File storage and Hub files

Machines and engineers often need to get files off the plant floor: logs, recipes, quality records, backups of a PLC program. FireSight OT gives each Cloud Connector an optional upload area, and can copy those files to the Hub for the customer's backup software to collect.

Both are off until an administrator allows them in the security settings and turns them on for a connector.

File storage on a Cloud Connector

machine / engineer ──SFTP or FTP upload──► Cloud Connector ──► staff download on the Hub (Files tab)

• Machines and people at the site upload over SFTP (port 2222 by default) or legacy FTP, on the connector's machine-network address only. They can upload, list, rename and delete, but never download.
• Staff download the files on the Hub, from the connector's Files tab, or with fsot-hub connectors download.
• There's a size limit (2 GB by default) and files are cleaned up automatically after 1 to 10 days (7 by default; each connector can be shorter).
• The Hub generates the site's sign-in and keeps only a hash. It's shown once.
• Every upload, deletion and download is in the audit log.

Turn it on:

fsot-hub policy set allow_file_storage=true allow_sftp=true
fsot-hub connectors storage con_… on sftp=on
fsot-hub connectors storage con_… on retention-days=3
fsot-hub connectors storage-password con_…        # the site sign-in, shown once

Allow allow_ftp=true and ftp=on only for older machines that can't do SFTP. FTP sends passwords unencrypted on the machine network.

Copy files to the Hub

A connector can copy finished uploads to the Hub, either everything or one folder such as /to-hub, optionally with a bandwidth limit for slow site links:

fsot-hub policy set allow_hub_files=true
fsot-hub connectors storage con_… on push=on push-folder=/to-hub push-kbps=2000

The Hub checks each copy's size and SHA-256 and saves it before the connector deletes its own copy. A copy that fails stays on the device and is tried again.

On the Hub, files are kept in a folder per customer (with a subfolder per connector) under Hub files, with a size limit per customer.

Let the customer's backup software collect them

Under Hub files, create a backup account for the customer, limited to the backup server's address:

fsot-hub backups add Veeam --customer cus_… --from 203.0.113.10/32
fsot-hub backups credentials bkp_…

The backup software then collects files over either:

• SFTP on port 2022, or
• the S3 API on port 9000 (path-style, Signature V4).

It can list and copy, and optionally delete, but never upload.

Once a file has been copied completely, the Hub marks it backed up and deletes it straight away, or 1 to 3 days later, as the security settings say. Files nobody collects are deleted after a set number of days (30 by default).