Skip to main contentSkip to navigation
[email protected]
Client AreaSupport
Hosting Mammoth
HostingMammothYour Data, Our Responsibility
Home
Solutions
Hosting Services
Store
Pricing
About
Blog
API
Contact

Stay Ahead of the Curve

Get the latest insights on cybersecurity, AI innovations, and enterprise data solutions delivered to your inbox.

Hosting Mammoth
HostingMammothEnterprise Solutions

Enterprise-grade data solutions. Hosting, recovery, cybersecurity, and AI-powered services for businesses worldwide.

[email protected]
Sun - Fri, 9:00am - 5:00pm

Services

  • Cloud Hosting
  • Data Recovery
  • Cybersecurity
  • Legal Support
  • MSP Services
  • Web Development
  • AI Services
  • Free Server Migration

Hosting

  • VPS Hosting (NVMe SSD)
  • VDS Hosting (NVMe)
  • Storage VPS (High SSD)
  • GPU Servers
  • Managed Services
  • Cloud Firewall
  • Load Balancer
  • One-Click Apps
  • n8n Hosting
  • Object Storage
  • FAQ

Company

  • Store
  • Pricing
  • About Us
  • Locations
  • Blog
  • Testimonials
  • Contact
  • Affiliate Program
  • White-Label
  • Terms of Service
  • Privacy Policy
  • Browser Cookies
  • SLA

Support

  • Client Area
  • Submit Ticket
  • Knowledge Base
  • Server Status
  • API Documentation

© 2026 Hosting Mammoth. All rights reserved.

Knowledge Base
Getting StartedAccount ManagementVPS HostingGPU ServersStorage VPSCloud FirewallLoad BalancerServer ManagementBilling & PaymentsSupport & TicketsAffiliate ProgramReseller ProgramMarketplace & Appsn8n HostingManaged ServicesServer MigrationAPI & DevelopersSecurityTroubleshootingGlossaryInstall Guides
  1. Home
  2. /
  3. Support
  4. /
  5. Install Guides
  6. /
  7. How To Install Ispconfig Ubuntu
GUIDEInstall Guides

How to Install ISPConfig 3 on Ubuntu 24.04 VPS: Multi-Server Hosting Control Panel

30 min read

How to Install ISPConfig 3 on Ubuntu 24.04 VPS: Multi-Server Hosting Control Panel

ISPConfig 3 is the only free, open-source hosting control panel that natively supports splitting web, mail, DNS, and database roles across dedicated servers from a single web UI. That makes it the panel of choice for independent hosting providers, agencies running dozens of customer sites, and internal platform teams who want the capabilities of cPanel or Plesk without the per-server license fees. This guide walks you through a production-ready install of ISPConfig 3.2 on Ubuntu 24.04 LTS, covering the auto-installer, manual Perfect Server path, mail stack with Postfix and Dovecot, DNS with BIND9, Let's Encrypt, backups, and the jump to full multi-server mode.

Prefer a pre-built panel? Deploy the CloudCore Professional VPS and follow this guide end-to-end on hardware sized for ISPConfig's full mail-filtering stack.

Table of Contents

  • What is ISPConfig 3?
  • Why Self-Host a Control Panel?
  • ISPConfig vs cPanel, Plesk, HestiaCP, CyberPanel
  • Prerequisites
  • Step 1: Prepare the Server
  • Step 2: Install with the Official Auto-Installer
  • Step 3: Manual Install (Perfect Server Path)
  • Step 4: Choose Apache or Nginx
  • Step 5: Verify the Mail Stack
  • Step 6: Configure DNS (BIND9 or PowerDNS)
  • Step 7: PureFTPd and Jailkit SSH
  • Step 8: First Admin Login
  • Step 9: Create a Client, Site, Mailbox, and DNS Zone
  • Step 10: Enable Let's Encrypt SSL
  • Step 11: Configure Automated Backups
  • Step 12: Scale to Multi-Server Mode
  • Hardening Checklist
  • Troubleshooting
  • FAQ
  • Next Steps
  • What is ISPConfig 3?

    ISPConfig is an open-source multi-server hosting control panel maintained by Projektfarm GmbH since 2005. Unlike panels that assume all services run on a single box, ISPConfig was built from day one around the idea of a central master node that orchestrates configuration across independent web, mail, DNS, database, and mirror servers. When you create a website in the UI, the master writes the vhost to the correct web node; when you add a mailbox, it pushes the user to the dedicated mail node; when you publish a DNS zone, it replicates to every DNS node in the cluster.

