Troubleshooting & FAQ

This page collects the most common questions and failure symptoms reported by new MyOsicam customers. Use your browser’s find-in-page (Ctrl+F / ⌘+F) to jump to the symptom you are experiencing, or browse by category.

For a focused note on the agent-install-401 registration failure, see Agent Install Token Rejected (HTTP 401).

General questions

Will this break my existing OScam setup?

No. The MyOsicam agent reads and adopts the OScam installation that is already on your server — it does not modify any configuration file without an explicit instruction from you via the panel. OScam keeps running exactly as you configured it; your subscribers continue to be served without any interruption during or after the agent install.

The only change at install time is the addition of a myosicam-agent systemd service unit and a narrow sudoers rule that lets the agent manage the OScam service. Nothing in your existing oscam.conf, oscam.server, or oscam.user is touched by the installer.

What happens if my panel goes offline — does my OScam keep working?

Yes. OScam runs as an independent service on each of your servers. The MyOsicam panel and the agent are your management plane — they let you monitor and configure your fleet, but they are not in the path of OScam’s actual card-sharing traffic.

If the panel is unreachable, or if the agent on a server stops for any reason, OScam keeps serving your subscribers without interruption. The agent reconnects automatically once the panel is reachable again and resumes normal heartbeat and sync operations.

What data leaves my server?

Only management-plane metadata is sent to the MyOsicam panel:

The list of OScam instances on your server (names, config paths, runtime status).
Configuration summaries: reader count, protocol ports, global settings from oscam.conf.
Reader and user-account entries from oscam.user — usernames, enabled state, caid/ident lists.
Lightweight resource readings: CPU usage (%), RAM consumption (MB), disk usage (MB).
Heartbeat data: the agent’s host identity and last-seen timestamp.

Can I uninstall the agent cleanly?

Yes. The agent is a standard systemd service plus a single file in /etc/sudoers.d/. To remove it:

# 1. Stop and disable the service
sudo systemctl stop myosicam-agent
sudo systemctl disable myosicam-agent

# 2. Remove the service unit
sudo rm /etc/systemd/system/myosicam-agent.service
sudo systemctl daemon-reload

# 3. Remove the binary
sudo rm /usr/local/bin/myosicam-agent

# 4. Remove the sudoers rule
sudo rm /etc/sudoers.d/myosicam-agent

# 5. Remove the agent working directory (config, registration state, shared secret)
sudo rm -rf /opt/oscam-agent

After removal, OScam is completely untouched and continues running exactly as it did before you installed the agent. No residue is left in any OScam configuration file; the agent working directory at /opt/oscam-agent (which held the agent config and registration state) is also removed by step 5.

Do I need a public IP or open inbound ports on my servers?

No. The agent makes outbound HTTPS connections to the panel — your OScam server never needs to accept incoming connections from the internet. You do not need a public IP address on the server, and you do not need to open any inbound firewall ports.

The panel itself does need to be reachable over HTTPS (that is your management interface), but the individual servers running OScam and the agent have no such requirement. They only need outbound internet access on port 443 to reach the panel.

Does the agent need root access to run?

Root access is needed exactly once — during the SSH-based install triggered from the panel. The installer uses root to create the systemd service unit and write a narrow sudoers rule that allows the agent to start and stop OScam without a password.

After that, the agent daemon runs as its own unprivileged system user. No root privileges are involved in any routine operation: heartbeats, syncs, config reads, or applying panel-initiated changes.

How many servers can I manage from one panel?

There is no hard limit. MyOsicam is fleet-oriented by design — the panel dashboard is built to give you a clear view across as many servers as you operate. Each server runs one agent instance, and each agent manages all OScam instances on that server.

Is the communication between the agent and the panel secure?

Yes. Every request the agent sends to the panel — heartbeats, sync calls, and command-result reports — is authenticated using a Bearer token (Authorization: Bearer <agent_token>) issued to the agent during registration. The panel verifies the token on every call and rejects anything with a missing or incorrect token.

