I want to do exactly the same as you, but have not found your problem
Am sysadmin / programmer at a school in Hordaland county, Norway. Got osTicket at a external webserver today, am going to move it inhouse when the summer holiday is over.
The reply-section of osTicket will be entirely in-house, the students might have access from the outside as well as inhouse.
Here's a small description on how we'll do it:
Admins create the tickets.
Students and staff claim and respond to the ticket.
Then admin responds to the response.
If the students and staff are happy then the ticket are resolved, else it's back to 2.
The last modified thread or action for each ticket are shown to students and staff through their interface.
I simply blocked access to the scp-directory from all subnets but the ones used by support staff (.htaccess). It's no problem to grant students and staff access to the "public" part, so they can see the progress on their tickets.
