OroCRM is a flexible open source Customer Relationship Management (CRM) platform written in PHP programming language, based on the Symfony2 framework.  OroCRM can be used by multichannel e-commerce marketing teams, it is capable of managing accounts and contact information and to track marketing campaign performance. OroCRM can also be easily integrated with popular e-commerce platforms like Magento, MailChimp or Zendesk. OroCRM is often deployed on Linux under Apache/Nginx web server, PHP and MySQL/MariaDB database, also known as LAMP or LEMP stack.

This tutorial shows you how to install and configure the latest version of OroCRM on Debian 9.


  • Debian 9 minimal server installation on a virtual private server or a bare-metal machine.
  • The server should have minimum 2GB of RAM.
  • Root access on the server.
  • The server should have a static IP address, either manually configured or with DHCP.
  • A domain name or subdomain that points to the server.
  • A mail server or access to a public mail server service, such as Gmail, Yahoo!, Outlook.

Prepare the server

In the first step, log in to your server console with the root account or an account with root power.

Configure the Hostname

Configure your machine hostname by executing the following command. You should replace the hostname variable used in this example (www.mycrm.com) with your own domain name.

hostnamectl set-hostname www.mycrm.com

After you’ve changed your machine name, verify the machine hostname by issuing the below commands. Be aware that for now the machine hostname is in a transient state and is not permanently applied. It will be applied later after you reboot the machine.

hostname –s
hostname –f

Install Debian Updates

Before rebooting the machine, make sure the Debian system is up-to-date with the latest software updates, security patches, and new Kernel. Run the below commands to install the updates.

apt update
apt upgrade

After the update process completed, you need to reboot the Debian server in order to apply the kernel updates and the hostname changes, by executing the below command.

systemctl reboot

Install LAMP Stack

In the next steps, we’ll install the LAMP software bundle in Debian 9. OroCrm platform is written mainly in PHP server-side programming language, so we will have to install the PHP interpreter and the Apache HTTP server. Install Apache and PHP with this command:

apt install apache2 libapache2-mod-php7.0 php7.0 php7.0-gd php7.0-opcache php7.0-json php7.0-mbstring php7.0-xml php7.0-mcrypt php7.0-cli php7.0-curl php7.0-zip php7.0-intl php7.0-soap php7.0-tidy

If you like to check that all the installed PHP modules are active, execute the below command.

php –m

In order to store different configurations, such as users, sessions, contacts and other data, OroCRM requires a relational database as backend. In this guide, we’ll deploy OroCRM plication with MariaDB database. In order to install MariaDB and the PHP module that is used to access the MariaDB database, execute the below command in your server console.

apt install mariadb-server php7.0-mysql mariadb-client

If you don’t have the possibility to use a public mail server to connect OroCRM to, then you should install Postfix MTA server on the system by executing the following command.

apt install postfix

In the next step, make sure you install Node.js javascript engine in your system by issuing the below command. Node.js is required by OroCRM.

apt-get install nodejs

In this step,  we will adjust some PHP settings. First, make a backup of the php.ini file.

cp /etc/php/7.0/apache2/php.ini{,.backup}

Then open /etc/php/7.0/apache2/php.ini with a text editor and change the lines as described below. Also, initially, make a backup of PHP configuration file.

nano /etc/php/7.0/apache2/php.ini

Search, edit and change the following variables in php.ini file:

file_uploads = On
default_charset = UTF-8
memory_limit = 512M
date.timezone = Europe/London

To support large file attachments you should search and increase the upload_max_file_size and post_max_filesize variable values as per your own requirements. You should also make sure that the date.timezone variable is configured to match your server physical location. The PHP timezone list can be found by consulting the list of time zones provided by PHP docs at the following link http://php.net/manual/en/timezones.php

Save the php.ini file.

Next, enable OPCache plugin for PHP 7 in order to increase the load speed of OroCRM. Add or change the following lines at the bottom of the file, below the [opcache] statement, as detailed below:

nano /etc/php/7.0/apache2/conf.d/10-opcache.ini


Save and close the file. In order to apply all the changes made so far, restart Apache service by issuing the following command.

systemctl restart apache2

Next, enable the rewrite module for Apache by issuing the below command. The rewrite module is required to modify Apache runtime environment via the .htaccess files placed in your server webroot path.

a2enmod rewrite
systemctl restart apache2

In order to securely install and access OroCRM via HTTPS protocol, enable the SSL module and SSL site configuration file by executing the below commands.

a2enmod ssl
a2ensite default-ssl.conf

Open Apache default SSL site configuration file with a text editor and enable URL rewrite rules by adding the following lines of code after DocumentRoot directive, as shown in the below sample. Make sure you change webroot path to /var/www/html/web

nano /etc/apache2/sites-enabled/default-ssl.conf

SSL site configuration file excerpt:

DocumentRoot /var/www/html/web
<Directory /var/www/html/web>
  Options +FollowSymlinks
  AllowOverride All
  Require all granted

