Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To install sysPass on Ubuntu, choose either a native Apache, PHP and MariaDB deployment or a Docker Compose deployment. Native installation integrates with Ubuntu and gives you direct control over the web server, PHP and database; Compose is generally more repeatable because the application and database run as services with persistent volumes. In both cases, enable HTTPS before exposing the login page, use a strong master password, restrict configuration and backup files, keep the database private, and test restores.
The published sysPass 3.1 Debian instructions require a web server with SSL, MariaDB 10.1 or newer, PHP 7.0 or newer, and PHP modules for MySQL, cURL, JSON, GD, XML, mbstring, intl and readline. Those requirements come from an older Debian-era guide, so treat them as a compatibility baseline rather than a promise that every current Ubuntu and PHP release is supported. Confirm the exact versions for the sysPass release you intend to deploy before production use.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is sysPass, and where does it run?
sysPass is a self-hosted, PHP web password manager for teams and individuals. It stores passwords with bidirectional encryption and provides user, group and profile management, two-factor authentication, directory authentication through MySQL, OpenLDAP or Active Directory, and a JSON-RPC API. The project describes it as a “PHP web based Password Manager for business and personal use.”
It is not an Ubuntu desktop package that appears in the graphical application store. You deploy a web application and its database, then access it through a browser. The official installation index covers prerequisites, dependencies, environment configuration and permissions at the sysPass installation documentation.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What should I check before installing sysPass on Ubuntu?
Prepare the host, decide how the database will be managed, and verify compatibility before copying any application files. A small mistake at this stage can leave the installer working while upgrades, mail or backups fail later.
Confirm the operating-system and package situation
- Use a supported Ubuntu release with security updates enabled.
- Install a fully updated system and record the Ubuntu release, PHP version and MariaDB version. The compatibility pages available for sysPass are old, so do not assume that the newest Ubuntu PHP package is accepted by your chosen sysPass release.
- Reserve a DNS name or internal hostname for the service. If users will connect from outside the private network, plan a trusted TLS certificate and firewall rules before publishing the login page.
- Allocate storage for the database, encrypted password records, configuration, backups and container volumes if you choose Compose. Monitor free space because a full database or volume can prevent logins and backups.
Use the documented dependency baseline as a starting point
The Debian guide lists MariaDB 10.1 or newer, PHP 7.0 or newer, and PHP support for MySQL, cURL, JSON, GD, XML, mbstring, intl and readline. LDAP is optional when you need directory authentication. mcrypt is optional for importing older XML exports. Package names differ between Ubuntu releases; check the package candidate and the PHP extension actually loaded by the web server rather than installing modules for a different PHP version.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose a recovery plan
Before the first production login, decide where encrypted application backups and database backups will be stored, who can restore them, and how you will test a restore on a separate host. A backup that has never been restored is only an assumption.
Should I install sysPass natively or with Docker Compose?
Choose native installation when you want sysPass to be part of the Ubuntu web stack and are comfortable maintaining Apache, PHP and MariaDB. Choose Compose when you prefer an isolated, repeatable application-and-database bundle and are willing to manage container images, volumes and lifecycle commands.
| Decision area | Native Apache/PHP/MariaDB | Docker Compose |
|---|---|---|
| Maintenance ownership | You patch Ubuntu, Apache, PHP, MariaDB and sysPass separately. | You patch the host and deliberately update application and database images. |
| Upgrade and rollback | Package and application changes are integrated with the host; rollback requires careful package or file restoration. | Compose files and image tags can make version changes repeatable; rollback still requires compatible persistent data and a tested backup. |
| Isolation | sysPass shares the host services and filesystem permissions. | Services are separated by containers, but Docker itself and mounted volumes become additional security responsibilities. |
| Backups | Back up the MariaDB database plus sysPass configuration and backup directories. | Back up the database volume and every persistent application volume, including configuration and backups. |
| Administrator control | Maximum control over Apache virtual hosts, PHP settings, TLS and MariaDB. | Less host-level tuning, but more control over a reproducible service definition. |
| Best fit | An Ubuntu administrator who already operates a web stack. | An administrator who wants a bundled deployment and understands Docker networking and volumes. |
The project’s Docker guidance calls Compose the recommended way to deploy a complete environment. However, the older Docker repository metadata identifies Apache 2.4, PHP 7.3–7.4 and MariaDB 10.2; those historical image details are not a current support guarantee. Check release notes and image maintenance status before pinning an image for production.
