Install a Cloud Hub

The Cloud Hub runs on a Debian 12 or 13 server, in your data centre or in the cloud. One Hub can serve many customers and sites.

What you need

A Debian 12 or 13 server with a public DNS name, for example hub.example.com.
The fsot-hub .deb package, from Downloads in the portal.
These ports open to the server:

Port	Used for
TCP 443	The web console, the API, the client and the Cloud Connectors' tunnels
TCP 8443	Optional fallback for sites that block outbound 443
UDP 51820	Optional full-network VPN (WireGuard)
TCP 2022	Optional: customers' backup software collecting Hub files over SFTP
TCP 9000	Optional: customers' backup software collecting Hub files over the S3 API

Install

sudo ./install-hub.sh --deb fsot-hub_<version>_amd64.deb \
     --url https://hub.example.com --letsencrypt you@example.com

--letsencrypt gets a trusted certificate for the address. Without it, the Hub uses a self-signed certificate, and the client asks people to trust its fingerprint the first time they sign in.

Open https://hub.example.com and sign in as admin. The first password is in /var/lib/fsot-hub/initial-admin.txt. Change it, then set up two-factor sign-in under My account.

Settings

The service reads /etc/default/fsot-hub. Restart it after a change with sudo systemctl restart fsot-hub.

Setting	Meaning
`FSOT_PUBLIC_URL`	The address people and devices use. It appears in installers and enrollment instructions.
`FSOT_LISTEN`	Listen addresses, for example `:443,:8443`.
`FSOT_CERT`, `FSOT_KEY`	Your TLS certificate and key. Leave empty for a self-signed certificate.
`FSOT_DATA`	Where the Hub keeps its data, `/var/lib/fsot-hub` by default. Back this folder up.

Everything else, such as the Hub's name, the virtual address pool and the VPN settings, is under Security & settings in the console, or fsot-hub settings set.

License it

A new Hub runs as a 30-day evaluation for up to 3 Cloud Connectors. To license it, open License on the Hub, download the activation request and upload it in this portal. See FireSight OT licenses.

Manage it from the command line

Everything in the console is also in the fsot-hub command, which uses the same API:

fsot-hub login https://hub.example.com
fsot-hub status
fsot-hub customers add "Acme Foods"
fsot-hub audit --action access --csv > access.csv

Run fsot-hub with no arguments for the full list.

Lost the admin password

Stop the service, reset the password, then start it again:

sudo systemctl stop fsot-hub
sudo fsot-hub reset-password admin
sudo systemctl start fsot-hub

Try it first in Docker

The test lab runs a Hub, a Cloud Connector and a small demo plant (a PLC and an HMI) on one computer with Docker:

docker compose up -d --build && ./deploy/docker/demo-setup.sh

Then open https://localhost:8070. Every port is bound to 127.0.0.1, so nothing is reachable from your network. Ask us for access to the lab if you'd like to try it.