    The panel supports Apache 2.4 and Nginx as web servers, PHP 7.4 through 8.3 via PHP-FPM with per-site version switching, MariaDB or MySQL as the database engine, Postfix with Dovecot for SMTP and IMAP, Amavis + SpamAssassin + ClamAV for mail filtering, BIND9 or PowerDNS as the DNS server, PureFTPd for FTP with per-site quotas, and Jailkit for chrooted SSH. Everything is stitched together by a config queue that each node polls every minute, so the system is resilient to temporary network partitions.

    ISPConfig 3.2 brought native Let's Encrypt integration via acme.sh, rspamd as an alternative to Amavis, modern UI themes, a REST API for automation, and better support for containerised installs. The 3.3 line (currently in development) is focused on FastCGI improvements and richer quota reporting.

    Why Self-Host a Control Panel?

    Running your own panel on a VPS you control, rather than paying for managed hosting or a commercial panel license, unlocks a handful of concrete advantages.

    • No per-server license fee. cPanel costs USD 17+ per month per server for a modest account tier and scales upward steeply. Plesk is in a similar range. ISPConfig is free for unlimited servers, domains, and mailboxes.
    • Full root access. You own the kernel, the firewall, and the backup policy. There is no hosting provider sitting above your OS limiting what you can install or how you tune the mail stack.
    • Predictable, flat-rate cost. A single VPS priced at EUR 19.99 per month hosts dozens of small sites. Shared hosting that bundles a panel often caps you at 10-20 sites and charges per mailbox.
    • Multi-tenant by design. ISPConfig's client/reseller model is built for agencies and resellers. Each client gets their own login with resource limits you define, without you ever exposing root.
    • Native multi-server scaling. When your single box gets full, you add a second node, assign it the mail role, and move customers across with a few clicks. No panel rebuild, no data export.
    • Privacy and GDPR. Your customer data, mailboxes, and DNS zones live on hardware you choose, in a region you choose, under a log retention policy you set.
    • Automation-friendly. Every feature in the UI is backed by a JSON-RPC and REST API, so you can plug ISPConfig into provisioning systems, billing software, or CI pipelines.

    Cost Comparison: ISPConfig vs Managed Panels

    ScenariocPanel SoloPlesk Web AdminISPConfig on VPS
    Monthly license~USD 17-30~USD 13-25EUR 0
    Sites hosted1-510Unlimited
    MailboxesUnlimitedUnlimitedUnlimited
    Multi-server modeExtra cost tierNot supportedIncluded
    Root accessNo (managed tier)YesYes
    Typical total (1 server, 20 sites)~USD 35/mo~USD 35/moEUR 19.99/mo

    ISPConfig vs cPanel, Plesk, HestiaCP, CyberPanel

    Each panel has a niche. ISPConfig wins on cost, multi-server, and openness. The others have their strengths too:

    • HestiaCP - modern fork of VestaCP, excellent single-server experience, simpler UI, no multi-server mode.
    • CyberPanel - built on OpenLiteSpeed, fastest WordPress performance out of the box, good for WP-heavy hosts.
    • Plesk - polished UX, huge extension marketplace, commercial license, stronger Windows support.
    Pick ISPConfig when you need multi-server, are cost-sensitive, or want an open-source path forward. Pick one of the others when you want a simpler single-server experience or a specific feature they nail.

    Prerequisites

    Before you begin, make sure you have:

    • A VPS running Ubuntu 24.04 LTS (Noble Numbat) with root SSH access.
    • At least 4 GB of RAM and 2 vCPU for a single-server install. 6 vCPU and 12 GB RAM is realistic for production with active mail filtering.
    • At least 40 GB of disk space to hold the OS, the panel, customer sites, mailboxes, and ClamAV virus definitions (which alone occupy 3-4 GB in memory).
    • A fully-qualified domain name you control, with DNS pointing an A record (and ideally a PTR record at your provider) to the server's public IP. Example: panel.example.com.
    • Port 25 unblocked outbound. Many low-cost cloud providers block outbound SMTP by default. Confirm with support before installing.
    Recommended Plan: CloudCore Professional
    >
    For a single-server ISPConfig install that hosts 15-30 active sites with mail filtering turned on, we recommend the CloudCore Professional plan:
    >
    - 6 vCPU cores
    - 12 GB RAM
    - 100 GB NVMe SSD
    - Unmetered bandwidth
    - EUR 19.99/month
    >
    The 12 GB of RAM matters because ClamAV loads its full signature database into memory on startup, and Amavis forks workers that each carry their own Perl interpreter. Underspec and your mail queue will stall under load.

