Start from the completed installer, not a reachable splash page
FreePBX currently directs FreePBX 17 deployments to Debian 12 and says to complete initial setup in the Administrator Control Panel after the installer finishes. Preserve the exact host, installer revision, options and /var/log/pbx/freepbx17-install-<date-timestamp>.log; a reachable web page does not prove the package run completed or that every service is healthy.
Keep the Debian root or sangoma account and privilege-elevation path separate from FreePBX web identities. The host credential does not authorize the Admin Control Panel, and a web administrator does not automatically provide shell access.
Create and preserve the first web administration path
Reach the intended host over a restricted management path, verify its address or name and certificate state, then complete the first web-administrator creation. Record the administrator identity, creation time, recovery owner and where its authorization is managed without storing its secret in the deployment notes.
Do not confuse the Admin Control Panel with UCP, a phone extension, voicemail or an API client. Test a new private browser session and preserve one controlled recovery path before changing authentication type, SAML, directory integration or administrator records.
Assign least privilege through the active owner
For additional administrators, prefer the installed User Management workflow. Sangoma documents separate controls for Allow Administration Login, full administration rights, visible extension range and Administration Access module selection. Resolve Yes, No and Inherit through the user and group before deciding the interface is broken.
The older Administrators module is deprecated. Its documentation says the configured authorization type changes its role and that a matching User Management username can take precedence. Inventory the active owner before editing either module, and prove both one allowed page and one deliberately denied page with the actual account.
Stabilize network ownership before adding public service
Record the management, phone, trunk, media, DNS and time paths. FreePBX 17 documentation lists several valid Debian network-management methods but says the System Admin network page owns only /etc/network/interfaces; a dashboard warning can therefore describe an ownership mismatch rather than a dead interface.
Make address changes only with console or out-of-band recovery available. Keep HTTPS name and certificate, firewall trust, listener reachability and user authentication as separate checks. Do not expose the Admin Control Panel to the internet merely to simplify setup.
Build and prove one minimal internal call path
Create two PJSIP extensions with separate secrets, submit and apply the configuration, then register two authorized test endpoints. Treat saved GUI values, a successful Apply Config, loaded Asterisk objects, endpoint contacts, alerting, answer, two-way media and hangup as distinct evidence.
If a call fails, preserve the exact response and first divergent boundary instead of attaching a paid trunk as a workaround. A successful internal call does not establish trunk service, emergency calling, remote-phone access, capacity, security or production readiness.
Create a recovery point before the system expands
Configure off-host backup storage, run a backup and preserve its manifest, retention owner and isolated-restore plan. Record module versions, network owner, authentication owner, certificate name, extension baseline and the expected internal-call results. A generated archive is not yet a proven recovery point.
Only then add trunks, real numbers, outbound permissions, remote access or SSO. Use the Admin login diagnostic when the management path fails; it keeps web reachability, authentication and module authorization separate. No setup or call was performed for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Sangoma: FreePBX 17 installation ↗
- FreePBX official installation paths ↗
- Sangoma: User Management group and user settings ↗
- Sangoma: deprecated Administrators module ↗
- Sangoma: FreePBX 17 network configuration ↗
- Sangoma: System Admin HTTPS setup ↗
- Sangoma: PBX SAML ↗
- FreePBX User Management release/17.0 metadata ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.