How to Install osTicket
osTicket is the most widely deployed open source help desk, running at over 15,000 organizations worldwide. Its PHP and MySQL architecture means it runs on the most common web hosting stack available, keeping infrastructure costs low and administrative overhead minimal. This guide assumes you have root or sudo access to a fresh Ubuntu 22.04 LTS server.
Step 1: Prepare the Server
Start with a fresh Ubuntu 22.04 LTS server. A VPS with 1 GB of RAM, 1 CPU core, and 25 GB of SSD storage is sufficient for teams handling up to several hundred tickets per day. Update the system packages to ensure you have the latest security patches and package lists.
Run the standard update commands to refresh the package index and upgrade all installed packages. This ensures your server starts from a known-good state. After the update completes, reboot the server if the kernel was updated, then reconnect over SSH.
Set the server timezone to match your team's location so that ticket timestamps display correctly. Configure the hostname to something meaningful for identification in monitoring tools and log files.
Step 2: Install Nginx, PHP, and MySQL
Install Nginx from the default Ubuntu repository. Nginx will serve the osTicket frontend and proxy PHP requests to PHP-FPM. After installation, verify that Nginx is running by checking its status with systemctl.
Install MySQL 8.0 from the Ubuntu repository. Run the secure installation script to set a root password, remove anonymous users, disable remote root login, and remove the test database. These steps eliminate the most common MySQL security issues in a single command.
Install PHP 8.1 with the extensions that osTicket requires. The essential extensions are php-fpm for FastCGI processing, php-mysql for database connectivity, php-gd for image manipulation, php-imap for email fetching, php-mbstring for multibyte string handling, php-xml for XML processing, php-curl for HTTP requests, php-intl for internationalization, php-apcu for opcode caching, and php-zip for archive handling.
Verify the PHP installation by checking the version number and confirming that all required extensions are loaded. You can list loaded extensions with the php -m command and cross-reference against osTicket's requirements page. Missing a single extension will cause the installer to fail or specific features to break after installation.
Step 3: Create the Database
Log into MySQL as root and create a dedicated database for osTicket. Use a descriptive name like osticket_db. Create a database user with a strong, random password and grant it full privileges on the osTicket database only. This user should not have access to any other databases on the server.
The database collation should be utf8mb4_unicode_ci to properly handle international characters in ticket content and customer names. Flush the privilege tables after granting permissions to ensure they take effect immediately. Note down the database name, username, and password because you will need them during the web installer step.
Step 4: Download and Extract osTicket
Download the latest stable release from the official osTicket GitHub repository. As of mid-2026, the current stable release is the 1.18.x line. Use wget or curl to download the release archive directly to your server, then extract it to your chosen web root directory.
Create the web root directory, typically at /var/www/osticket, and extract the archive contents there. The archive contains two directories: upload (the application files) and scripts (maintenance utilities). The web server should point to the upload directory as its document root.
Copy the sample configuration file from include/ost-sampleconfig.php to include/ost-config.php. The web installer needs this file to exist and be writable. Set its permissions to 0666 temporarily so the installer can write the database configuration. You will tighten these permissions after installation is complete.
Set the ownership of the entire osTicket directory to the www-data user and group so the web server can read the files and write to the directories it needs. The upload/include directory and the ost-config.php file specifically need to be writable during installation.
Step 5: Configure Nginx and Run the Installer
Create an Nginx server block configuration for osTicket. Set the document root to the upload directory within your osTicket installation. Configure PHP-FPM to handle .php files by adding a location block that passes requests to the PHP-FPM socket. Add rewrite rules to handle osTicket's URL routing, which uses a single index.php entry point with query string parameters.
Enable the server block by creating a symbolic link in the sites-enabled directory. Test the Nginx configuration for syntax errors, then reload Nginx to apply the changes. At this point, navigating to your server's IP address or domain name in a browser should show the osTicket installation wizard.