    Connect to your server via SSH to get started:

    bash
    ssh root@your-server-ip

    Step 1: Prepare the Server

    ISPConfig is fussy about hostname and /etc/hosts entries because it uses the FQDN to identify nodes in the cluster. Get this right on day one.

    Set the hostname to a fully-qualified subdomain:

    bash
    sudo hostnamectl set-hostname panel.example.com

    Edit /etc/hosts so the hostname resolves correctly locally:

    bash
    sudo nano /etc/hosts

    Ensure a line like the following exists, substituting your public IP and FQDN:

    text
    127.0.0.1       localhost
    203.0.113.10    panel.example.com panel

    Verify the FQDN resolves correctly:

    bash
    hostname -f

    Expected output:

    text
    panel.example.com

    Update the package index and upgrade everything to current:

    bash
    sudo apt update && sudo apt upgrade -y

    Install the essentials the installer expects:

    bash
    sudo apt install -y curl wget sudo gnupg2 lsb-release software-properties-common rsyslog ufw

    Set the timezone (adjust to your region):

    bash
    sudo timedatectl set-timezone UTC

    Enable the firewall with the ports ISPConfig needs:

    bash
    sudo ufw allow OpenSSH
    sudo ufw allow 20,21,22,25,53,80,110,143,443,465,587,993,995,8080,8081,53/tcp
    sudo ufw allow 53/udp
    sudo ufw --force enable

    Reboot to ensure the kernel and hostname are clean:

    bash
    sudo reboot

    Reconnect after a minute and confirm the hostname:

    bash
    hostname -f

    Step 2: Install with the Official Auto-Installer

    The ISPConfig team maintains an official one-command installer that provisions the full stack on a clean Ubuntu 24.04 server. This is the recommended path unless you need specific customisation.

    Run the auto-installer:

    bash
    wget -O - https://get.ispconfig.org | sh -s -- --use-ftp-ports=40110-40210 --unattended-upgrades

    The script will prompt for a handful of choices early on:

  • Web server: Apache (default) or Nginx.
  • Mail server: yes (installs Postfix + Dovecot + Amavis + SpamAssassin + ClamAV).
  • DNS server: BIND9 (default) or PowerDNS.
  • Let's Encrypt: yes (installs acme.sh and wires it to ISPConfig).
  • Webmail: Roundcube (optional but recommended).
  • phpMyAdmin: optional, accessible at /phpmyadmin.
  • The installer takes 10-20 minutes depending on your bandwidth. Expected end-of-run output:

    text
    [INFO] ISPConfig installation complete.
    [INFO] Panel URL: https://panel.example.com:8080
    [INFO] Admin username: admin
    [INFO] Admin password: <random 16-char string>
    [INFO] MariaDB root password: <random 16-char string>
    [INFO] Credentials also saved to /root/.ispconfig_install.log

    Write the credentials down immediately. The log file is root-readable only.

    What the Auto-Installer Does

    Under the hood the installer performs these actions on your behalf:

  • Installs Apache or Nginx with PHP-FPM for versions 7.4, 8.0, 8.1, 8.2, and 8.3.
  • Installs MariaDB 10.11, hardens the root account, and creates the dbispconfig database.
  • Installs Postfix, Dovecot, Amavis-new, SpamAssassin, ClamAV, and dkimproxy.
  • Installs BIND9 (or PowerDNS), PureFTPd, and Jailkit.
  • Downloads the latest ISPConfig 3.2 tarball, runs the non-interactive installer, and starts the panel on port 8080.
  • Generates a Let's Encrypt certificate for the panel itself if the FQDN is publicly resolvable.
  • Installs Fail2ban with rules for SSH, Postfix, Dovecot, and the panel login.
  • Enables unattended security upgrades.
  • Skip to Step 4 if the auto-installer completed successfully. The manual path below is only for users who need component-level control.

    Step 3: Manual Install (Perfect Server Path)

    If you prefer a hands-on install, the ISPConfig team maintains a detailed Perfect Server guide. The short form is reproduced below for reference. Skip this section if you ran the auto-installer.

    3.1 Install MariaDB

    bash
    sudo apt install -y mariadb-server mariadb-client
    sudo mysql_secure_installation

    Answer Y to all hardening prompts and set a strong root password.

    3.2 Install Postfix and Dovecot

    bash
    sudo apt install -y postfix postfix-mysql postfix-doc dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-mysql dovecot-sieve dovecot-managesieved

    When prompted for the Postfix configuration type, choose Internet Site and set the mail name to your FQDN (panel.example.com).

