There's a bug in tomcat.sh when you specify -security after the start and run targets. Basically you have to do another shift to get rid of -security before passing the rest of the args to Tomcat. Here's the diff: 124a125 > shift 141a143 > shift Edwin Park