What mumble-server needs
Mumble's documentation publishes no CPU or memory figures for the server. What bounds the load is in the config file: how many clients may connect and how many bits per second each may send. The defaults, from the mumble-server.ini shipped in the mumble-voip repository:
| Setting | Default | What it controls |
|---|---|---|
| port | 64738 | TCP and UDP sockets are both bound to it |
| host | blank | Blank binds every available address |
| users | 100 | Concurrent clients on the virtual server |
| bandwidth | 558000 | Bits per second each client may send speech at |
| serverpassword | blank | Password unregistered users must give to join |
| database | blank | SQLite file; blank means search default locations |
| allowping | true | Answers UDP pings with user count, maximum and bandwidth |
The bandwidth value is a ceiling, not a floor. The configuration page says the client compares its own bandwidth setting with the server's and uses the lower of the two, and that the figure applies per user. Lower it if you want to cap quality; leave it if you do not.
Versions differ by distribution. The current upstream release is 1.5.939 (October 2026). Debian 13 and Ubuntu 26.04 package 1.5.735 and Ubuntu 24.04 packages 1.5.517, all reading /etc/mumble/mumble-server.ini. Debian 12 still carries 1.3.4, with the file at /etc/mumble-server.ini.
Install with the firewall first
- Install ufw, allow SSH and enable it before anything else listens. The ufw man page says a rule applies to IPv4 and IPv6 when IPv6 is enabled; the shipped
/etc/default/ufwenables it withIPV6=yes, and the grep below confirms it. - Install the
mumble-serverpackage. It creates themumble-serversystem user, a data directory at/var/lib/mumble-server(mode 0750) and the systemd unit. - Edit the ini (next sections), then restart the service.
- Run
sudo dpkg-reconfigure mumble-serverto set the SuperUser password, as the package's README.Debian instructs. - Open the voice port last, once a server password is in place:
ufw allow 64738with no protocol suffix opens TCP and UDP together.
sudo apt update && sudo apt install ufw
sudo ufw allow 22/tcp
grep IPV6 /etc/default/ufw
sudo ufw enable
sudo apt install mumble-server
sudoedit /etc/mumble/mumble-server.ini
sudo systemctl restart mumble-server
sudo dpkg-reconfigure mumble-server
sudo ufw allow 64738
sudo ufw status verboseIf SSH listens on a port other than 22, allow that port instead before ufw enable, or you lock yourself out.
The ini settings that matter
The postinst script sets the ini to mode 0640, owner root, group mumble-server, so the service can read it and other local users cannot. Keep it that way: the server password, any certificate passphrase and any Ice secret live in this file in plain text. sudoedit preserves the ownership. Pin the database to the package's data directory so you know which file to back up:
database=/var/lib/mumble-server/mumble-server.sqlite
welcometext="Clan voice. Register once you are in."
port=64738
serverpassword=use-a-long-random-string-here
users=100
bandwidth=558000
sslCert=/etc/mumble/fullchain.pem
sslKey=/etc/mumble/privkey.pem
;ice="tcp -h 127.0.0.1 -p 6502"
;dbus=sessionValues containing commas must be quoted, and backslashes and double quotes escaped, per the notes at the top of the shipped file. Set the database path before you set the SuperUser password: a new database file starts with a new SuperUser.
SuperUser, server password and registration
SuperUser is the account that bypasses every permission check. When a virtual server's database is first created, mumble-server generates a 12-character password for it and logs it. Mumble's documentation says it goes to mumble-server.log. Our reading of the source is that under the systemd unit in Debian 13 and Ubuntu 24.04 and later, which starts the server with -fg, that log is the journal. Replace it. dpkg-reconfigure asks for the new one at a debconf password prompt and feeds it to mumble-server -readsupw on standard input. The other route, mumble-server -supw with the password as an argument, leaves it where ps and the shell history can show it: avoid it.
Log in once as SuperUser, register your own user, put yourself in the admin group on the Root channel (the ACL documentation notes that @admin with Write ACL on Root has every permission) and use that account from then on.
Server password and registration solve different problems. In the server source, the server password is checked only for unregistered users. A registered user is identified by the client certificate stored at registration, and anyone presenting that name with a different certificate is rejected. A clan setup that works: a server password handed to members once, every member registering themselves on first join (the Register Self permission, granted on Root by default), and per-user rights through ACL groups.
"Register" also names the public server list. The register* settings publish your server to Mumble's directory, which requires an empty server password and allowping left on. A private clan server leaves registerPassword blank, which disables listing.