    3.3 Install Amavis, SpamAssassin, and ClamAV

    bash
    sudo apt install -y amavisd-new spamassassin clamav clamav-daemon opendkim opendkim-tools
    sudo systemctl enable --now clamav-daemon clamav-freshclam amavis

    3.4 Install Apache with PHP

    bash
    sudo apt install -y apache2 apache2-doc apache2-utils libapache2-mod-fcgid php-common php-cli php-fpm php-mysql php-gd php-curl php-imagick php-intl php-mbstring php-xml php-zip php-bcmath php-imap
    sudo a2enmod rewrite ssl actions suexec fcgid proxy_fcgi
    sudo systemctl restart apache2

    For Nginx instead, install nginx and php8.3-fpm and skip the Apache modules.

    3.5 Install BIND9 or PowerDNS

    For BIND9 (default choice):

    bash
    sudo apt install -y bind9 bind9utils bind9-doc dnsutils haveged

    For PowerDNS with a MySQL backend:

    bash
    sudo apt install -y pdns-server pdns-backend-mysql

    3.6 Install PureFTPd and Jailkit

    bash
    sudo apt install -y pure-ftpd-common pure-ftpd-mysql quota quotatool
    sudo apt install -y build-essential autoconf automake libtool flex bison debhelper binutils

    Jailkit is not in the Ubuntu repositories, so build from source:

    bash
    cd /tmp
    wget https://olivier.sessink.nl/jailkit/jailkit-3.3.1.tar.gz
    tar xvzf jailkit-3.3.1.tar.gz
    cd jailkit-3.3.1
    echo 5 > debian/compat
    ./debian/rules binary
    cd ..
    sudo dpkg -i jailkit_*.deb
    rm -rf jailkit-3.3.1*

    3.7 Install ISPConfig 3.2

    bash
    cd /tmp
    wget https://www.ispconfig.org/downloads/ISPConfig-3.2.12.tar.gz
    tar xfz ISPConfig-3.2.12.tar.gz
    cd ispconfig3_install/install/
    sudo php -q install.php

    Answer the prompts (language, country, MariaDB credentials, SSL for the panel), and the installer will wire everything together. Expect a 5-10 minute run.

    Step 4: Choose Apache or Nginx

    Both web servers are first-class citizens in ISPConfig. The choice matters for how you configure websites later.

    Choose Apache when:

    • You host mixed PHP apps that rely on .htaccess files (classic WordPress, Laravel, custom legacy stacks).
    • You want per-site FastCGI sandboxing with mpm_itk or suEXEC.
    • Your team is more familiar with Apache rewrite rules.
    Choose Nginx when:
    • You prioritise raw static-file throughput and concurrent connections.
    • You are running mostly CMS apps with server-side routing you can express in Nginx location blocks.
    • You plan to offload TLS termination to Nginx in front of an application backend.
    You cannot switch web servers after install without reinstalling ISPConfig. Pick once, pick carefully.

    Verify the web server is running:

    bash
    sudo systemctl status apache2    # or nginx

    Confirm PHP-FPM pools are live:

    bash
    sudo systemctl status php8.3-fpm

    Step 5: Verify the Mail Stack

    Check each mail component:

    bash
    sudo systemctl status postfix dovecot amavis clamav-daemon

    All four should show active (running). Verify Postfix is listening on ports 25, 465, and 587:

    bash
    sudo ss -tlnp | grep master

    Expected output:

    text
    LISTEN 0  100  0.0.0.0:25   0.0.0.0:*  users:(("master",pid=1234,fd=13))
    LISTEN 0  100  0.0.0.0:465  0.0.0.0:*  users:(("master",pid=1234,fd=64))
    LISTEN 0  100  0.0.0.0:587  0.0.0.0:*  users:(("master",pid=1234,fd=69))

    Verify Dovecot is listening on 143, 993, 110, and 995:

    bash
    sudo ss -tlnp | grep dovecot

    Check the SpamAssassin and ClamAV handoff by sending a test message after you create your first mailbox in Step 9.

    Step 6: Configure DNS (BIND9 or PowerDNS)

    ISPConfig manages DNS zones through the Sites module and pushes them to BIND9 or PowerDNS on the selected DNS nodes.

    For BIND9, confirm the daemon is running and listening on port 53:

    bash
    sudo systemctl status bind9
    sudo ss -tulnp | grep ':53'

    Set up a forwarder or root hints as required. The default Ubuntu BIND9 ships with root hints baked in, which is fine.

