> Source: https://meetrix.io/blogs/install-openfire-ubuntu/
> Markdown copy of that page. Cite the URL above, not this file.

Collaboration

# Openfire Ubuntu Install: Setup on 22.04, 24.04 and 26.04

[By Hiruna Kumara](https://meetrix.io/blogs/authors/hiruna-kumara/) • September 15, 2026 • 4 min read

[Openfire](https://www.igniterealtime.org/projects/openfire/) is a Java XMPP server with a web-based admin console, which is its main appeal: user management, plugins and settings without editing config files. Our first guide installed Openfire 4.4 on Ubuntu 18.04 with OpenJDK 8. That combination doesn't work any more, so this is the current version.

The package is architecture-independent and the steps are the same on Ubuntu 22.04, 24.04 and 26.04. At the time of writing, the latest release is Openfire 5.1.2, from August 2026.

## Ports to open

| Port | Used for | Open to |
| --- | --- | --- |
| 5222 TCP | XMPP clients | Your users |
| 5223 TCP | XMPP clients over direct TLS | Your users, if clients need it |
| 5269 TCP | Server-to-server federation | Other XMPP servers, only if you federate |
| 7070 / 7443 TCP | BOSH and WebSocket for web clients | Your users, if you use web clients |
| 9090 / 9091 TCP | Admin console (the Openfire admin port) | **Nobody.** Use an SSH tunnel |

The old guide opened 9090 and 9091 in the security group. Don't. The admin console controls every account on the server, and it is reachable safely without exposing it at all, as the wizard section shows.

```bash
sudo ufw allow 22/tcp
sudo ufw allow 5222/tcp
sudo ufw allow 7443/tcp
sudo ufw enable
```

## Install Java 17

Openfire stopped bundling a Java runtime in version 4.7, and releases from 4.10 onwards require Java 17. OpenJDK 17 is in the archive for all three Ubuntu releases:

```bash
sudo apt update
sudo apt install -y openjdk-17-jre-headless
java -version
```

## Install the Openfire package

Download the `.deb` from the [Ignite Realtime downloads page](https://www.igniterealtime.org/downloads/), adjusting the version number if a newer release is out:

```bash
cd /tmp
wget -O openfire.deb "https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire_5.1.2_all.deb"
sudo apt install -y ./openfire.deb
sudo systemctl status openfire --no-pager
```

### When the Ubuntu Openfire install fails

Using `apt install ./openfire.deb` rather than `dpkg -i` matters: apt resolves any missing dependencies, where dpkg stops with an error and leaves a half-configured package. That difference is behind a lot of "Openfire install failed" reports. Openfire installs to `/usr/share/openfire` with its configuration in `/etc/openfire`.

### Install Openfire on Debian 12

The same `.deb` and the same commands work on Debian 12, which carries OpenJDK 17 in its own archive. Install `openjdk-17-jre-headless`, then run `apt install ./openfire.deb` exactly as above. The Openfire package is distribution-independent, so nothing else changes: the database setup, the wizard and the ports below are identical on Debian and Ubuntu.

## Prepare a database

The setup wizard offers an embedded database. It is fine for trying Openfire out. For real use, create a database in PostgreSQL or MySQL first, which makes backups and server moves ordinary.

### PostgreSQL

```bash
sudo apt install -y postgresql
sudo -u postgres psql -c "CREATE USER openfire WITH PASSWORD 'REPLACE_WITH_A_STRONG_PASSWORD';"
sudo -u postgres psql -c "CREATE DATABASE openfire OWNER openfire;"
```

### MySQL 8

```sql
CREATE DATABASE openfire CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'openfire'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_STRONG_PASSWORD';
GRANT ALL PRIVILEGES ON openfire.* TO 'openfire'@'localhost';
FLUSH PRIVILEGES;
```

The old GRANT command fails on MySQL 8

The 2019 guide used `GRANT ALL PRIVILEGES ON openfire.* TO openfire@localhost IDENTIFIED BY '...'`. MySQL 8 removed the `IDENTIFIED BY` clause from `GRANT`, so that line now fails with a syntax error. Create the user first, then grant, as above. You also don't need to import the schema file by hand; the wizard creates the tables in the empty database.