How do I install sysPass natively on Ubuntu?
The native route has five phases: install compatible services and modules, secure the host, create a database, place sysPass in the web root with restrictive permissions, and finish the browser installer.
Recommended Free Tools
1. Update Ubuntu and install the service stack
Start with updates and the core services. The extension package names below are common Ubuntu names, but verify them against the PHP version supplied by your release and the sysPass release notes.
sudo apt update
sudo apt full-upgrade
sudo apt install apache2 mariadb-server php php-mysql php-curl php-gd php-xml php-mbstring php-intl php-readlineJSON support may be built into the PHP package on newer Ubuntu releases, so an install command that names a separate JSON package can fail even though JSON is available. If you need LDAP authentication, add the LDAP extension that matches the installed PHP version. Install mcrypt only if you must import an older XML export and your supported PHP version provides a compatible implementation.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Check what the command installed:
php -v
php -m
systemctl status apache2 --no-pager
systemctl status mariadb --no-pagerLook for the required modules in the web-server PHP environment, not only the command-line environment. A different PHP version or configuration can be selected by Apache.
2. Enable HTTPS before opening the application
Configure an Apache virtual host for the sysPass hostname and enable TLS before users sign in. Redirect plain HTTP to HTTPS, restrict the host with your firewall, and avoid exposing MariaDB to the network. If a reverse proxy terminates TLS, forward only the headers and ports required by your architecture and keep the application host reachable only from that proxy or trusted network.
3. Create a dedicated MariaDB database and account
Use a database and account created solely for sysPass. Do not reuse the MariaDB administrator account, and do not copy a password from a tutorial into production.
sudo mariadbCREATE DATABASE syspass_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'syspass_user'@'localhost' IDENTIFIED BY 'replace-with-a-long-random-password';
GRANT ALL PRIVILEGES ON syspass_db.* TO 'syspass_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;The exact character set and collation should remain compatible with the sysPass release you install. Store the database password in your administrator password vault; it is separate from the sysPass master password.
4. Download and place the sysPass release
Obtain the current release from the official project release path or clone the official repository. Verify the release archive or tag before unpacking it. Place the application under a dedicated Apache web root rather than mixing it with unrelated sites, for example:
sudo mkdir -p /var/www/syspass
sudo tar -xzf syspass-release.tar.gz -C /var/www/syspass --strip-components=1The archive’s directory layout can vary, so confirm that the directory containing the application entry point is the one exposed by Apache. Do not guess a release number or use an obsolete archive simply because an old guide names it.
5. Apply ownership and restrictive permissions
Apache must be able to read the application and write only where sysPass requires it. The installation guide specifically calls out app/config and app/backup; protect both directories from other local users and from direct web access where your virtual-host layout permits.
sudo chown -R www-data:www-data /var/www/syspass
sudo find /var/www/syspass -type d -exec chmod 750 {} ;
sudo find /var/www/syspass -type f -exec chmod 640 {} ;
sudo chmod -R 750 /var/www/syspass/app/config /var/www/syspass/app/backupThese commands are a conservative starting point, not a substitute for the permissions documented by the exact release. If the installer reports that a specific directory is not writable, grant the narrowest write permission needed and remove temporary write access after installation. Never make the whole web root world-writable.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
6. Run the browser installer
Browse to the HTTPS hostname. The installer should ask for the database host, database name, database user and database password, then create the schema. Use a long, unique sysPass master password: it protects the application’s encrypted password store and should not be reused for Ubuntu, MariaDB or your email account.