    If you plan to use this server as an authoritative DNS server for customer domains, you also need:

  • NS records at your registrar pointing the child domain to ns1.example.com and ns2.example.com (typically a secondary DNS node).
  • Glue records if your nameservers live on the same domain you are delegating.
  • A second DNS node (join it as a mirror in Step 12) so you can publish at least two NS records per zone.
  • For PowerDNS, verify the MySQL backend is populated:

    bash
    sudo mysql -e "USE powerdns; SHOW TABLES;"

    You should see domains, records, supermasters, and other PowerDNS-specific tables.

    Step 7: PureFTPd and Jailkit SSH

    FTP via PureFTPd and chrooted SSH via Jailkit are both installed by the auto-installer.

    Verify PureFTPd:

    bash
    sudo systemctl status pure-ftpd-mysql

    Verify Jailkit is available:

    bash
    which jk_init jk_chrootsh

    Expected output:

    text
    /usr/sbin/jk_init
    /usr/sbin/jk_chrootsh

    When you create a shell user in ISPConfig later, the panel copies the necessary binaries into the chroot using jk_init. You do not need to configure anything manually.

    Step 8: First Admin Login

    Open the panel in your browser:

    text
    https://panel.example.com:8080

    You may see a self-signed certificate warning if Let's Encrypt did not complete during install. Accept the warning temporarily; we will fix it in Step 10.

    Log in with:

    • Username: admin
    • Password: the random password printed at the end of the installer (check /root/.ispconfig_install.log if you missed it).

    Change the Admin Password

    Immediately navigate to Tools -> User Settings -> Password and Language. Enter a strong password and save. ISPConfig logs password changes in the admin audit log.

    Tour the Main Modules

    The top navigation exposes the core modules:

    • Dashboard - server stats, disk quotas, mail queue status.
    • Client - add customers, set limits, manage reseller hierarchy.
    • Sites - websites, FTP users, shell users, databases, subdomains.
    • Email - domains, mailboxes, forwards, filters, whitelists, blacklists.
    • DNS - zones, records, templates.
    • System - server config, CLI, firewall, cron, remote users for API.
    • Monitor - logs, server health, mail queue, RAID status.
    • Help - support request form that emails the master admin.

    Step 9: Create a Client, Site, Mailbox, and DNS Zone

    Walk through the full customer creation flow once to confirm every module works end to end.

    9.1 Create a Client

    Go to Client -> Add new client. Fill in:

    • Company name and contact name.
    • Username (this becomes the panel login for the customer).
    • A secure password.
    • Limits: number of websites, mailboxes, FTP users, databases, DNS zones, disk quota, traffic quota.
    Click Save. The client account is provisioned instantly.

    9.2 Create a Website

    Go to Sites -> Website -> Add new website:

    • Server: the current host (or a specific web node in multi-server mode).
    • IPv4 address: * to listen on all IPs.
    • Domain: customer-domain.com.
    • Client: select the client you just created.
    • Document root is generated automatically as /var/www/customer-domain.com/web.
    • PHP: select PHP-FPM and the version (7.4 through 8.3).
    • Check Auto-subdomain: www so www.customer-domain.com also works.
    Click Save. ISPConfig writes the vhost, creates the web directory, and starts a PHP-FPM pool within 60 seconds.

    9.3 Create a Mail Domain and Mailbox

    Go to Email -> Domain -> Add new Domain:

    • Server: the current host (or a dedicated mail node).
    • Client: the client account.
    • Domain: customer-domain.com.
    • Check Active.
    Save, then go to Email -> Email Mailbox -> Add new Mailbox:

    • Email: [email protected].
    • Password: strong random string.
    • Quota: 1024 MB (adjust per customer plan).
    • Spam filter: Normal (uses SpamAssassin scoring).
    Save. Within a minute the mailbox is live and accessible via IMAP on port 993 and SMTP on port 587.

    9.4 Create a DNS Zone

    Go to DNS -> Add DNS Zone with Wizard:

    • Select the template Default (creates SOA, NS, and MX records automatically).
    • Domain: customer-domain.com.
    • IP: the server's public IP.
    • NS1 and NS2: your nameserver FQDNs.
    • Client: the client account.
    Click Create. ISPConfig writes the zone file, reloads BIND9, and the zone is live immediately. Verify with dig:

    bash
    dig @127.0.0.1 customer-domain.com NS +short

    Expected output:

    text
    ns1.example.com.
    ns2.example.com.

