People and access

Nobody sees anything on a Cloud Hub until it's granted to them. Access is given per machine (a resource) or for a whole Cloud Connector, to divisions, vendors or individual people.

Publish a machine

Open Resources → New resource, or a connector's Access tab:

Type	Target	How people use it
Web page (HTTP or HTTPS)	`192.168.1.30:80`	My access → Open, in the browser. No client needed.
RDP, VNC	`192.168.1.10:3389`	The client opens Remote Desktop or a VNC viewer.
SSH, Telnet	`192.168.1.40:22`	`fsot ssh`, or any terminal on the local port.
TCP	`192.168.1.20:502`	Any tool, pointed at the local port the client gives (Modbus, OPC UA, S7, vendor software).
Network	`192.168.1.0/24`	The person picks the address and port when connecting.

The target can be the site's real address or its virtual address; the connector decides which site it reaches.

From the command line:

fsot-hub resources add --connector con_… --name "Line 3 HMI" --type http --target 192.168.1.30:80 --all-customer
fsot-hub resources add --connector con_… --name "Press 4 PLC" --type tcp --target 192.168.1.20:502

Divisions and external vendors

Under Divisions & vendors, split each customer into groups:

Divisions are your own people: plants, lines, maintenance.
External vendors are machine builders and integrators.

Use Access… on a group to choose what it may use: single machines, or everything on a Cloud Connector, which includes machines added to it later.

Vendor accounts are deliberately limited:

They must use two-factor sign-in.
They never get "everyone at the customer" access.
They only get a whole network if that resource allows vendors.
They can have an end date and working hours, for example mon-fri 07:00-18:00 Europe/Rome. Sign-in is refused outside those hours, and open connections are closed when time is up.

fsot-hub groups add "Siemens service" --customer cus_… --kind vendor
fsot-hub users add siemens.tech --customers cus_… --groups "Siemens service" \
     --expires 2026-12-31 --hours "mon-fri 07:00-18:00 Europe/Rome"
fsot-hub resources grant "Press 4 PLC" group "Siemens service"

People

Add people under Users, with a role:

Role	What they can do
Admin	Everything on the Hub.
Operator	Their customers' Cloud Connectors, resources and people. An operator placed in a division manages only that division's people and access.
User	Reach the resources granted to them.

You can disable someone, remove them, or reset their two-factor sign-in if they lose their phone (fsot-hub users reset-totp).

What people see

People find everything granted to them under My access: web pages open straight in the browser, and the client can be downloaded there for everything else. See The FireSight OT client.

Port forwards on the Hub

For a tool that can't use the client, an administrator can open a static port forward on the Hub to one machine, limited to the source addresses you list:

fsot-hub connectors forward con_… add 15020 192.168.1.20:502 203.0.113.10/32 "SCADA server"

Static forwards can be turned off for the whole Hub under Security & settings.

Full-network VPN

Where a connector allows it, people can download a WireGuard profile (fsot vpn > firesight.conf) and reach the networks granted to them as if they were on site. Traffic is still limited to what they've been granted. The VPN is off unless an administrator turns it on, for the Hub and for the connector.

Every access is recorded

Every sign-in, session and change is in the Audit log, with the person's division or vendor. See Security and audit.