FireSight OT OT remote access

People and access

Nobody sees anything on a Cloud Hub until it's granted to them. Access is given per machine (a resource) or for a whole Cloud Connector, to divisions, vendors or individual people.

Publish a machine

Open Resources → New resource, or a connector's Access tab:

Type	Target	How people use it
Web page (HTTP or HTTPS)	`192.168.1.30:80`	My access → Open, in the browser. No client needed.
RDP, VNC	`192.168.1.10:3389`	My access → Open in the browser, or the client opens Remote Desktop or a VNC viewer.
SSH, Telnet	`192.168.1.40:22`	A browser terminal from My access, `fsot ssh`, or any terminal on the local port.
Serial console	A USB serial port on the Cloud Connector	A browser terminal, or PuTTY/SecureCRT through the client.
TCP	`192.168.1.20:502`	Any tool, pointed at the local port the client gives (Modbus, OPC UA, S7, vendor software).
Network	`192.168.1.0/24`	The person picks the address and port when connecting.

The target can be the site's real address or its virtual address; the connector decides which site it reaches.

From the command line:

fsot-hub resources add --connector con_… --name "Line 3 HMI" --type http --target 192.168.1.30:80 --all-customer
fsot-hub resources add --connector con_… --name "Press 4 PLC" --type tcp --target 192.168.1.20:502

Divisions and external vendors

Under Divisions & vendors, split each company into groups:

Divisions are your own people: plants, lines, maintenance.
External vendors are machine builders and integrators.

Use Access… on a group to choose what it may use: single machines, or everything on a Cloud Connector, which includes machines added to it later.

Vendor accounts are deliberately limited:

They must use two-factor sign-in.
They never get "everyone at the company" access.
They only get a whole network if that resource allows vendors.
They can have an end date and working hours, for example mon-fri 07:00-18:00 Europe/Rome. Sign-in is refused outside those hours, and open connections are closed when time is up.

fsot-hub groups add "Siemens service" --customer cus_… --kind vendor
fsot-hub users add siemens.tech --customers cus_… --groups "Siemens service" \
     --expires 2026-12-31 --hours "mon-fri 07:00-18:00 Europe/Rome"
fsot-hub resources grant "Press 4 PLC" group "Siemens service"

People

Add people under Users, with a role:

Role	What they can do
Admin	Everything on the Hub.
Operator	Their companies' Cloud Connectors, resources and people. An operator placed in a division manages only that division's people and access.
User	Reach the resources granted to them.

You can disable someone, remove them, or reset their two-factor sign-in if they lose their phone (fsot-hub users reset-totp).

What people see

People find everything granted to them under My access: web pages, Remote Desktop, VNC, SSH, Telnet and serial consoles open straight in the browser, with nothing to install. The client can be downloaded there for engineering tools and anything else. See The FireSight OT client.

Port forwards on the Hub

For a tool that can't use the client, an administrator can open a static port forward on the Hub to one machine, limited to the source addresses you list:

fsot-hub connectors forward con_… add 15020 192.168.1.20:502 203.0.113.10/32 "SCADA server"

Static forwards can be turned off for the whole Hub under Security & settings, or for one site.

A forward can also be limited to VPN only, so only signed-in VPN users with access to that site can use it, each use audited by name. The console and Ember warn you about a forward that's open to the whole internet.

Full-network VPN

Where a connector allows it, people can download a WireGuard profile (fsot vpn > firesight.conf) and reach the networks granted to them as if they were on site. Traffic is still limited to what they've been granted. The VPN is off unless an administrator turns it on, for the Hub and for the connector.

Every access is recorded

Every sign-in, session and change is in the Audit log, with the person's division or vendor. See Security and audit.