The initial install uses a single-use install token generated by the panel just before the SSH install. The token is presented by the agent on its first registration call and is immediately invalidated once used — it cannot be replayed.

All traffic travels over HTTPS (TLS). The agent never opens a listening port; it only initiates outbound connections to the panel.

What happens if the agent crashes or is restarted?

OScam is completely unaffected. The agent is a standard systemd service configured to restart automatically on failure. If the agent crashes or is manually restarted, OScam continues serving subscribers without interruption. When the agent comes back up it re-establishes its connection to the panel, sends a fresh heartbeat, and resumes normal operation — no manual intervention needed.

Will the agent silently rewrite my oscam.conf or oscam.server?

No. The agent only applies changes that you explicitly initiate through the panel. It never silently rewrites your oscam.conf or oscam.server files.

User-account management (adding, editing, or removing entries in oscam.user) can be done via the panel, and the agent applies those changes directly to the file and triggers a live WebIF reload — no OScam restart required.

How do I update the MyOsicam panel?

The panel includes a built-in self-update mechanism. When a new release is available you will see a notification inside the panel UI. Updates are signed releases — the panel verifies the signature before applying anything. You do not need SSH access or manual file transfers to keep your panel current.

Installation questions

Which operating systems does the panel support?

The panel requires Ubuntu 22.04 LTS or newer or Debian 12 (Bookworm) or newer.

Which operating systems does the agent support?

The agent supports Ubuntu 20.04 LTS or newer and Debian 12 or newer.

The panel installer says “FAILED: unsupported OS” — what do I do?

Your VPS is running an OS that the panel does not support. The panel requires Ubuntu 22.04+ or Debian 12+.

Check your OS version:

lsb_release -a

If you see Ubuntu 20.04, Ubuntu 18.04, or Debian 10/11, you need to provision a new VPS running a supported OS.

The installer fails with “certbot failed” — what do I do?

Let’s Encrypt requires your domain to already resolve to the VPS’s public IP before a certificate can be issued. Certbot also needs port 80 to be reachable from the internet.

Check the following:

Does your DNS A record point at this VPS? (You can verify with dig +short panel.example.com.)
Is port 80 open in your VPS firewall or hosting control panel?

If both are correct, re-run Certbot manually:

sudo certbot --nginx -d panel.example.com -m admin@example.com --agree-tos

The installer hangs on APT with “apt lock still held”?

Another APT process — typically unattended-upgrades — is running at the same time. Wait a few minutes for it to finish, or identify and stop it:

ps aux | grep -E "apt|dpkg"

Then re-run the installer.

License key not recognized — “install quota exhausted”

Key not recognized: double-check the key from your purchase email. Copy–paste it directly rather than typing it by hand.
Quota exhausted: all install slots for your license are used. Contact support or remove an unused install from the admin portal to free a slot.

Agent connection issues

Agent registered but no instances appear in the panel

The agent registers successfully but does not find any OScam instances to sync. Common causes:

OScam is not running: the agent can only discover OScam instances that are currently running (or whose config files are in a known location). Start OScam on the server, then trigger a manual resync from the panel.
Non-standard config path: if your OScam binary and config files are in an unusual directory, check your panel’s server entry and use its resync/rescan option so the agent picks it up.

Server shows “Unreachable” after a successful agent install

The agent installed and registered, but the panel now shows the server as Unreachable. This means the agent cannot reach the panel URL from the OScam server.

On the OScam server, test outbound HTTPS connectivity:

curl -I https://panel.example.com

If this fails, investigate:

Firewall rules blocking outbound port 443 from the server.
DNS resolution for your panel domain not working on the OScam server.
TLS/certificate error (run curl -v for verbose output).

systemd service fails to start after agent install

Read the service status and recent journal:

systemctl status myosicam-agent
journalctl -u myosicam-agent -n 50

Look for permission errors, missing files, or dependency failures in the output. If the agent is stuck in a restart loop due to a registration failure, see Agent Install Token Rejected (HTTP 401).

Agent install returns 401 Unauthorized

This is a known issue. See the dedicated note:

Agent Install Token Rejected (HTTP 401) →