I'm installing tomcat on a CentOS box for use as an application server. My system admin created a tomcat user service account under which to run tomcat. I'm generally following instructions on this page but when I get to the step where I adjust the startup script to run the tomcat startup and shutdown commands as user tomcat (Step 6, item 4) I'm being asked for a password for the tomcat account. Since this is a service account should I be able to /bin/su tomcat to run certain commands as the tomcat user without entering the password?

I'm generally unfamiliar with setting up tomcat to run under a service account. If anyone has best practices for this please let me know.

Update: I found a good article covering installing tomcat as a service under a low privilege user here. Following that article I eventually got my installation working.


If you are not logged in/elevated as root, and are a "regular" user, you will need to provide the password for another user account.

However, you may want to look into sudo to achieve what you are trying accomplish. You will likely need to consult with your sysadmin to properly set you up in the sudoers file in order to grant you the access you require.

  • My user account is granted sudo rights but when I use sudo to run the startup script I get the message: "This account is currently not available."
    – Tom
    Apr 10 '14 at 14:34
  • That's normally due to a lack of a shell specified for the user account. Sometimes sysadmins do that for security purposes.
    – Chipster
    Apr 10 '14 at 14:37

No service accounts such as this are typically not configured to be logged into. You can see this if you look at the file /etc/passwd. You can also see it using the getent command.


$ getent passwd saml

Notice that my account is setup to use a shell, /bin/bash. Meanwhile a service account is not.

$ getent passwd nginx
nginx:x:987:978:Nginx web server:/var/lib/nginx:/sbin/nologin

To make changes to any files related to this service you'll need to use sudo privileges to edit them. Simply doing a sudo vim </path/to/file> will allow you to edit them preserving the original user of these files.

If you need to make new files, you'll need to take care to chown <user>.<group> new files to the service account and its default Unix group as well.

  • I wasn't actually trying to login to this account...just trying to run commands as this user which I should be able to do.
    – Tom
    Apr 10 '14 at 16:35
  • @Tom - you can run commands as a user via sudo as well: sudo -u tomcat <cmd>.
    – slm
    Apr 10 '14 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.