Then open /etc/apache2/sites-enabled/000-default.conf file for editing and add the same URL rewrite rules as for SSL configuration file. Insert the lines of code after DocumentRoot statement as shown in the below example. Also, change DocumentRoot path to /var/www/html/web

DocumentRoot /var/www/html/web
<Directory /var/www/html/web>
  Options +FollowSymlinks
  AllowOverride All
  Require all granted

Finally, create the /var/www/html/web directory and restart Apache daemon to apply all changes made so far by issuing the below commands.

mkdir -p /var/www/html/web

systemctl restart apache2

Visit your domain name or server IP address via HTTP protocol. Because you’re using the automatically generated Self-Signed certificate, a warning will be displayed in the browser. Accept the warning in order to accept the untrusted certificate and you will be redirected to Apache default web page, as illustrated in the below image.


Apache default web page will show up

When a firewall is enabled on the Debian system, such as the UFW firewall, you might not be able to access Apache web server. Make sure you add a new rule to allow HTTP and HTTPS traffic to pass through the firewall. The commands below are for the UFW firewall:

ufw allow http
ufw allow https

If you’re using iptables raw rules to manage the Firewall on your Debian server, add the following rules to allow ports 80 and 443 inbound traffic on the firewall so that clients can browse the OroCrm application. Save the iptables rules and restart and enable the service.

apt-get install -y iptables-persistent

iptables -I INPUT -p tcp –destination-port 80 -j ACCEPT
iptables -I INPUT -p tcp –destination-port 443 -j ACCEPT

netfilter-persistent save

systemctl restart netfilter-persistent
systemctl status netfilter-persistent
systemctl enable netfilter-persistent.service

Finally, create a PHP info file in your application webroot path by executing the following command.

echo ‘<?php phpinfo(); ?>’| tee /var/www/html/web/info.php

Visit the PHP info script file from a browser at the following URL via HTTPS and check the PHP server environment configurations. Scroll down to date setting in order to check PHP time zone configuration.


In the next step, secure the MariaDB root account by logging into the database console and issue the following commands to blank root account plugin. Be aware, that MariaDB root account is different from Linux system root account. These root accounts are two distinct accounts. Linux root user is used for managing the system and MySQL root user is used for managing MariaDB database.

mysql -h localhost

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 2

Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

MariaDB [(none)]> use mysql;

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

MariaDB [mysql]> update user set plugin=” where user=’root’;

Query OK, 1 row affected (0.00 sec)

Rows matched: 1  Changed: 1  Warnings: 0

MariaDB [mysql]> flush privileges;

Query OK, 0 rows affected (0.00 sec)

MariaDB [mysql]> exit


Further secure MariaDB by executing the script mysql_secure_installation. This script will ask a series of questions designed to secure MariaDB database, such as: to change MySQL root password, to remove anonymous users, to disable remote root logins and delete the test database. Make sure you answer with yes to all questions asked and supply a strong password for database root account in order to fully secure MySQL daemon, as shown in the below script output excerpt.


In order to log into MariaDB to secure it, we’ll need the current
password for the root user.  If you’ve just installed MariaDB, and
you haven’t set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none):
OK, successfully used password, moving on…
Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.
You already have a root password set, so you can safely answer ‘n’.

Change the root password? [Y/n] y

New password:
Re-enter new password:
Password updated successfully!

Reloading privilege tables..
… Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y

 … Success!

Normally, root should only be allowed to connect from ‘localhost’.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y

 … Success!

By default, MariaDB comes with a database named ‘test’ that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y

 – Dropping test database…

 … Success!

 – Removing privileges on test database…

 … Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y

 … Success!

Cleaning up…

All done!  If you’ve completed all of the above steps, your MariaDB
installation should now be secure.
Thanks for using MariaDB! 

In order to test MariaDB security, try to log in to the database via console and do not enter the root account password. The access to the database should be denied if no password is provided for the root account, as illustrated in the below command excerpt:

mysql -h localhost -u root

ERROR 1045 (28000): Access denied for user ‘root’@’localhost’ (using password: NO)

If the password is supplied, the login process should be granted and you should be able to login to MySQL console, as shown in the below command example. Type exit in order to leave the database.

mysql -h localhost -u root -p

Enter password:

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 15
Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1
Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

MariaDB [(none)]> exit


Install OroCRM

Before we actually start to install OroCRM, we’ll install some utilities to download files from the internet and to unpack zip archives.

apt install wget zip unzip curl

Visit the OroCRM download page at GitHub https://github.com/oroinc/crm-application/releases and grab the latest zip archive. I’ll be using OroCRM 2.6 here. Below the wget command to download OroCRM:

cd /tmp

After the zip file download finished, extract the archive file inyour current working directory and list the extracted files by issuing the below commands. Also, remove the default index.html file installed by Apache web server to webroot path and also delete the info.php file created earlier.

