You can self-host osTicket on a Linux VPS if you provide a supported web server, PHP 8.2–8.4, MySQL 5.5 or newer, the required PHP extensions, HTTPS, and a DNS name. The browser installer creates the database schema and configuration; immediately afterward, remove write access from include/ost-config.php, delete the setup/ directory, enable the system, and schedule api/cron.php for incoming mail.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a self-hosted osTicket installation requires
osTicket is downloadable open-source help-desk software. Your VPS supplies the operating system, web server, PHP runtime, database, TLS certificate, backups, updates, and monitoring. The official installation prerequisites specify Apache, LiteSpeed, or IIS with URL Rewrite enabled; PHP 8.2 through 8.4 (8.4 is recommended); and MySQL 5.5 or newer. The database account used by the installer must have full privileges on the target database while the schema is being created.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Component | Requirement | Practical implication |
|---|---|---|
| Operating system | Maintained Linux distribution | Choose a distribution whose repositories can provide the supported PHP and database versions. The official documentation does not mandate Ubuntu, Debian, or another particular distribution. |
| Web server | Apache, LiteSpeed, or IIS with URL Rewrite | Apache is a common choice on a Linux VPS; whichever server you select must pass rewrite requests correctly. |
| PHP | 8.2–8.4; 8.4 recommended | Verify the command-line and web-server PHP versions separately. A mismatched PHP-FPM or module version can make the installer report false failures. |
| Database | MySQL 5.5 or newer | Create an empty database and an installer account with full privileges on that database. |
| PHP extensions | mysqli plus release-required extensions |
The project repository lists ctype, fileinfo, gd, gettext, iconv, imap, intl, json, mbstring, Zend OPcache, phar, xml, xml-dom, and zip among the recommended modules. |
| DNS and TLS | A hostname pointing to the VPS and HTTPS | Use a stable name such as support.example.com; issue a certificate before inviting agents or customers. |
No authoritative osTicket figure specifies minimum CPU, RAM, storage, or ticket volume. Size the VPS from concurrent agents, attachment sizes, incoming-mail frequency, database growth, and backup-retention requirements, then validate the selected size under realistic load.
Choose the osTicket release before installing
The official download page currently lists osTicket Core v1.17.8 and v1.18.4, both shown as released on June 17, 2026.
| Release listed | Release date shown | How to use the information |
|---|---|---|
| Core v1.17.8 | June 17, 2026 | Use when your integrations or operational policy require the 1.17 branch. Confirm the exact branch requirements before deployment. |
| Core v1.18.4 | June 17, 2026 | Use when you want the newer listed branch and your extensions support it. Confirm the exact branch requirements before deployment. |
The same download page contains older FAQ ranges for the 1.17 and 1.18 series. Treat the dated release listing as the current selector, download from the official project, and read the requirements for the exact archive or branch you choose. Do not mix application files from one branch with a database schema created by another.
Plan the VPS and DNS
Provision a maintained server
- Create a non-end-of-life Linux VPS and apply all distribution security updates.
- Assign a static public address and point an A or AAAA DNS record for your help-desk hostname to that address. Wait for the record to resolve before requesting a certificate.
- Create an administrative account that uses SSH keys, disable password SSH authentication where your provider permits it, and restrict the firewall to the ports you actually need. Public web traffic normally needs TCP 80 and 443; SSH should be limited to trusted source addresses.
- Set the server time zone and enable time synchronization. Correct time is important for cron schedules, certificate validation, and log correlation.
Decide what stays private
Keep MySQL bound to the VPS or a private network, not the public internet. The public surface should be the web server and, if required, SSH from an allow-list. Administrative osTicket access can be further restricted at the VPS firewall, reverse proxy, VPN, or identity layer.
Install and verify the web, PHP, and database stack
Install packages from your distribution
Package names differ by Linux distribution, so use the distribution’s supported repositories and select PHP 8.2, 8.3, or 8.4 rather than accepting an older default. On an Ubuntu-like system, the workflow is conceptually:
sudo apt update
sudo apt upgrade
sudo apt install apache2 mysql-server php php-mysqlInstall the additional packages that provide the required PHP modules: ctype, fileinfo, gd, gettext, iconv, imap, intl, json, mbstring, Zend OPcache, phar, xml, xml-dom, and zip. Some distributions bundle several of these in the core PHP package or expose them under versioned names. Enable Apache’s URL Rewrite module and reload the service using your distribution’s service manager.
Check the versions seen by both PHP interfaces
php -v
php -m
apachectl -Mphp -v checks the CLI interpreter used by cron, while the web installer uses the PHP module or PHP-FPM pool attached to the web server. Confirm that both are in the 8.2–8.4 range and that the required modules appear in php -m. If they differ, correct the Apache module or PHP-FPM virtual-host configuration before opening the installer.
