On this page
Openfire is a Java XMPP server with a web-based admin console, which is its main appeal: user management, plugins and settings without editing config files. Our first guide installed Openfire 4.4 on Ubuntu 18.04 with OpenJDK 8. That combination doesn't work any more, so this is the current version.
The package is architecture-independent and the steps are the same on Ubuntu 22.04, 24.04 and 26.04. At the time of writing, the latest release is Openfire 5.1.2, from August 2026.
Ports to open
| Port | Used for | Open to |
|---|---|---|
| 5222 TCP | XMPP clients | Your users |
| 5223 TCP | XMPP clients over direct TLS | Your users, if clients need it |
| 5269 TCP | Server-to-server federation | Other XMPP servers, only if you federate |
| 7070 / 7443 TCP | BOSH and WebSocket for web clients | Your users, if you use web clients |
| 9090 / 9091 TCP | Admin console (the Openfire admin port) | Nobody. Use an SSH tunnel |
The old guide opened 9090 and 9091 in the security group. Don't. The admin console controls every account on the server, and it is reachable safely without exposing it at all, as the wizard section shows.
sudo ufw allow 22/tcp
sudo ufw allow 5222/tcp
sudo ufw allow 7443/tcp
sudo ufw enableInstall Java 17
Openfire stopped bundling a Java runtime in version 4.7, and releases from 4.10 onwards require Java 17. OpenJDK 17 is in the archive for all three Ubuntu releases:
sudo apt update
sudo apt install -y openjdk-17-jre-headless
java -versionInstall the Openfire package
Download the .deb from the Ignite Realtime downloads page, adjusting the version number if a newer release is out:
cd /tmp
wget -O openfire.deb "https://www.igniterealtime.org/downloadServlet?filename=openfire/openfire_5.1.2_all.deb"
sudo apt install -y ./openfire.deb
sudo systemctl status openfire --no-pagerWhen the Ubuntu Openfire install fails
Using apt install ./openfire.deb rather than dpkg -i matters: apt resolves any missing dependencies, where dpkg stops with an error and leaves a half-configured package. That difference is behind a lot of "Openfire install failed" reports. Openfire installs to /usr/share/openfire with its configuration in /etc/openfire.
Install Openfire on Debian 12
The same .deb and the same commands work on Debian 12, which carries OpenJDK 17 in its own archive. Install openjdk-17-jre-headless, then run apt install ./openfire.deb exactly as above. The Openfire package is distribution-independent, so nothing else changes: the database setup, the wizard and the ports below are identical on Debian and Ubuntu.
Prepare a database
The setup wizard offers an embedded database. It is fine for trying Openfire out. For real use, create a database in PostgreSQL or MySQL first, which makes backups and server moves ordinary.
PostgreSQL
sudo apt install -y postgresql
sudo -u postgres psql -c "CREATE USER openfire WITH PASSWORD 'REPLACE_WITH_A_STRONG_PASSWORD';"
sudo -u postgres psql -c "CREATE DATABASE openfire OWNER openfire;"MySQL 8
CREATE DATABASE openfire CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'openfire'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_STRONG_PASSWORD';
GRANT ALL PRIVILEGES ON openfire.* TO 'openfire'@'localhost';
FLUSH PRIVILEGES;The old GRANT command fails on MySQL 8
GRANT ALL PRIVILEGES ON openfire.* TO openfire@localhost IDENTIFIED BY '...'. MySQL 8 removed the IDENTIFIED BY clause from GRANT, so that line now fails with a syntax error. Create the user first, then grant, as above. You also don't need to import the schema file by hand; the wizard creates the tables in the empty database.
Run the setup wizard
From your own computer, open an SSH tunnel to the admin console instead of exposing its port:
ssh -L 9090:localhost:9090 ubuntu@your-serverThen browse to http://localhost:9090 and work through the wizard:
- Language.
- Server settings. The XMPP domain is the part after the
@in user addresses, for exampleexample.com. The server host name is the machine's full DNS name, for examplexmpp.example.com. They can differ, and changing the XMPP domain later is painful, so choose carefully. - Database. Choose Standard Database Connection, pick PostgreSQL or MySQL, and enter the database URL, user and password from the previous step.
- Profile. Default stores users in the database. LDAP connects to an existing directory.
- Admin account. Set the admin email and a strong password, then log in.
After the install
- TLS. Replace the self-signed certificate so clients and other servers trust Openfire. Our older Openfire Let's Encrypt guide shows the certificate import in the admin console.
- DNS SRV records. If the XMPP domain differs from the host name, publish
_xmpp-client._tcp(and_xmpp-server._tcpif you federate) SRV records pointing at the host, so clients find the server. - Backups. Back up the database and
/etc/openfire. Those two contain everything.
Openfire Active Directory, LDAP and SSO
The wizard's Profile step is where Openfire stops owning your user list. Point it at Active Directory or any other LDAP directory and accounts, groups and passwords stay in the directory, with Openfire reading from it. You can switch later under Server Settings, though moving an existing user base across is more work than choosing correctly at setup.
Single sign-on goes a step further: with SASL GSSAPI configured against Kerberos, a domain-joined client authenticates without a password prompt at all. Plan it together with the directory, because SSO without a shared directory behind it has nothing to sign in against. The same idea applied to video meetings is in Jitsi Meet LDAP authentication.
New to the protocol itself? What XMPP is and how it works explains addresses, streams and stanzas. And if you are wondering whether Openfire can host video meetings, Jitsi Meet with Openfire or ejabberd covers what works and what doesn't.
Frequently Asked Questions
Which Java version does Openfire need?
Openfire 4.10 and later require Java 17. Older guides install OpenJDK 8, which only worked for Openfire 4.3 and earlier. Install openjdk-17-jre-headless before the Openfire package, and Openfire starts without complaints.
Why does the Openfire install fail on Ubuntu?
Most failures are a missing or too old Java runtime. Installing the downloaded .deb with dpkg -i doesn't pull in dependencies; use sudo apt install ./openfire.deb instead, which resolves them, or install OpenJDK 17 first and rerun.
Can I use Openfire's embedded database in production?
It works, but it is meant for evaluation and small setups. For anything you care about, use PostgreSQL or MySQL: they are easier to back up, monitor and move to another server, and they handle larger user counts.
What port is the Openfire admin console on?
9090 for HTTP and 9091 for HTTPS. Keep both closed to the internet and reach the console through an SSH tunnel, since the admin console controls every account on the server.
Openfire or Prosody?
Openfire if you want a web admin console, directory integration and Java plugins with little command-line work. Prosody if you prefer a lightweight server configured in files, or you run Jitsi Meet, which is built on Prosody.