After setup, create individual user accounts and groups instead of sharing an administrator login. Enable two-factor authentication where available, configure mail only after verifying the sender and relay settings, and test a login, password retrieval, password change and logout from a non-administrator account.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How do I deploy sysPass with Docker Compose on Ubuntu?
Compose deploys the application and database as services. It reduces host-package coupling, but it does not remove the need to manage TLS, secrets, updates and backups.
1. Install and verify Docker and Compose
Install Docker Engine and the Compose implementation recommended for your Ubuntu release. Confirm that the Docker daemon starts at boot and that your administrative account can run Compose. Avoid granting broad Docker access to untrusted users: control of the Docker socket is effectively high-privilege access to the host.
2. Obtain a maintained Compose definition
Use the Compose file supplied with the sysPass project or its current documentation, then read every image name, tag, environment variable, port mapping and volume declaration. The documented pattern is:
docker-compose -p syspass -f docker-compose.yml up -dSome current Docker installations use the equivalent docker compose subcommand instead of the hyphenated command. Use the syntax provided by the Compose version installed on your host.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDo not copy an example database password into production. Replace sample secrets with long random values stored outside the Compose file when the project supports secret files or environment injection. Pin a currently maintained image after checking its release notes; do not blindly use historical tags that bundle PHP 7.3–7.4 or MariaDB 10.2.
3. Keep database and application ports private
Publish only the web service to the network that needs it. Do not map MariaDB’s port to the public interface unless a specific administrative task requires it, and then restrict it with firewall rules and a short maintenance window. Put the web service behind HTTPS, either in the container stack or in a carefully configured reverse proxy.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
4. Start the stack and inspect logs
docker-compose -p syspass -f docker-compose.yml up -d
docker-compose -p syspass -f docker-compose.yml ps
docker-compose -p syspass -f docker-compose.yml logs --tail=200Wait for the database health check or startup process to complete before opening the web interface. If the application repeatedly restarts, inspect the database credentials, file permissions on mounted volumes, image compatibility and available disk space before changing passwords or deleting data.
5. Back up every persistent volume
The Compose documentation relies on persistent volumes for configuration, backups and database data. Identify those volumes with:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker volume lsBack up the database using a database-aware dump as well as the application’s configuration and backup volumes. A raw volume copy alone may capture an inconsistent database if the service is writing. Schedule a maintenance window or use the database’s supported backup method, then copy the resulting encrypted backup to storage that the Docker host cannot erase with a single command.
How do I secure a self-hosted sysPass installation?
Security is part of installation, not a later optimization. Protect the web session, the master secret, the database, the filesystem and the recovery path.
Web and network controls
- Require HTTPS and redirect HTTP to HTTPS. Renew certificates before expiry and test renewal without disabling certificate validation.
- Allow inbound web traffic only on the ports and interfaces required by your users or reverse proxy.
- Keep MariaDB bound to localhost or an internal container network. Never expose it as an unnecessary public service.
- Apply Ubuntu, Apache, PHP, MariaDB, Docker and sysPass security updates on a defined schedule.
Identity and secrets
- Use a unique, high-entropy master password and store an emergency recovery copy under your organization’s access-control policy.
- Give each person an individual sysPass account, assign the least-privileged profile and remove departed users promptly.
- Enable two-factor authentication and directory authentication only after testing a local break-glass administrator account.
- Keep the MariaDB credential, TLS private key and sysPass master password in separate protected locations.
Filesystem and container controls
- Restrict
app/config,app/backupand equivalent container mounts to the service account and authorized administrators. - Prevent direct web downloads of configuration, database dumps and backup archives.
- For Docker, restrict access to the Docker socket, use persistent volumes, pin maintained images and review every host bind mount.
- Monitor logs for repeated authentication failures, database errors, permission changes and unexpected container restarts.
How should I back up, upgrade and roll back sysPass?
Back up before every application, PHP, MariaDB, image or Compose-file change. A usable backup includes the database and the sysPass configuration and backup data, not just the web files.