Certificate and admin interfaces
Without sslCert and sslKey, the server generates a self-signed certificate, and the Mumble client warns that it "failed verification" and asks each member to accept it. Our advice: use a certificate from a public CA for the hostname members type, which removes the prompt. Put an intermediate in the same file or in sslCA. After a renewal, copy the new files into /etc/mumble/ again, then restart, or run sudo systemctl kill -s SIGUSR1 mumble-server: the server's SIGUSR1 handler reloads its SSL settings. The units packaged in Debian 13 and Ubuntu 24.04 and 26.04 define no reload command, so systemctl reload is refused there; upstream's unit has one from 1.5.857 on.
Three RPC interfaces can control the server. Ice has no authentication of its own: the configuration page warns that without secrets anyone who reaches the Ice port has full administrative access to every virtual server. Upstream binds it to 127.0.0.1:6502; the Debian package comments the line out. Leave it off unless a management tool needs it, and then keep it on loopback with icesecretwrite set and never open 6502 in ufw. gRPC is listed as unreleased in the scripting docs and has no setting in the shipped ini; D-Bus is obsolete, so leave its ;dbus= line commented. grep -E '^(ice|dbus|grpc) *=' /etc/mumble/mumble-server.ini should print nothing.
sudo install -o root -g mumble-server -m 640 fullchain.pem privkey.pem /etc/mumble/
sudo systemctl restart mumble-server
sudo journalctl -u mumble-server -n 30
sudo ss -tulpn | grep 64738Running it well
- Back up the SQLite file and the ini. The database holds channels, ACLs, registered users and the SuperUser hash; stop the service for a consistent copy.
- Take updates from the distribution with apt, and compare
mumble-server --versionwith the upstream release list now and then. - Leave the autoban defaults (10 attempts in 120 seconds, banned 300 seconds). If many members share one address at a LAN event, the ini documents
autobanSuccessfulConnections=false. - Set
allowping=falseif you do not want unauthenticated clients to see the user count and limits; a public listing needs it left on. obfuscate=truescrambles IP addresses in the log only, and only IPv4; the documentation says it is a simple XOR and probably trivially broken.
Which machine to run it on
Nothing in Mumble's documentation asks for a machine of its own, so our suggestion is to run it beside the game server the clan already has. The bare metal game server line is HPE enterprise hardware in New York, Miami, San Francisco, Amsterdam or Bucharest, and the voice relay shares the game's unmetered port: 1 Gbps on ten of the eighteen configurable lines, 500 Mbps on the other eight, and no traffic counter on any of them. Choose the city nearest the bulk of your members on the data center map and test the path from home with the looking glass.
The network is AS19624, our own autonomous system, so there is no reseller between the server and the routes. IPv6 is not in the default build: add it at checkout at no charge, as individual addresses, which is why the ufw rules above must cover v6. A racked machine is live about 30 minutes after the order is approved, with root and, on every rack server and blade, an out-of-band console. Any Linux dedicated server on Ubuntu 24.04 or 26.04 runs the packages above.
Where it is the wrong fit
A dedicated machine for voice alone is more than most clans use. If your members already know TeamSpeak, our TeamSpeak server page covers its licence and ports. Web admin panels for Mumble talk to Ice; this page does not cover them.
Questions
Which ports does a Mumble server use?
One number: 64738 by default, and the server binds both a TCP and a UDP socket to it, so the firewall must allow both. The Debian README notes that Mumble can also run in TCP-only mode, which is how it works over Tor. Ice, on 6502 when enabled, should never be reachable from outside.
Where do I find the SuperUser password?
On first start mumble-server generates one and logs it. On Debian 13 and Ubuntu 24.04 or later we find it in the journal (journalctl -u mumble-server); Debian 12 writes it to /var/log/mumble-server/mumble-server.log. Do not keep it: set your own with sudo dpkg-reconfigure mumble-server, which reads it at a hidden prompt. Then register a normal admin account and use that.
Is murmur the same thing as mumble-server?
Yes. The Debian README says mumble-server, murmur and murmurd all refer to the same server binary. Current packages install it as /usr/bin/mumble-server and the config as /etc/mumble/mumble-server.ini; Debian 12's 1.3.4 package still uses murmurd and /etc/mumble-server.ini.
Do registered users still need the server password?
No. The server checks the server password only for unregistered connections. A registered user is matched by the certificate stored at registration, and the same name arriving with a different certificate is rejected, so members should keep their client certificate backed up.
How much bandwidth does Mumble use per person?
The server caps what each client may send at the bandwidth setting, 558000 bits per second by default, and the client uses the lower of that and its own setting. Actual usage depends on the client's quality settings. Lower the server value to cap it.