Unpack the zip archive:

unzip 2.6.0.zip

List the unpacked files:


Remove the default index file and info.php file.

rm /var/www/html/index.html
rm /var/www/html/web/info.php

The installation files of OroCRM are located in your current working directory inside the crm-application-2.6.0/ subdirectory now. Copy the files and folders that are inside the subdirectory to your web server document root path by issuing the following command.

cp -rf crm-application-2.6.0/* /var/www/html/

Next, change directory to webroot path and install Composer dependency manager for PHP my issuing the below commands.

cd /var/www/html/

curl -sS https://getcomposer.org/installer | php

All settings correct for using Composer
Composer (version 1.5.5) successfully installed to: /var/www/html/composer.phar
Use it: php composer.phar 

After Composer has been installed on your server, install OroCRM dependencies via Composer script by issuing the below command.

php7.0 composer.phar install –prefer-dist –no-dev

The script will ask to enter the configuration parameters of the application in order to bootstrap OroCRM. Just press [enter] key in order to continue with default values.

Next, make sure you insert Composer $HOME path line in the .htaccess hosted application web directory, by issuing the below command.

echo ‘SetEnv COMPOSER_HOME “/var/www/html” ‘ >> /var/www/html/web/.htaccess

Now execute the below commands in order to grant Apache runtime user full write permissions to the application web, app and cache directories.

chown -R www-data:www-data /var/www/html/web/
chown -R www-data:www-data /var/www/html/app/
chown -R www-data:www-data /var/www/html/cache/

The configuration file of the application is parameters.yml under /var/www/html/app/config/ path.

Log in to MariaDB database console and create a database for oroCRM and a user with a password to manage the OroCRM database. Replace the database name, user and password accordingly.

mysql –u root -p

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 2

Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

MariaDB [(none)]> create database mycrm_db;

Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> grant all privileges on mycrm_db.* to ‘crm_user’@’localhost’ identified by ‘password1234’;

Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;

Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit


Now, let’s start OroCRM installation process via the web interface. Open a browser and navigate to your domain name or server IP address via HTTPS protocol.


On the first installation screen, the OroCRM wizard installer will display a welcome screen. Hit on Begin Installation button in order to start the setup process.

Start the OroCRM installation

On the next screen, the installer will check your system requirements. If all system and PHP requirements are passed, as illustrated in the below images, hit on Next button to move to the next step.

Check system requirements

System requirements - part 2

On the next screen, add your database connection settings. Choose MySQL driver, enter for database host, 3306 for MySQL port and add the database name, user, and password settings configured earlier. Select None for Drop database option.

Then, move on to Mailer settings and add your own mail server SMTP configuration. In case you run a local mail server on the same node, add in SMTP server host filed.

Then, go to System settings, choose the Locale setting for OroCRM and leave the Secret as the default key generated by the application installer.  Finally, leave the WebSocket connection to default settings and hit on Next button to continue the installation process.

Database and system configuration

On the next screen, wait for MySQL database schema to initialize and click on Next button to move to the next step.

Database initialization

Next, set a name in OroCRM organizational name, supply your application URL address and an administrator account with a strong password. Also, add the email address of the admin account and the first and last name of the admin account. Finally, uncheck Load Sample Data and hit on Install button to start OroCRM installation process.

Administration setup

Wait for the installation process to complete and hit on Next button to finish the installation process and move to the last wizard screen.

Installation finished

After the installation process completes, the installer will display the final installation screen and will inform you that the installation process completed. Here, just click on Launch application button in order to be redirected to OroCRM login screen.

Launch OroCRM application

In order to log in to OroCRM platform, use the credentials configured for the admin account during the installation process, as illustrated in the below screenshot.

Login to OroCRM

You will be redirected to OroCRM default dashboard, as shown in the below image. Now you can start managing your CRM platform.

OroCRM Dashboard

Finally, to force visitors to securely access the CRM application via HTTPS protocol, return to your server’s terminal and edit OroCRM .htaccess file located in your website document root path, by issuing the below command.

nano /var/www/html/web/.htaccess

Here, add the below lines under RewriteEgine On in order to automatically redirect application clients to HTTPS.

# Redirect to HTTPS
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

You can also add some new lines at the end of .htaccess file in order to modify the native PHP server settings on-fly, such as file upload size. Make sure the PHP settings presented below match your own server resources.

# PHP settings alteration
php_value upload_max_filesize 100M
php_value post_max_size 100M

In order automatically execute OroCRM administrative tasks, add the below cron jobs owned Apache runtime user.

crontab –u www-data –e

crontab file excerpt:

*/5 * *  *  *  /usr/bin/php7.0   /var/www/html/app/console oro:cron --env=prod > /dev/null
# Run maintenance tasks by executing MessageQueueComponent and MessageQueueBundle asynchronously.
*/5 * *  *  *  /usr/bin/php7.0   /var/www/html/app/console oro:message-queue:consume --env=prod > /dev/null

Congratulations! OroCRM platform has been successfully deployed on your Debian 9 server. Consult OroCRM documentation page at the following address: https://oroinc.com/orocrm/doc/current in order to further configure your CRM platform.

How to Install OroCRM on Debian 9