Native deployment
- Put the site in maintenance mode or otherwise prevent writes.
- Export the MariaDB database with a consistent, tested dump.
- Copy the sysPass configuration and backup directories with ownership and permissions preserved.
- Record Ubuntu, PHP, MariaDB, Apache and sysPass versions.
- Upgrade one layer at a time, check the browser login and run a restore test before reopening access.
Compose deployment
- Save the Compose file, environment or secret definitions and the exact image tags.
- Back up the database through a database-aware method and archive all persistent volumes.
- Pull the selected images without replacing the running services until the backup is verified.
- Recreate the stack during a maintenance window and inspect service health and logs.
- For rollback, restore the previous Compose definition and image tags only alongside a database backup known to match that application version.
Do not treat changing an image tag as a rollback plan. Database migrations can be one-way; restoring the prior application image against a newer schema may fail or silently corrupt behavior.
What are the common installation failures and fixes?
The installer reports a missing PHP module
Check the PHP version loaded by Apache and compare its module list with the sysPass requirements. Install the matching versioned extension, restart Apache, and reload the installer. A module visible in php -m may still be absent from Apache if the command-line and web-server PHP configurations differ.
Database authentication fails
Verify the database name, username, host and password exactly as created. Confirm that the account is allowed from the host shown in the error; localhost and 127.0.0.1 can use different connection behavior. Test the account with the MariaDB client, then remove any temporary administrative credentials.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Apache shows a blank page or download instead of sysPass
Confirm that PHP is enabled for the virtual host, the document root points to the correct extracted directory, required rewrite behavior is configured, and Apache’s error log contains no permission or PHP fatal error. Do not solve a permission error by making the entire web root writable.
Docker containers restart repeatedly
Run the Compose status and log commands, then check environment-variable names, database readiness, volume ownership, image architecture and free disk space. If the image is based on an old PHP or MariaDB combination, select a currently maintained release supported by the project rather than forcing the old image to run on a new host.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Users cannot receive mail
Verify the SMTP host, port, encryption mode, sender policy and credentials, then test delivery to an internal mailbox. Check the application and container logs without exposing passwords. Mail is not required for the first local login, so finish core access and backup testing before troubleshooting notifications.
What should I verify before declaring the installation complete?
- The sysPass login page loads only over HTTPS.
- The installed PHP version and required modules match the selected sysPass release, with any uncertainty documented.
- The database account is dedicated, has only the required database privileges and is not publicly reachable.
- The master password is unique, stored safely and known to the designated administrators.
- Two-factor authentication, user groups and least-privilege profiles have been tested.
- A password record can be created, retrieved and changed by an authorized test user.
- Application configuration and backup directories are not downloadable and have restrictive ownership.
- A database backup and application backup have completed, and a restore has been performed on a non-production instance.
- For Compose, all required volumes are persistent, image tags are recorded and logs show healthy services.
- Ubuntu, web-server, PHP, database and container update responsibilities are assigned to a person or team.
Frequently Asked Questions
Can sysPass run without Apache?
The documented native stack is based on a web server with SSL, PHP and MariaDB, and the project’s Compose examples bundle Apache with PHP. A different supported web server may be possible only if the specific sysPass release documents that configuration; do not assume a generic PHP-FPM setup is equivalent.
Do I need LDAP or Active Directory to use sysPass?
No. LDAP is optional, and a local sysPass account can be used for initial setup and emergency recovery. Add directory authentication only after local administration, two-factor authentication and a break-glass login have been tested.
Where should sysPass backups be stored?
Keep at least one encrypted copy separate from the Ubuntu or Docker host, with access limited to recovery administrators. Retain the database backup together with the matching application configuration and record which sysPass version produced it.
Is the old PHP 7.3–7.4 Docker image safe to use on a new Ubuntu server?
The repository metadata identifying PHP 7.3–7.4 is historical and does not establish current support or security maintenance. Use a maintained image and release combination confirmed by the project, or choose a native stack whose PHP and MariaDB versions are explicitly supported.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
