osTicket

sudo systemctl is-active nginx php8.3-fpm mariadb
sudo ss -tlnp | grep ':80 ' php -r 'echo "php ".PHP_VERSION."\n";'

On the first boot of your instance, a one-shot service generates a fresh MariaDB password, a fresh configuration secret and a fresh administrator password. All three are unique to that instance. The service writes them to a file that only root can read.

sudo cat /root/osticket-credentials.txt

Note the osticket.admin.user (ostadmin) and the osticket.admin.pass value. The passwords are unique on every instance.

The web installer has already imported the schema and the default data. Departments, help topics, an SLA, agent roles and ticket statuses are in place, and the administrator agent is created and ready. To check the seeded data, run:

sudo mariadb -N osticket -e "SELECT 'help_topics', COUNT(*) FROM ost_help_topic UNION ALL SELECT 'departments', COUNT(*) FROM ost_department UNION ALL SELECT 'agents', COUNT(*) FROM ost_staff;"

nginx serves an unauthenticated health endpoint for load balancer probes, the agent control panel at /scp/ and the customer portal at /. The MariaDB database lives on a dedicated data disk, separate from the operating system disk. To check the endpoints and the data disk, run:

curl -s -o /dev/null -w 'healthz %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'agent %{http_code}\n' http://127.0.0.1/scp/login.php
sudo findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql

Browse to http://<vm-ip>/scp/ and sign in as ostadmin with the password from Step 5.

After you sign in, you land on the open ticket queue, the core of the helpdesk. It lists each ticket with its number, subject, sender, priority and assignee.

Open a ticket to read the customer message thread and reply. The reply editor supports canned responses, rich text, agent-only notes and file attachments. You can set the department, status and assignee from the same view.

In the admin panel, you configure departments, help topics, SLAs, email and agents. The System Settings page confirms the running osTicket version and your helpdesk name.

• Departments and help topics: create the queues that inbound tickets route into, under Admin Panel, then Manage.
• Inbound email: connect a mailbox so that email becomes tickets, under Admin Panel, then Emails. Use IMAP fetch or a piped mailbox.
• Agents and teams: add agents and set their roles and permissions under the Agents tab.
• Canned responses and knowledge base: write canned replies and publish knowledge base articles for the customer portal.

These are the key components and their locations:

• osTicket install: /var/www/osticket/
• Configuration: /var/www/osticket/include/ost-config.php (read-only, mode 0440)
• nginx vhost: /etc/nginx/sites-available/sac-osticket
• nginx logs: /var/log/nginx/
• MariaDB data: /var/lib/mysql/ (dedicated data disk)
• First-boot script: /usr/local/sbin/osticket-firstboot.sh
• Cron timer: osticket-cron.timer (queued tasks and email fetch every minute)
• Credentials: /root/osticket-credentials.txt (mode 0600 root:root)

• HTTPS: install certbot and obtain a Let's Encrypt certificate, then follow the nginx prompts: sudo apt-get install -y certbot python3-certbot-nginx && sudo certbot --nginx
• Restrict the network security group. Open ports 80 and 443 only to the addresses that need them, and limit port 22 to your management range.
• Rotate the administrator password from the agent profile after you sign in, and keep the customer portal registration policy tight.
• Keep MariaDB on loopback (127.0.0.1). The network security group never opens port 3306.
• Patch monthly: sudo apt-get update && sudo apt-get upgrade && sudo reboot

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for osTicket. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. The osTicket workload is PHP and MariaDB heavy, and email piping and report generation benefit from memory. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

This command launches an instance from the SecureAnyCloud osTicket Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=osticket-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the public address once the instance is running: aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

• osTicket 1.18.3 on Ubuntu 24.04: ubuntu

Connect with ssh -i <path-to-key.pem> ubuntu@<instance-public-ip>. Substitute your key path and the instance's public IP address.

On first boot, the image writes a per-instance administrator password to a file that only root can read. Read it with:

sudo cat /root/osticket-credentials.txt

The file lists the agent control panel URL, the customer portal URL, the administrator username (ostadmin) and password, and the MariaDB database name, user and password. Store the administrator password in your password manager and treat the file as sensitive.

