We use Flyspray, and it works fine--very lightweight and easy to install anywhere with PHP available (we use it because it integrates relatively easily with the rest of our site).

I've also used Trac and liked it even more. Roundup is also good, if you don't need all of the extra stuff trac provides (wiki, timeline, etc.). If trac hasn't fixed their horribly broken authentication yet, then that would be a strong argument against it, but I can't imagine that it hasn't been fixed by now.