VICIdial in 2026: What Changed and Why Your Old Install Guide Is Wrong

Every VICIdial installation guide on Google right now is wrong. Not "slightly outdated" — wrong in ways that will waste your entire weekend and leave you with a system that's insecure, misconfigured, or just broken.

CentOS 7 hit end-of-life in June 2024. The OS that 90% of VICIdial guides reference is dead. No more security patches, no more updates. Every tutorial telling you to run yum install centos-release-scl is historical fiction.

ViciBox jumped from version 9 to 12. Asterisk 18 is the default. PHP 8.2 is standard — and the old mysql_* functions your 2018 install script references have been gone since PHP 7.0. The SVN trunk is at revision 3939+, version 2.14b0.5, database schema 1729. If you follow a guide written for ViciBox 8 or CentOS 7, you're building on a foundation that doesn't exist anymore.

Here's what actually works in 2026.

Two Paths, No Others

For a new VICIdial install, you have exactly two viable options:

Option 1: ViciBox 12.0.2 ISO (the sane path). The official pre-built image maintained by Kumba. Bundles OpenSuSE Leap 15.6, Asterisk 18, MariaDB 10.11.9, PHP 8.2, and VICIdial into a single bootable ISO. Download from download.vicidial.com/iso/vicibox/server/, burn to USB, boot, and answer a few questions.

After the OS is installed, set a static IP with yast lan, set timezone with vicibox-timezone (not regular yast — the regular command doesn't update PHP timezone), update with zypper ref && zypper up (never zypper dup — distribution upgrades can downgrade MariaDB or break DAHDI), then run vicibox-express. Reboot. VICIdial is running. Verify with screen -ls — you should see 10-12 screen sessions. Hit http://your-server/vicidial/welcome.php with default credentials 6666/1234. Total time: about 30 minutes.

There's one bug to fix immediately: ViciBox 12 ships with a MariaDB version that deprecated implicit TIMESTAMP behavior. Add explicit_defaults_for_timestamp = Off to /etc/my.cnf.d/general.cnf and restart MariaDB.

Option 2: Scratch install on AlmaLinux 9 (the control freak path). For people who need RHEL-family Linux or want to understand every component. Use the carpenox auto-installer — the most actively maintained community script for Alma/Rocky 9 with Asterisk 18:

timedatectl set-timezone America/New_York
yum check-update && yum update -y
yum -y install epel-release && yum update -y
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
cd /usr/src
git clone https://github.com/carpenox/vicidial-install-scripts.git
reboot
cd /usr/src/vicidial-install-scripts
chmod +x alma-rocky9-ast18.sh
./alma-rocky9-ast18.sh

SELinux must be disabled. Non-negotiable. VICIdial's Perl scripts, Asterisk's file operations, and Apache's config all assume it's off. The script handles dependency installation, Asterisk 18 compilation with the five VICIdial-specific patches, DAHDI, database setup, crontabs, and boot scripts.

Everything else — CentOS, ViciBox 9, Asterisk 13, manual compilations from a 2019 forum thread — is a waste of your time.

Hardware: Real Numbers

The ViciBox 12 documentation finally has proper dimensioning specs, and they're different from what forum posts from 2015 will tell you.

Single server (10-25 agents): 4+ cores at 2.0 GHz, 8 GB RAM minimum (16 GB recommended), SSD storage. SSDs are mandatory in 2026 — not recommended, mandatory. The ViciBox documentation explicitly states SATA SSD as minimum. If someone tries to sell you a VICIdial server on spinning disks, they're stuck in 2016. A single Express server realistically handles 15-20 outbound agents with predictive dialing active.

Multi-server cluster: When you outgrow a single box, VICIdial splits into four roles:

• Database server — The brain. One per cluster, always. For 150 agents: 8+ cores, 32 GB ECC RAM, NVMe RAID1.
• Telephony/dialer servers — Each handles about 25 outbound agents with heavy recording and 4:1 dial ratios.
• Web servers — 2-4 cores, 4-8 GB RAM. SSL cuts capacity roughly in half due to TLS overhead.
• Archive server — The one place spinning drives are fine.

You add servers as you grow: split DB from telephony at 20 agents, second dialer at 25, dedicated DB at 50+, dedicated web at 70+, slave database for reporting at 150+. One cluster maxes out around 450-500 agents (VICIdial's MEMORY tables are single-threaded).

Post-Install: The Part Every Guide Skips

This is where most tutorials end with a screenshot of the login page and "Good luck!" Not helpful. Here's what you actually need to do.