Three systemd units serve osTicket. Confirm that they are active:

systemctl is-active nginx php8.3-fpm mariadb

Each line returns active. To confirm that osTicket is listening on port 80, run ss -tlnp | grep ':80'. To confirm the PHP version, run php -v.

A systemd timer runs the osTicket cron every minute. The cron processes queued tasks and fetches email. Check the timer:

systemctl status osticket-cron.timer

Browse to http://<instance-public-ip>/scp/ to reach the agent control panel, the staff sign-in page. Sign in with the username ostadmin and the password from /root/osticket-credentials.txt.

After you sign in, you land on the Tickets view. It lists open tickets with their number, subject, requester, priority and assignee. The top navigation gives you Dashboard, Users, Tasks, Tickets and Knowledgebase. The Admin Panel link in the top right opens the configuration area.

The customer-facing support portal is at http://<instance-public-ip>/. Your customers open and track tickets there and browse the knowledge base.

The first-boot password is unique to your instance, but you should still set your own. In the agent control panel, open the Profile link in the top right. Set your name and a personal email address, then change the password to one you control. osTicket stores agent passwords as bcrypt hashes.

Open Admin Panel, then Settings, then System. Set the Helpdesk URL to the address your users will use (for example https://support.example.com/). Set the Helpdesk Name/Title to your organization's name. Then open Admin Panel, Settings, Emails and set the default system email address that outbound notifications are sent from. These are the first settings to configure on a new helpdesk.

osTicket routes tickets using departments and help topics.

• Departments (Admin Panel, Agents, Departments) group your agents and own ticket queues, for example Support, Billing or IT.
• Help topics (Admin Panel, Manage, Help Topics) are what a customer chooses when opening a ticket. Each one maps to a department, an SLA and a ticket form.
• Agents (Admin Panel, Agents, Agents) are your staff. Add an agent and assign them to a department and a role. They then receive their own sign-in.

Create the departments your team is organized around, a help topic for each request type, and an agent record for each member of staff.

From the Tickets tab, open any ticket to see the full thread, the requester, the status, priority, department, SLA plan and due date. Use Post Reply to respond to the customer. Use the note option for a note that only agents see. Use the toolbar to assign, transfer, change status or set priority. Canned responses speed up common replies. Configure them under Admin Panel, Manage, Canned Responses.

To turn inbound email into tickets, add a system email under Admin Panel, Settings, Emails, Emails. osTicket can fetch mail from an IMAP or POP mailbox on the schedule the cron timer runs. The php-imap extension that this image ships makes that work. osTicket can also receive mail piped in from your MTA. Enter the mailbox host, login and folder, choose the department and help topic that new mail maps to, and enable fetching. The cron timer already running on this instance polls the mailbox each minute.

Your customers use the portal at http://<instance-public-ip>/. There they can open a new ticket, check the status of an existing ticket and browse the knowledge base. Build out the knowledge base under Knowledgebase in the agent control panel. Published FAQ articles appear on the portal and deflect repetitive tickets.

For production use, serve osTicket over HTTPS. Point a DNS name at the instance's public address, then install Certbot and obtain a certificate. The commands below are illustrative. Replace support.example.com with your domain and run them as root. They involve interactive prompts and a domain you own, so run them yourself rather than copying them blindly.

Install Certbot and the nginx plugin, then request a certificate. Certbot edits the nginx site in place and reloads nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx

sudo certbot --nginx -d support.example.com

After HTTPS is live, set Force HTTPS under Admin Panel, Settings, System so that all traffic redirects to the secure URL. Then update the Helpdesk URL to the https:// address.

The osTicket database lives in MariaDB on the /var/lib/mysql volume, and the application files and attachments are under /var/www/osticket. Back up both. A simple database dump is:

sudo mysqldump --single-transaction osticket | gzip > osticket-db-$(date +%F).sql.gz

Take EBS snapshots of the data volumes for point-in-time recovery, and take a snapshot before any osTicket version upgrade. Keep the operating system patched with sudo apt-get update && sudo apt-get -y upgrade.

The application and database tiers are on dedicated EBS volumes, and you can resize each one independently. To inspect them, run:

df -h /var/lib/mysql /var/www

/var/lib/mysql holds the MariaDB data directory. /var/www holds the osTicket code, document root and attachments. To grow a tier, modify the EBS volume in the EC2 console, then extend the filesystem with sudo resize2fs <device>.