Connection security

Where connection passwords and the PFX password of the MQTT client certificate are kept and how they are entered, the security offered by each driver (authentication, TLS, certificate, DCOM) and network / firewall notes.

Passwords are not written to the project

For the three drivers that require authentication (OPC UA, MQTT, OPC DA), the connection parameters contain only the User name; even when Authentication (DCOM identity in OPC DA) is set to User name and password, there is no password field. In MQTT, if PFX file is selected as the client certificate, only the path of the file is kept in the project; the password of the file is also entered in Live, like the connection password. The password and the PFX password are never written to the project file (.fvs); sharing the project with someone else, backing it up or uploading it to Live does not carry them.

Entering the password in Live

1. Log in as an authorized user

   The Settings authorization is required to enter a password. If no user is logged on, Live opens the login window with the message This operation requires the "Settings" authorization.; a user without the authorization receives the message is not authorized. After logging on, click the button again.

2. Open the system menu

   In Live, open the system menu (the ☰ button at the bottom right of the screen). In the Connections section, next to each connection that asks for a user name and password or a PFX password there is a button: Enter password if nothing has been entered yet, Password… if it has.

   1

   1. Enter password — the password is stored on this computer; the Settings authorization is required.

3. Type the password and save

   The Connection password window shows the connection name and the user name; for an MQTT connection with a PFX file selected, it also shows the path of the file and the PFX password field. Enter the values and click Save. After saving, communication restarts: all connections are briefly interrupted and re-established.

   

A connection with no password entered is still attempted; when the server rejects the credentials, the connection message reads … (no password entered for this connection) (OPC UA) or asks for the password to be entered in Live (MQTT). If no password has been entered for a PFX file that requires one, the message begins with The PFX file requires a password but none has been entered.

If a connection is deleted and re-created with the same name, it gets a new ID and the password must be entered again. In a redundant server pair, passwords are not synchronized between the two computers: enter them in both Live instances.

Security offered by the drivers

With the S7, Modbus, Allen-Bradley, Mitsubishi and Omron protocols, anyone who can access the network (the line, for the serial drivers) can establish the same connection and read and write. Place these devices on a separate control network, place a firewall or VPN between them and Live, and where secure communication is required, use the device's OPC UA server.

TLS and certificates

• OPC UA: in the security modes, the server certificate is trusted on first use; afterwards only the saved certificate is accepted. For the server to trust Live, the Live certificate is added to the server. Folders and steps: OPC UA driver. There is no management screen for certificates; the files are located under %LOCALAPPDATA%\FabyaVision\OpcUa.
• MQTT, server certificate: TLS (server certificate is verified) requires the certificate to be signed by an authority trusted by Windows and the address to match the name in the certificate; add a self-signed certificate to Windows as trusted. TLS (certificate is not verified) does not check the identity of the server; a man-in-the-middle attacker can read the traffic, so use it only in closed networks.
• MQTT, client certificate: if the server requires mutual TLS, Live presents its own certificate. The certificate is taken either from a PFX file (its password is entered in Live as above) or by its thumbprint from the Windows Personal certificate store; it must have a private key, and the user running Live must be able to read the key. Details: MQTT driver.

OPC DA and DCOM

• Local server: The Windows user running Live stays selected as the DCOM identity. If the server runs under another account, that account must have permission to launch / access the server.
• Remote server: in the DCOM settings of the OPC server on the remote computer, grant launch and access permission to the connecting user. If you select a user name and password, you can use the format ALAN\kullanıcı. The messages access denied (DCOM permissions) and RPC server unavailable indicate these two problems.
• DCOM / RPC traffic must be allowed through the firewalls between the Live PC and the server. If the server also offers OPC UA, prefer the OPC UA driver.

Network and firewall

Drivers establish an outbound connection to the device; no inbound rule is needed for these connections on the Live PC. In Windows Firewall and network firewalls, outbound traffic to the following ports must be allowed toward the network the device is on:

An inbound connection rule is needed on the Live PC in two cases: browser monitoring and TV display (Remote monitoring), and the redundancy port between the two Live instances in a redundant server pair (default TCP 8091). Live does not add the rule for the redundancy port; add it manually on both computers (Redundant server pair).

Limits