Ssh/Sftp Authentication; Update Default Ssh/Sftp Keys - ABB XIO-08 User Manual

Table 8-8: Security keys
Account Access
privileges
Name
Totalflow-use Only SFTP
access
(Read-only)
8.7.2

SSH/SFTP authentication

Session keys encrypt the communication between the client and the SSH/SFTP server to provide security.
Authentication requires specific private-public key pairs for the type of access. ABB provides default
private keys and passphrases to customers upon request. ABB stores the default public keys at the factory
in a protected storage location on the device's flash. They remain unchanged by updates.
To request a connection to the SSH/SFTP service, provide the private key and passphrase. The service
compares the private key with the public key stored in the Totalflow device. If the keys pair correctly, the
connection is successful.
IMPORTANT NOTE: Private keys do not ship with the product or user interface software. ABB
keeps the keys and credentials safely stored. Request keys for SSH/SFTP access. Enable the service
only if necessary.
8.7.3

Update default SSH/SFTP keys

ABB Totalflow generates default keys, but customers must generate their own private keys for security
reasons. To update the private key, first update the corresponding public key stored on the XIO device.
This procedure describes how to regenerate a private key and update the corresponding public key on the
device.
IMPORTANT NOTE: Only permit an authorized expert user to perform this procedure. This
procedure requires developer or tech-support access. Failure to follow the procedure in its entirety
locks access to the SSH/SFTP service. To obtain default keys for this type of access, call ABB
Customer Support (see the
Update requirements
The key update requires third-party software.
Obtain the following before update:
 Third-party software, such as PuTTYgen, to generate new keys. Download PuTTYgen as part of a
putty package or as a standalone utility.
 Third-party SFTP client software to establish SFTP connections with the device (FileZilla).
 Latest PCCU from ABB. Download PCCU from www.abb.com/upstream.
 The private keys for developer or tech support accounts, and their respective passphrases for
SFTP. To change the keys for the first time, request the default keys from ABB. Otherwise, use
previously-updated keys.
IMPORTANT NOTE: There are other options for the third-party software. PuTTYgen and FileZilla
are examples. The update procedure is similar with other software.
Generate private-public key pair
This procedure generates and saves a new private-public key pair. The private key, passphrase and public
key are stored safely on the user's laptop or PC. The public key must also be saved in the XIO device. The
134 | XIO USER MANUAL | 2106424MNAA
Default Access
keys
Totalflow-user The following folders and contents are available for download:
private key
 Crash Dumps
 Flash: Main Totalflow application (App), Factory
 Logs: System and device loader log files
 tfData: Running (warm) configuration files
Contact us section).
configuration, Startup (cold) configuration