Create the database and installer account
Create an empty database with a dedicated name and a strong, unique password. Grant the installation account full privileges on that database, as required by the installer. Do not reuse a personal administrator account in the application. Record the database host, name, username, password, and port in a password manager; you will enter them once in the browser installer.
Recommended Free Tools
After the schema has been created and you have confirmed normal operation, use a separate database administrator account for maintenance and reduce the application’s runtime account to the least privileges appropriate for your database engine and upgrade process. Test the application after changing privileges instead of assuming the reduction is harmless.
Download and place osTicket
Packaged release deployment
- Download the archive for the selected release from the official osTicket download page.
- Verify that the archive came from the project and has not been replaced by an untrusted third-party package.
- Unpack it into the document root of the HTTPS virtual host, for example
/var/www/osticket. Ensure the web-server account can read the files and that the virtual host points to the directory containing osTicket’s entry point. - Configure the virtual host for the hostname you created, enable URL Rewrite, and reload the web server.
- Issue and install the TLS certificate, then redirect HTTP to HTTPS once the certificate is working.
Do not make the entire document root writable by the web-server account. The installer only needs temporary write access to include/ost-config.php; grant that narrowly and remove it as soon as setup completes.
Run the browser installer
- Open the HTTPS help-desk hostname in a browser. osTicket displays a requirement check before presenting the setup form.
- Resolve every failed PHP extension, version, rewrite, or file-permission check. Refresh the page after changing the server; do not proceed with a warning you do not understand.
- Temporarily make
include/ost-config.phpwritable by the installer. Change ownership or mode only for this file and only for the duration of setup. - Enter the help-desk name, default language, administrator identity, administrator password, and email details. Use an administrator address that is monitored and protected with a unique password.
- Enter the database host, database name, installer username, and password. The installer uses the full privileges granted on the target database to create its tables.
- Submit the form and wait for the success page. The installer writes the database schema and configuration file; do not refresh repeatedly or run two installers at once.
- Sign in to the staff control panel, verify that the administrator can create and update a test ticket, and confirm that the public help-desk page loads over HTTPS.
Harden the installation immediately
- Remove write access from
include/ost-config.php. A typical Linux operation ischmod a-w include/ost-config.php; preserve ownership and use a stricter mode if your deployment policy requires it. - Delete the entire
setup/directory from the document root. Leaving it available allows a future visitor to reach installation code. - Use the administrator interface to enable the system after you have completed the initial checks. An installation that remains disabled will not accept normal customer traffic.
- Confirm from the filesystem that the configuration is not writable and that
setup/no longer exists. - Enforce HTTPS, redirect plain HTTP, and set secure administrative access rules at the firewall or reverse proxy. Keep the database port private.
Repeat the permission and setup-directory checks after every restore, migration, or manual file replacement. A backup or deployment process that restores the old writable state can undo otherwise sound hardening.
Configure incoming email and cron
Set up the osTicket email queue
For POP3 or IMAP intake, configure an osTicket email queue with the mailbox host, port, encryption mode, username, and password supplied by your mail provider. Use a mailbox dedicated to ticket intake and protect its credentials. The queue is processed by PHP through api/cron.php; merely creating the mailbox does not make osTicket poll it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Preferred method: run cron locally
Schedule the command on the VPS so no public endpoint has to be invoked by a third-party scheduler. The official example runs every five minutes. Adapt the PHP executable and application path to your server:
*/5 * * * * /usr/bin/php /var/www/osticket/api/cron.phpInstall the entry for the account and environment that can read the osTicket files and reach the mail server. Test the exact command manually first, then watch the osTicket system log, the web-server/PHP log, and the mail-server log for a complete polling cycle. A successful cron process should fetch eligible messages and create or update tickets according to your queue rules.
When an external scheduler must call a URL
Some hosting panels can run only an HTTP request. In that case, the official guide requires both an allowed originating IP address and an API key supplied as the request’s User-Agent. Configure the permitted source IP and key in osTicket’s API settings, then have the scheduler call the HTTPS endpoint with the key as its User-Agent. Do not put the key in a query string or publish it in a screenshot.
