So you are using a web server (as opposed to a full "application server"). The fact that it be Tomcat is irrelevant.
You would need to create some sort data access utility that wraps every single one of your data access operations.
That utility should expose methods, say, create(), update(), delete() and executeQuery(), and all DAOs from your application shouls inherit from it.
Inside each method call, you would get a session (yes, using the HibernateUtil with ThreadLocal), then create a transaction, begin it, do wjat you have to do, then close the transaction, and yes, then close the session.
This approach is somewhat wasteful, because it creates a transaction every time.
A different approach would be to use some sort of framework able to take advantage on "contextual sessions" and the pattern known as "OSIV", which takes care of finding every time a right session from the environment.
These are also called "managed environments", and the most popular is Spring.
For a minimal example of setting up such environment, you can go here
http://hibernar.org/articulos_en/spring ... xample.php