    9.5 Test Mail End-to-End

    From any external mail account send a test to [email protected]. Then log into the Roundcube webmail (installed by the auto-installer) at:

    text
    https://panel.example.com:8081

    Log in as [email protected]. The test message should be in the inbox within a minute. Check that SpamAssassin has added X-Spam-* headers.

    Step 10: Enable Let's Encrypt SSL

    ISPConfig uses acme.sh as its ACME client. To issue a certificate for a site:

  • Go to Sites -> Website -> select your site.
  • Open the SSL tab.
  • Tick Let's Encrypt SSL.
  • Save.
  • Within 60-120 seconds acme.sh issues the certificate, installs it into the vhost, and reloads the web server. Verify with:

    bash
    curl -I https://customer-domain.com

    You should see HTTP/2 200 and a valid certificate chain.

    For the panel itself, edit /usr/local/ispconfig/interface/ssl/ after pointing the FQDN correctly and run:

    bash
    sudo /usr/local/ispconfig/server/scripts/letsencrypt.sh

    Then restart the panel:

    bash
    sudo systemctl restart apache2    # or nginx

    Certificates renew automatically via the system cron; no further action is needed.

    Step 11: Configure Automated Backups

    ISPConfig has a built-in backup module that snapshots websites and databases on a configurable rotation.

    Go to System -> Server Config -> select your server -> Web tab:

    • Backup directory: /var/backup.
    • Backup mode: zip.
    • Retention: 7 daily, 4 weekly, 6 monthly.
    For per-site backups, go to Sites -> Website -> select a site -> Backup tab:

    • Tick Backup interval: daily.
    • Set copies to keep: 7.
    Backups are generated overnight and are downloadable by the client from their own panel login. For offsite backups, rsync /var/backup to object storage (for example Backblaze B2 or a second VPS) nightly via cron:

    bash
    sudo tee /etc/cron.daily/offsite-backup > /dev/null <<'EOF'
    #!/bin/bash
    rclone sync /var/backup b2:mycompany-ispconfig-backups \
      --log-file /var/log/offsite-backup.log
    EOF
    sudo chmod +x /etc/cron.daily/offsite-backup

    Pair this with rclone or restic for deduplicated encrypted offsite copies.

    Step 12: Scale to Multi-Server Mode

    The killer feature of ISPConfig is true multi-server orchestration. Here is how to split mail, web, and database onto dedicated nodes.

    12.1 Provision Additional VPS Instances

    Spin up three additional Ubuntu 24.04 servers on CloudCore Professional plans. Set their FQDNs:

    • web1.example.com
    • mail1.example.com
    • db1.example.com
    Ensure they can resolve and reach the master (panel.example.com) on MySQL port 3306 (over a private network if available).

    12.2 Install ISPConfig in Slave Mode

    On each slave, run the auto-installer with the slave flag:

    bash
    wget -O - https://get.ispconfig.org | sh -s -- --no-mail --no-dns --use-ftp-ports=40110-40210

    Adjust --no-mail, --no-dns, --no-mailman to disable the services you do not want on that slave. For example, the database node should skip web, mail, and DNS entirely.

    12.3 Grant MySQL Access from Slaves to Master

    On the master, create a remote MySQL user for each slave:

    bash
    sudo mysql -e "CREATE USER 'ispcsrv2'@'web1.example.com' IDENTIFIED BY 'strongpassword';"
    sudo mysql -e "GRANT SELECT ON dbispconfig.* TO 'ispcsrv2'@'web1.example.com';"
    sudo mysql -e "FLUSH PRIVILEGES;"

    Open MySQL port 3306 on the master firewall only to the slave IPs:

    bash
    sudo ufw allow from 203.0.113.20 to any port 3306

    12.4 Join the Slave to the Master

    On the slave, edit /usr/local/ispconfig/server/lib/config.inc.php:

    php
    $conf['db_host']     = 'master.example.com';
    $conf['db_user']     = 'ispcsrv2';
    $conf['db_password'] = 'strongpassword';
    $conf['db_database'] = 'dbispconfig';

    Restart the ISPConfig server agent:

    bash
    sudo systemctl restart ispconfig_server

    Within two minutes the slave shows up in System -> Server services on the master. Tick the roles you want it to serve (Web, Mail, DNS, DB, FTP), save, and assign new customer resources to it.

    12.5 Mirror and Failover

    For HA, assign a mirror server to each primary role. The master replicates config to both, and you can switch clients between primary and mirror with a single dropdown change. Full HA requires shared storage or rsync of document roots; the panel manages the config layer, not the data layer.