Lock Down the Defaults

1. Change admin password — Admin > Users > Modify user 6666. The default 6666/1234 credentials are known to literally everyone who has ever Googled "vicidial."
2. Set MySQL root password — mysqladmin -u root password 'SOMETHING_STRONG'
3. Change phone registration passwords — Default is test. Yes, really.
4. Move SSH off port 22 — Every bot on the internet is hammering port 22.

Set Up Your SIP Trunk

Navigate to Admin > Carriers > Add A New Carrier. For an IP-authenticated trunk:

Account Entry:

[your-carrier]
disallow=all
allow=ulaw
allow=g729
type=peer
insecure=port,invite
host=sip.yourcarrier.com
dtmfmode=rfc2833
context=trunkinbound
canreinvite=no

Dialplan Entry:

exten => _91NXXNXXXXXX,1,AGI(agi://127.0.0.1:4577/call_log)
exten => _91NXXNXXXXXX,2,Dial(${CARRIER}/${EXTEN:1},60,tTor)
exten => _91NXXNXXXXXX,3,Hangup

Verify with asterisk -rx "sip show registry" and asterisk -rx "sip show peers".

STIR/SHAKEN attestation matters enormously in 2026. You need A-level attestation, which requires your DIDs and termination on the same carrier. Without it, "Scam Likely" appears on consumer phones within a week.

Create Your First Campaign

The critical choice is dial method. For most outbound operations: ADAPT_HARD_LIMIT with a 3% drop ceiling for TCPA compliance. For small teams or testing: RATIO with a fixed level. Start your auto-dial level at 1.5 and adjust based on performance.

Key settings: Hopper Level 100-200, Dial Timeout 26-30 seconds (carrier-dependent), Available Only Tally = Y.

Agent Phone Setup

Two options in 2026. Traditional SIP softphones (MicroSIP, Zoiper) where agents need software installed and configured with extension, server IP, and registration password. Or WebRTC/ViciPhone — browser-based, zero software installs, works from anywhere. WebRTC requires SSL on your web server (vicibox-ssl on ViciBox or certbot on scratch installs) and port 8089 open. This is how most remote operations run now.

Clustering Rules Nobody Writes Down

Past 20-25 outbound agents, you need a cluster. Four rules that will save your weekend:

1. One adaptive process, one server. The AST_VDadapt process (keepalive 5) runs on exactly one server in the entire cluster. Running it on two causes dial-level conflicts that look like random drops. Same for AST_VDauto_dial_FILL (keepalive 7).

2. Same LAN, no routers. All cluster servers need sub-1ms latency. A router between database and dialer servers adds enough latency to break agent sessions. Use IAX2 (not SIP) for inter-server trunks.

3. NTP from one source. All servers sync clocks to the database server. Independent NTP sync to external servers causes clock drift that breaks sessions, disconnects calls, and corrupts reporting.

4. Know the ceiling. One cluster maxes at 450-500 agents. Plan your growth accordingly.

The Troubleshooting Hall of Fame

These fill the VICIdial forum's 13,400+ support threads:

• No audio / one-way audio — 80% firewall blocking UDP 10000-20000 (RTP). 15% missing externip in sip.conf. 5% SIP ALG on a NAT router. Temporarily disable firewall and test.
• "No available sessions" — Conference extensions aren't populated for your server IP. Admin > Conferences > Show VICIDIAL Conferences.
• Recordings missing — Check SOX installed, campaign recording set to ALLCALLS, cron jobs running, /var/spool/asterisk/monitor/ for raw files. User-level recording can silently override campaign setting.
• Database schema mismatch — Updated SVN but forgot the database upgrade: mysql -p -f --database=asterisk < /usr/src/astguiclient/trunk/extras/upgrade_2.14.sql

The Honest Take

VICIdial is incredible software — free, powerful, and in the right hands it outperforms dialers that cost 10x more. But running it yourself means you're the sysadmin, DBA, telephony engineer, security auditor, and carrier relationship manager all at once. When Asterisk crashes at 9 AM Monday and 50 agents are sitting idle, you're the one in the terminal.

ViciStack does overnight migrations to fully optimized bare-metal infrastructure with AMD accuracy hitting 92-96% out of the box, STIR/SHAKEN A-level attestation from day one, and DID reputation management included at $150/agent/month. But if you're the DIY type, the instructions above will get you from bare metal to first dial without following a guide that's been wrong since 2024.

Originally published at https://vicistack.com/blog/vicidial-setup-guide/