Preview warning: The reviewed build is suitable for controlled evaluation, not direct exposure to a production or public network without additional hardening.
Default credentials
The current commissioning code uses fixed development credentials for:
- MariaDB root.
- The
foguserdatabase account. - The initial Gateway administrator (
admin/admin).
The same database ports and phpMyAdmin interface are published on the controller. Restrict access at the host firewall and network boundary. Coordinate credential replacement and application configuration with the release owner before production use.
Gateway authentication
Gateway data endpoints require JWT permissions, but the current build:
- Seeds a known administrator on an empty database.
- Stores user passwords without a password hash.
- Ships a static JWT signing configuration in
appsettings.json. - Has no end-user account administration page.
Do not assume JWT alone makes the preview deployment production-safe.
Transport security
The normal container workflow uses HTTP between BFC Console, Node-RED, and Gateway. Port 5001 uses an automatically generated self-signed certificate. SSH protects Setup Tool transport, but the service ports themselves must be isolated on a trusted network or placed behind properly configured TLS and access controls.
Setup Tool connection storage
When Store password on this computer is selected, the SSH password is serialized into connection_values.json without encryption. Protect the workstation account and release directory, and remove saved credentials when no longer needed.
Exposed administrative services
The default setup publishes:
- MariaDB on 3306.
- phpMyAdmin on 8080.
- Node-RED on 1885.
- Gateway HTTP/HTTPS on 5000/5001.
Node-RED is created without application-level editor authentication in the reviewed configuration. Do not expose these ports beyond the required management network.
Secrets in scripts
Current Lua examples contain inline Gateway and device credentials. Before deployment:
- Replace example device addresses and passwords.
- Avoid committing production credentials to shared source control.
- Restrict access to uploaded workspaces under
~/.bfc/containers. - Review container logs for accidental secret output.
Operational safeguards
- Segment the controller and industrial devices from general user networks.
- Allow only required inbound ports.
- Back up MariaDB and Node-RED volumes.
- Test graceful shutdown and safe actuator state.
- Review every example script before running it against equipment.
- Treat phpMyAdmin, Swagger, and Node-RED as administrative interfaces.
- Update container bases and dependencies through a controlled release process.
Security, account lifecycle, certificate management, secret storage, and automatic backup remain explicit hardening work for this first version.