    Hardening Checklist

    Production panels should go through this hardening checklist on day one.

    • SSH: disable root password login, enforce key-based auth, change the default port away from 22.
    • Fail2ban: confirm the ispconfig jail is enabled and banning brute-force attempts on port 8080.
    • UFW: review allowed ports and trim anything you do not use.
    • Amavis: enable DKIM signing for every mail domain.
    • SPF, DKIM, DMARC: publish DNS records for every mail domain. ISPConfig generates the DKIM selector and records automatically.
    • rspamd: consider swapping Amavis for rspamd for a 3-5x performance boost.
    • Panel access: bind port 8080 to a VPN or whitelist office IPs via UFW.
    • System updates: unattended-upgrades is on by default via the auto-installer; confirm with sudo systemctl status unattended-upgrades.
    • Monitoring: deploy Uptime Kuma externally to watch port 8080, port 25, and port 443.
    • Backup verification: restore a test site from backup monthly to confirm the pipeline works.

    Troubleshooting

    ProblemCauseSolution
    Panel 500 error on loginPHP-FPM pool crashed or missing extensionsudo systemctl restart php8.3-fpm apache2. Check /var/log/apache2/error.log.
    Mail not delivering locallyPostfix virtual mailbox tables unsyncedsudo postmap /etc/postfix/virtual then sudo systemctl restart postfix. Check /var/log/mail.log.
    Let's Encrypt issue failsHTTP-01 challenge blocked on port 80Open port 80 in UFW, ensure no other service uses it, retry by re-saving the site with SSL ticked.
    BIND9 refuses to reload zoneSyntax error in zone filesudo named-checkconf and sudo named-checkzone example.com /var/lib/bind/example.com.db.
    ClamAV daemon exits on startOut of RAM (ClamAV needs ~2 GB for signatures)Upgrade to at least 4 GB RAM or disable ClamAV and rely on SpamAssassin plus rspamd.
    Slave not appearing in master UIMySQL credentials wrong or firewall blocking 3306Verify slave can mysql -u ispcsrv2 -h master.example.com successfully; check UFW on master.
    Quota reports zero for all usersUser quotas not enabled on filesystemRemount with usrquota,grpquota in /etc/fstab, run quotacheck -avugm, then quotaon -avug.
    ISPConfig updater fails midwayStale lock fileRemove /usr/local/ispconfig/server/temp/.update.lock and rerun ispconfig_update.sh.

    Useful Log Locations

    • Panel: /var/log/ispconfig/ (cron.log, auth.log, httpd_error.log).
    • Apache: /var/log/apache2/.
    • Nginx: /var/log/nginx/.
    • Postfix / Dovecot: /var/log/mail.log and /var/log/mail.err.
    • BIND9: /var/log/syslog filtered by named.
    • MariaDB: /var/log/mysql/error.log.
    Tail everything during troubleshooting with:

    bash
    sudo multitail /var/log/ispconfig/cron.log /var/log/mail.log /var/log/apache2/error.log

    FAQ

    Is ISPConfig free?

    Yes. ISPConfig 3 is open-source under the BSD license and free for unlimited clients, domains, mailboxes, and servers. The maintainers sell optional commercial products - a migration toolkit from cPanel and Plesk, a detailed manual, and a billing module - but the panel itself is free forever. No phone home, no license key.

    What is the difference between ISPConfig and cPanel?

    The largest differences are cost and architecture. cPanel is a paid commercial product with a license fee of roughly USD 17-30 per server per month, and it assumes a single-server deployment by default (multi-server is an upsold tier). ISPConfig is free, open-source, and was built from day one around multi-server orchestration. cPanel's end-user UX is more polished and has a larger marketplace of one-click app installers. ISPConfig trades that polish for zero license cost, full root control, and native scaling to dedicated mail, web, DNS, and database nodes.

    Can I migrate from cPanel to ISPConfig?

    Yes. ISPConfig publishes a commercial migration toolkit that imports cPanel and Plesk backups including websites, databases, mailboxes, DNS zones, FTP accounts, and SSL certificates. For small installs with a handful of sites, manual recreation through the ISPConfig UI plus rsync of document roots and mysqldump of databases works fine. For larger migrations the toolkit is worth the one-time cost because it preserves cron jobs, email filters, and quota settings that are tedious to redo by hand. See our WHMCS migration patterns for adjacent workflows.

    What resources does ISPConfig need?

