Let's secure our interface. Each change we make to our system in this course is
either focused on keeping the bad guys out or limiting their impact if they happen to get in.
The first change we're making is the latter. We're lessening the impact of malicious activity or even
accidental configuration. Right now, our interface uses the read-write version of the PI interface
for OPCDA. It's possible to create a point on the PI data archive that causes the interface
to write back to the OPC server. So, this means that someone with right access to the data archive
can essentially make changes down in the control system. But in fact, let's draw a hacker here,
as we'll see more a little later in the course our configuration is so bad
that someone wouldn't even need administrator access. Anyone that happens to be on our
network could spoof a connection and make a change to the rights to our control system.
And all we'd see in the logs is that someone called PI admin created a tag.
Are you scared yet? You probably should be! What's more scary is that the configuration
we have right now is really common! I feel my heart sink whenever I see it in the wild.
It's common because it works. If you go through and configure things so they just work, in the
way that's easiest to get it working really what you have in our configuration right now
is what you get. There's a reason we teach things the way we do in the basis class.
To prevent this from happening. We don't really give you any option but to use good security
practices if you go through configuration as we did in the basics class. So, in this class we're
fixing up a poorly implemented system. We're going to install the read-only version of the interface.
So, this version is effectively the same as the read-write version of the interface,
but it doesn't have any functionality relating to writing back to the OPC server.
We'll actually have two interface versions installed at the same time
a read-write and a read-only. Next, we're going to copy our configuration over from
the read-write version to the read-only version. Make some minor edits to it making it recognize
that it's for the read-only version now and then we'll load our interface into the ICU and create
a new instance. We'll install its service then stop the old one and start the new one.
So, all this while making sure we're still getting data. After we do all this, we'll configure
disconnected startup and health tags and make sure the interface is following best practices.
We're on PIINT01, let's take a look at our configuration before we make any changes
and well let's see if everything's still working. Now we're going to open up the ICU.
So, interface configuration utility on PIINT01 and take a look at our interface configuration.
We select the only interface in the list and here's how we've got it configured.
Now right now it's running as a service under the default service account,
and we have a point source here. I'm going to copy this so I can use it later.
And we're going to make some changes here and best practice is to have a scrolling log open
while we're doing that. So, let's open that up, a little bit of paper with the PI symbol and there
we go. Okay let's switch over to PISRV01 and see if data is actually coming in for this interface.
We're going to open up system management tools on PISRV01, so down to PI System,
PI System management tools and then go into data and current values.
We do a tag search, and we search for all tags for the point source of our
copied point source from our interface. We search and let's select all and okay.
Here's our tags, I'm going to click on the play button and I'm getting data through. The other
thing we should check is if buffering is working. So, because we're coming in and going to make some
changes here, I'm really concerned that everything is working before we start making changes.
So, I'm going to go back to PIINT01 and go tools, buffering.
Here we go! Looks like events are getting sent through the queue.
It's getting 19 events per second now, 20 events per second.
We are getting data through the queue. Okay let's start making some changes.
The first thing I'm going to do is install the read-only version of the interface.
So, open up PI install kits on the desktop of PIINT01 and we're going
to right-click and run as administrator on the OPC and read-only install kit.
Don't install the PI API yet. We're going to do that later.
Okay so first we're going to set up the interface using the strategy in place,
using trusts. I'm going to click next, next, next on here and then we're going to go and see
what's happening in the PI data archive. See how this original interface is actually getting in.
Okay we're installed. Now before we switch over, I want to confirm
that our other interface or when we do switch over our new interface will work, security wise. So,
let's go over to our data archive and we're going to go to operation and network manager statistics.
This will tell us how our different services are connecting.
I'm going to scroll down and find our OPC interface, so OPCpE here it is.
Scroll along, looks like it's getting in under a trust called PIINT01
it's being mapped to the super user PI admin. And this is the first part where my brain goes:
“Oh no! Danger, danger!”. Let's see how that's actually configured. So, let's go
down into security and mappings and trusts and into the trusts tab and here is our interface
trust. So PIINT01 is called, and it maps anything coming from the machine PIINT01 to the super user.
Now we're going to take a look at this a little deeper later, but this is where alarm
bells are ringing here. And I'm looking at this and feeling very uncomfortable.