The web installer walks through four steps. First, it checks system prerequisites and shows green checkmarks for satisfied requirements and red warnings for missing components. Fix any red items before proceeding. Second, it asks for your database credentials: the MySQL hostname (usually localhost), database name, username, and password you created in step 3. Third, it asks for the administrator account details: name, email address, username, and password. Fourth, it creates the database tables, writes the configuration, and confirms successful installation.
Save the administrator credentials in a password manager immediately. The installer displays the staff login URL and client portal URL on the final confirmation page. Bookmark both.
Step 6: Configure Email and Cron
Email integration is what makes osTicket useful. Without it, you are manually creating tickets, which defeats the purpose of a help desk. osTicket supports both IMAP email fetching and POP3, though IMAP is preferred because it leaves messages on the mail server and handles folder management better.
In the osTicket admin panel, navigate to Emails and add your support email address. Enter the IMAP server details: hostname, port (993 for SSL), username, and password. For Gmail, you need to use an app-specific password since basic auth is disabled. For Microsoft 365, you need to register an OAuth application. For standard IMAP servers, the email account credentials work directly.
Configure outbound SMTP under Admin > Emails > Settings. Enter your SMTP server address, port (587 for TLS), and authentication credentials. If you are using a transactional email service like Amazon SES or Mailgun, enter their SMTP credentials here. Test by sending a test email from the admin panel and verifying delivery.
Set up the cron job that triggers email fetching and other scheduled tasks. osTicket needs a cron entry that hits its API endpoint on a regular schedule, typically every 2 to 5 minutes. Create a crontab entry for the www-data user that calls the cron.php file with the PHP CLI. This single cron job handles email fetching, overdue ticket alerts, auto-close rules, and other time-based automation.
Step 7: Secure the Installation
Delete the entire setup directory from the osTicket installation. The installer warns you to do this, and leaving it in place is a security vulnerability that could allow someone to reinstall the application or access configuration details.
Change the ost-config.php file permissions to read-only (0644) now that installation is complete. The installer needed write access to save the database configuration, but that file should never be modified through the web server again.
Install SSL certificates using Certbot with the Nginx plugin. Run Certbot, select your domain, and let it automatically configure HTTPS and set up the renewal cron job. After SSL is active, update the osTicket admin settings to reflect the HTTPS URL. Redirect all HTTP traffic to HTTPS in the Nginx configuration to ensure all connections are encrypted.
Configure the UFW firewall to allow only SSH (port 22), HTTP (port 80), and HTTPS (port 443). Deny all other incoming traffic. Enable the firewall and verify the rules are active. This limits the attack surface to only the services your help desk needs to expose.
Review the PHP configuration for production security. Disable display_errors to prevent error messages from exposing file paths and configuration details to visitors. Set expose_php to Off so the server does not advertise the PHP version in response headers. Set open_basedir to restrict PHP's file access to the osTicket directory and the /tmp directory only.
Post-Installation Configuration
With osTicket installed and secured, configure the application itself for your team. Start in the admin panel by creating departments that match your support structure, such as General Support, Billing, and Technical. Create help topics that customers select when submitting tickets, like Account Issues, Feature Requests, and Bug Reports. Each help topic can have its own custom form with specific fields relevant to that type of request.
Set up SLA plans that define your response and resolution time commitments. Create different plans for different priority levels, such as 4 hours for urgent, 8 hours for high, 24 hours for normal, and 48 hours for low. Assign SLA plans to help topics or departments so they apply automatically when tickets are created.
Create agent accounts for your support staff. Assign each agent to the appropriate department and set their permission level. osTicket supports granular permissions that control who can create, edit, assign, close, and delete tickets, as well as who can access admin settings, manage users, and run reports.
Configure auto-responders for ticket creation and ticket assignment. The creation auto-responder tells the customer their message was received and includes a ticket number for reference. The assignment notification tells the agent they have a new ticket. Customize these templates with your brand name, support hours, and any relevant links.
osTicket installs cleanly on a standard LEMP stack and needs only a single cron job for ongoing operation. The most important post-install steps are deleting the setup directory, locking down file permissions, configuring SSL, and connecting your support email. Once those four items are done, you have a production-ready help desk.