## Run the setup wizard

From your own computer, open an SSH tunnel to the admin console instead of exposing its port:

```bash
ssh -L 9090:localhost:9090 ubuntu@your-server
```

Then browse to `http://localhost:9090` and work through the wizard:

1.  **Language.**
2.  **Server settings.** The XMPP domain is the part after the `@` in user addresses, for example `example.com`. The server host name is the machine's full DNS name, for example `xmpp.example.com`. They can differ, and changing the XMPP domain later is painful, so choose carefully.
3.  **Database.** Choose Standard Database Connection, pick PostgreSQL or MySQL, and enter the database URL, user and password from the previous step.
4.  **Profile.** Default stores users in the database. LDAP connects to an existing directory.
5.  **Admin account.** Set the admin email and a strong password, then log in.

## After the install

-   **TLS.** Replace the self-signed certificate so clients and other servers trust Openfire. Our older [Openfire Let's Encrypt guide](https://meetrix.io/blogs/openfire-lets-encrypt-ssl/) shows the certificate import in the admin console.
-   **DNS SRV records.** If the XMPP domain differs from the host name, publish `_xmpp-client._tcp` (and `_xmpp-server._tcp` if you federate) SRV records pointing at the host, so clients find the server.
-   **Backups.** Back up the database and `/etc/openfire`. Those two contain everything.

### Openfire Active Directory, LDAP and SSO

The wizard's Profile step is where Openfire stops owning your user list. Point it at Active Directory or any other LDAP directory and accounts, groups and passwords stay in the directory, with Openfire reading from it. You can switch later under Server Settings, though moving an existing user base across is more work than choosing correctly at setup.

Single sign-on goes a step further: with SASL GSSAPI configured against Kerberos, a domain-joined client authenticates without a password prompt at all. Plan it together with the directory, because SSO without a shared directory behind it has nothing to sign in against. The same idea applied to video meetings is in [Jitsi Meet LDAP authentication](https://meetrix.io/blogs/jitsi-meet-ldap-authentication/).

New to the protocol itself? [What XMPP is and how it works](https://meetrix.io/blogs/what-is-xmpp/) explains addresses, streams and stanzas. And if you are wondering whether Openfire can host video meetings, [Jitsi Meet with Openfire or ejabberd](https://meetrix.io/blogs/jitsi-meet-openfire-ejabberd/) covers what works and what doesn't.

## Frequently Asked Questions

Which Java version does Openfire need?

Openfire 4.10 and later require Java 17. Older guides install OpenJDK 8, which only worked for Openfire 4.3 and earlier. Install openjdk-17-jre-headless before the Openfire package, and Openfire starts without complaints.

Why does the Openfire install fail on Ubuntu?

Most failures are a missing or too old Java runtime. Installing the downloaded .deb with dpkg -i doesn't pull in dependencies; use sudo apt install ./openfire.deb instead, which resolves them, or install OpenJDK 17 first and rerun.

Can I use Openfire's embedded database in production?

It works, but it is meant for evaluation and small setups. For anything you care about, use PostgreSQL or MySQL: they are easier to back up, monitor and move to another server, and they handle larger user counts.

What port is the Openfire admin console on?

9090 for HTTP and 9091 for HTTPS. Keep both closed to the internet and reach the console through an SSH tunnel, since the admin console controls every account on the server.

Openfire or Prosody?

Openfire if you want a web admin console, directory integration and Java plugins with little command-line work. Prosody if you prefer a lightweight server configured in files, or you run Jitsi Meet, which is built on Prosody.

Meetrix Store

Jitsi Meet

Self-hosted video calls for 50 to 500 users

[Deploy it](https://meetrix.io/store/jitsi-meet/)

Meetrix Store New

Deploy what this guide covers, pre-configured.

-    [Jitsi Meet Self-hosted video calls for 50 to 500 users](https://meetrix.io/store/jitsi-meet/)
-    [Coturn TURN/STUN for WebRTC, no per-minute relay fees](https://meetrix.io/store/coturn/)
-    [Mattermost Team chat, a self-hosted Slack alternative](https://meetrix.io/store/mattermost/)
-    [RustDesk Remote desktop AMI, a TeamViewer alternative](https://meetrix.io/store/rustdesk/)
-    [Plane Issues, cycles and roadmaps, a Jira alternative](https://meetrix.io/store/plane/)
-    [Mailcow Business email on your own domain](https://meetrix.io/store/mailcow/)

[Browse all products](https://meetrix.io/store/)