Okay we're going to fix it later but when we switch over to our read-only version of
the interface it'll still work. Because we have this trust here letting in any connection from
the interface. Anyway, so it doesn't really matter what we run the interface as it'll still work. So,
let's go back to the interface and we're going to switch over to the read-only version now.
So, there's a few steps here. I'm going to go into windows file explorer,
down into this pc and d: drive and into program files x86, PIPC,
interfaces. This is where our interfaces are installed.
The interface binary files, all the configuration for each interface instance is in these folders.
So, the top one is OPC and read write and the bottom one is read only. We just installed the
bottom one. So, we should if we go into OPCInt see a configuration file for our
interface instance called OPCInt1. And we see it here, this bat file.
So, what does this bat file actually do? Let's right click and edit it.
Here we go. So, this is the file that's written by the ICU when we save configuration. We can see
every different version that's been saved so far here, and the last line runs the opcn.exe
file with a lot of different flags turned on and off. To see exactly
what these flags do read the documentation for the interface but really, they're the
different bits of the ICU configuration all written into the configuration file.
Okay we're going to copy this to the OPC read only folder. So, I'm going to close this.
I'm going to copy this opcn1.bat, go one file up, go into our OPCInt_ReadOnly and paste it here.
I'm going to make some minor changes here before I open it up in the ICU
and configure it further. I'm going to right click, go to properties and
make it read write. Make the configuration file read write. I'm just about to write to it, okay.
And then right click and edit.
So, the final line here we see that it's running. It's got an explicit path to the read write
version of the interface when this configuration is run. We're going to change this to the
read only version. So, if we look at the file path of the read-only version
we see it is OPCInt_ReadOnly as the folder name
and OPCInt_ReadOnly.exe is the file name. So, we can change this here.
Save this and our configuration is complete. We can close all of these and then we can use
the ICU to go to interface and then new windows interface from bat file. This creates a new
interface from an already existing configuration bat file. Which is what we just created.
So, we're going not OPC int we're going back to interfaces
and OPCInt_ReadOnly then going into this opcint1.bat. Click on that and then open.
It gets very angry with us because we've got a duplicate configuration. It is detected
that both interfaces that we have loaded now, the read only and the read write,
will both be writing to the same points. And if they both run at the same time, then you'll get
duplicate data. It's okay with us we're only going to run one at a time anyway. So okay.
Now under the drop down we have two different interfaces. OPCint1 and OPCInt_ReadOnly.
For this read only one we're going to go down to service and we're going to leave it to log
on as the default service account for now. We're going to change that a little later. And create
okay. Now we have both interface instances created as services. The new one's not running but the old
one is. I'm going to go and stop the old one and start the new one. So back to OPCint1.
I would like to save my changes. Okay I'm going to stop the old one
and once that’s stopped navigate to OPCInt_ReadOnly1 and then start.
So, I would have got a little bit of data loss there. About equivalent to a normal
interface restart. Once that started up the very first thing you should do
is make sure data is still flowing. So, let's go back to our PISRV01,
go into our current values and data's still flowing. We're good, okay.
We're going to go back to our interface machine
and remove the old read write interface instance. So, I'm going to navigate into OPCINT1
then click on ok. Then go interface, delete interface instance. This will also remove
the service. It asks us if we want to delete the configuration file as well,
I'm going to say no just in case we want to go back to this configuration.
So, it's been removed. Now we only have one interface which is the one we want to keep.
Let's make sure this is using best practices. So, let's go down to disconnected startup,
we're going to enable it, we're going to browse for a cache path.
I'm going to leave this in the OPCInt_ReadOnly folder
and then I'm going to go down to health points and create the health points we want.
So, I'm creating the heartbeat, the device status, the IO rate and scan skipped for scan class 0.
I'll apply all this
and then restart my interface.
While that's restarting, we can go over to PISRV01, do another tag search.
Search for the same thing again, this time it'll grab the health points we just created as well.
Select all and okay. Sort by tag name in reverse order and we get the health points.
So, I'm pretty happy with this, well actually I'm not very happy with this because it's still
using that same trust that we really really need to fix. But at least if we were to be attacked,
this interface that's running right now, has no ability to write back to our control system.