Run one manual request from the scheduler’s real source address, inspect osTicket and mail logs, and verify that exactly one polling cycle occurred. A 403 response generally means the source IP or User-Agent key does not match the configured values. Return the scheduler to its intended five-minute interval only after the manual test succeeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Packaged releases versus repository deployment
| Approach | Upgrade path | Control and maintenance | Security and backup responsibility |
|---|---|---|---|
| Packaged release archive | Download the next approved archive, stage it, and migrate or replace files according to that release’s instructions. | Simple, explicit release boundaries; manual file handling is required. | You control the archive and deployment timing. Back up the database, attachments, and code before changing files. |
| Repository deployment | Pull the selected branch and redeploy with the project’s deployment command. | Convenient for repeatable deployments, but requires Git, command-line access, and discipline around branch selection. | Protect repository credentials and deployment paths. Backups remain your responsibility. |
The official repository documents a source deployment path:
git clone <official-osTicket-repository>
cd osticket
php manage.php deploy --setup /var/www/htdocs/osticket/Use the project’s actual repository URL and your intended branch; do not copy an unverified clone. After deployment and setup, delete the deployed setup directory. For an upgrade, pull the repository, redeploy, and follow the release’s migration requirements rather than overwriting a live installation blindly. The project README describes support for “bleeding-edge installations,” which is useful for development workflows but should not be confused with a stability guarantee for a production help desk.
Backups, upgrades, and routine operations
Back up all three parts
Before every upgrade, back up the database, the attachment directory, and the complete codebase. A database-only backup cannot restore uploaded evidence; a code-only backup cannot restore ticket data. Store backups outside the VPS, encrypt them, restrict access, and retain enough versions to recover from an unnoticed corruption.
Rehearse restoration
- Restore a recent database backup to an isolated database server or temporary VPS.
- Restore attachments and the matching code version.
- Point a test virtual host at the restored copy and verify login, ticket display, attachment downloads, and email polling without sending production mail.
- Document the restore time and any manual steps. Update the runbook before the next upgrade.
Monitor the logs that explain failures
- Web-server access and error logs for 4xx, 5xx, rewrite, and permission errors.
- PHP logs for fatal errors, missing extensions, memory failures, and execution-time limits.
- Database logs for authentication, connection, and schema errors.
- osTicket system logs for staff actions, mail fetching, and application errors.
- Mail-server logs for POP3/IMAP authentication, connection rejection, and delivery delays.
Troubleshooting common installation problems
| Symptom | Likely cause | Checks and corrective action |
|---|---|---|
| The requirement page flags PHP | The web server is using an unsupported or different PHP version, or an extension is missing. | Compare php -v with the PHP version reported by a controlled web diagnostic, enable the listed modules, restart PHP-FPM or Apache, and refresh the installer. |
| Installer cannot write configuration | include/ost-config.php is absent, owned by the wrong account, or not writable. |
Create or correct the file as instructed by the installer, grant temporary write access only to that file, and remove it after setup. |
| Database connection fails | Wrong host, port, password, database name, or insufficient privileges. | Test a login from the VPS, confirm the account has full privileges on the target database during installation, and verify that MySQL is listening on the expected private address. |
| Clean URLs return 404 | URL Rewrite is disabled or the virtual host does not permit the application’s rewrite rules. | Enable the supported rewrite module, check the virtual-host configuration, reload the web server, and retest over HTTPS. |
| Blank page after login | PHP fatal error, incompatible extension, permissions, or an incomplete file deployment. | Read the PHP and web-server error logs, verify the selected release’s PHP range and modules, check file ownership, and redeploy from a trusted archive if files are missing. |
| Cron runs but no tickets arrive | Wrong PHP path, wrong application path, mailbox authentication failure, or a queue rule that excludes messages. | Run the exact cron command manually, inspect osTicket and mail logs, verify POP3/IMAP credentials and encryption, then restore the five-minute schedule. |
| External cron receives 403 | The scheduler’s source IP is not allowed or its User-Agent does not contain the configured API key. | Allow the real source address, send the key as User-Agent, test once, and keep the key out of URLs and logs where possible. |
Production readiness checklist
- Selected a release and verified its exact PHP, database, web-server, and extension requirements.
- Applied operating-system updates and restricted SSH and database exposure.
- Configured DNS and working HTTPS for the help-desk hostname.
- Confirmed the installer account had full privileges only during schema creation.
- Removed write access from
include/ost-config.php. - Deleted
setup/and enabled the system. - Tested administrator login, customer ticket submission, replies, and attachments.
- Configured the email queue and a five-minute local cron, or secured external polling with source-IP and User-Agent API-key controls.
- Scheduled encrypted backups of the database, attachments, and codebase and completed a restoration test.
- Know which web, PHP, database, osTicket, and mail logs to inspect when a component fails.
Bottom line
A dependable osTicket VPS is less about a one-click installer than about matching the supported stack, limiting permissions, deleting setup artifacts, securing mail polling, and proving that backups restore. Start with the current 1.17.8 or 1.18.4 release listing dated June 17, 2026, verify the branch requirements, and treat every upgrade as a database, attachment, and code deployment that needs a tested rollback.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
