FireSight OT OT remote access

Install a Cloud Hub

The Cloud Hub runs on a Debian 12 or 13 server, in your data centre or in the cloud. One Hub can serve many companies and sites.

What you need

A Debian 12 or 13 server with a public DNS name, for example hub.example.com.
The FireSight OT Cloud Hub bundle, firesight-ot-hub-<version>.tar.gz, from Downloads in the portal.
These ports open to the server:

Port	Used for
TCP 443	The web console, the API, the client and the Cloud Connectors' tunnels
TCP 8443	Optional fallback for sites that block outbound 443
UDP 443	Optional: data saving for Cloud Connectors on mobile data
UDP 51820	Optional full-network VPN (WireGuard)
TCP 2022	Optional: companies' backup software collecting Hub files over SFTP
TCP 9000	Optional: companies' backup software collecting Hub files over the S3 API

Outgoing: if you use the MQTT bridge (0.4.0), allow the Hub out to each company's MQTT broker, usually TCP 8883. Nothing new needs to be open towards the Hub for it.

Install

Step by step, including downloading the bundle straight onto the server, is in Install and upgrade FireSight OT. In short:

tar xzf firesight-ot-hub-<version>.tar.gz && cd firesight-ot-hub-<version>
sha256sum -c SHA256SUMS
sudo bash install-hub.sh --deb ./fsot-hub_<version>_amd64.deb \
     --url https://hub.example.com --letsencrypt you@example.com

The Hub works behind a corporate 1:1 NAT, as long as these ports reach it.

--letsencrypt gets a trusted certificate for the address. You can also get and renew a Let's Encrypt certificate from the console, under Security & settings, with no command line. Without it, the Hub uses a self-signed certificate, and the client asks people to trust its fingerprint the first time they sign in.

Open https://hub.example.com and sign in as admin. The first password is in /var/lib/fsot-hub/initial-admin.txt. Change it, then set up two-factor sign-in under My account.

Settings

The service reads /etc/default/fsot-hub. Restart it after a change with sudo systemctl restart fsot-hub.

Setting	Meaning
`FSOT_PUBLIC_URL`	The address people and devices use. It appears in installers and enrollment instructions.
`FSOT_LISTEN`	Listen addresses, for example `:443,:8443`.
`FSOT_CERT`, `FSOT_KEY`	Your TLS certificate and key. Leave empty for a self-signed certificate.
`FSOT_DATA`	Where the Hub keeps its data, `/var/lib/fsot-hub` by default. Back this folder up.

Everything else, such as the Hub's name, the virtual address pool and the VPN settings, is under Security & settings in the console, or fsot-hub settings set.

License it

A new Hub runs as a 30-day evaluation for up to 3 Cloud Connectors. To license it, open License on the Hub, download the activation request and upload it in this portal. See FireSight OT licenses.

Manage it from the command line

Everything in the console is also in the fsot-hub command, which uses the same API:

fsot-hub login https://hub.example.com
fsot-hub status
fsot-hub companies add "Acme Foods"
fsot-hub audit --action access --csv > access.csv

Run fsot-hub with no arguments for the full list.

Lost the admin password

Stop the service, reset the password, then start it again:

sudo systemctl stop fsot-hub
sudo fsot-hub reset-password admin
sudo systemctl start fsot-hub

Try it first in Docker

There's a test lab that runs a Hub, a Cloud Connector and a small demo plant (a PLC and an HMI) on one computer with Docker. Every port is bound to 127.0.0.1, so nothing is reachable from your network. Contact us if you'd like to try it.