wget http://apache.ntu.edu.tw/tomcat/tomcat-connectors/jk/source/jk-${TC_VERSION}/tomcat-connectors-${TC_VERSION}-src.tar.gz

fi

tar zxvf tomcat-connectors-${TC_VERSION}-src.tar.gz

cd tomcat-connectors-${TC_VERSION}-src/native

yum -y install httpd-devel libtool automake

./buildconf.sh

./configure --with-apxs=/usr/sbin/apxs

make

service httpd stop

make install

service httpd start

這裡的

yum -y install httpd-devel libtool automake

是為了解決及避免出現下面錯誤訊息

rm autom4te.cache
libtoolize --force --automake --copy
./buildconf.sh: line 7: libtoolize: command not found
aclocal
./buildconf.sh: line 11: aclocal: command not found
autoheader
./buildconf.sh: line 13: autoheader: command not found
automake -a --foreign --copy
./buildconf.sh: line 15: automake: command not found
autoconf
./buildconf.sh: line 17: autoconf: command not found
rm autom4te.cache

附檔是兩個Linux上自動化更新的程式，下載附檔儲存到/root/setup/web下，並修改權限為755可執行，然後以root身份執行即可。