    A single-server install with the full mail filtering stack (Amavis plus ClamAV plus SpamAssassin) needs 4 GB RAM, 2 vCPU, and 40 GB disk at absolute minimum. ClamAV alone loads 3-4 GB of signatures into memory at startup, and Amavis forks Perl workers that each consume 100-200 MB. For production hosting of 15-30 active sites with live mail traffic, plan for 6 vCPU and 12 GB RAM on a CloudCore Professional plan. Multi-server setups split these requirements across dedicated nodes: a web node can get by on 4 GB, a mail node wants 8 GB minimum, and a DB node scales with customer database size.

    Does ISPConfig support Let's Encrypt?

    Yes, natively via acme.sh since version 3.2. Enable it per site with a single checkbox in the Sites module and the panel handles issuance, installation, and renewal automatically. The panel itself also gets a Let's Encrypt certificate during the auto-installer run if the FQDN is publicly resolvable. Renewals run via cron twice daily and reload Apache, Nginx, Postfix, and Dovecot when new certs are installed.

    Can ISPConfig run on a low-cost VPS?

    ISPConfig runs on VPS plans from 4 GB RAM upward, but you will feel the pinch with ClamAV and Amavis enabled. A 2 GB plan can run the panel with mail disabled, but that defeats one of the core reasons to use ISPConfig. CloudCore Professional at EUR 19.99 per month delivers the 6 vCPU and 12 GB RAM headroom that a single-server install with mail filtering really needs, and leaves room for 20-30 active customer sites. If you are budget-constrained, consider swapping Amavis plus ClamAV for rspamd, which uses roughly a third of the memory for equivalent protection.

    Can I run ISPConfig alongside Docker?

    Yes, but carefully. The panel manages ports 80, 443, 25, 465, 587, 110, 143, 993, 995, 53, 21, 20, and 8080 on the host. If you run Docker containers that also want those ports, bind them to a different interface or a non-standard host port. The safest pattern is to run ISPConfig on the host and expose Docker services behind ISPConfig's Apache or Nginx via a reverse proxy vhost configured in the panel.

    Does ISPConfig have an API?

    Yes. ISPConfig exposes a JSON-RPC API and a newer REST API covering essentially every action in the UI - creating clients, sites, mailboxes, DNS records, databases, FTP users, and cron jobs. The API is documented in the official manual and is the standard way to integrate ISPConfig with billing systems like WHMCS, Blesta, or Invoice Ninja. Create a Remote User under System -> Remote Users and grant the specific function groups the integration needs.

    Next Steps

    Now that ISPConfig is running on your VPS, here are recommended next steps to build on your setup:

    • Compare other panels - evaluate HestiaCP for a simpler single-server experience, CyberPanel for OpenLiteSpeed performance, or Plesk if you need a commercial extension ecosystem.
    • Add a monitoring stack - deploy Prometheus, Grafana, and node_exporter with our monitoring stack guide to track ISPConfig server health, mail queue depth, and SSL expiry.
    • Automate with the ISPConfig API - generate API keys under System -> Remote Users and script customer provisioning. See the official API reference for function lists.
    • Harden mail deliverability - publish SPF, DKIM, and DMARC records for every hosted domain, set up reverse DNS (PTR) at your provider, and submit your IP to mail-tester.com to catch spam-score issues.
    • Build a redundant DNS cluster - join a second Ubuntu VPS as a DNS mirror to ISPConfig, then publish ns1.yourhost.com and ns2.yourhost.com as customer-facing nameservers.
    • Scale to multi-server - when the single box nears capacity, add dedicated mail and database nodes via the flow in Step 12 and migrate customers incrementally.

    Skip the Manual Install - Get a Pre-Sized Hosting VPS
    >
    Our CloudCore Professional VPS is sized exactly for ISPConfig's full mail-filtering stack, so you can run the auto-installer in this guide end-to-end without hitting memory ceilings.
    >
    - 6 vCPU cores and 12 GB RAM - enough for ClamAV plus Amavis plus 20-30 active sites
    - 100 GB NVMe SSD - fits customer sites, mailboxes, and a 30-day backup rotation
    - Unmetered bandwidth - no surprise traffic bills when a site goes viral
    - Instant provisioning - Ubuntu 24.04 ready for SSH in under 60 seconds
    - Optional private networking for multi-server ISPConfig clusters
    >
    Deploy Your Hosting VPS Now - Plans start at EUR 19.99/month.

    For the authoritative reference on every ISPConfig module, flag, and API call, see the official ISPConfig documentation.

    Was this article helpful?

    ← Back to Install GuidesBrowse all categories →

    Still have questions?

    Contact Support →Submit a Ticket