Category:LS-WXL

= LinkStation Duo (LS-WXL) =

Variants

 * 1.0TB LS-WX1.0TL/R1
 * 2.0TB LS-WX2.0TL/R1
 * 4.0TB LS-WX4.0TL/R1

Commercial description
LS-WXL : LinkStation™ Duo @ BUFFALO

The LinkStation™ Duo is a high performance, multimedia, shared RAID network storage solution for the home and small office that requires a central location to share data files, photos, video and music.

The unit is a two drive NAS solution that can be configured in RAID 0 for performance or RAID 1 for redundant storage. In addition to the storage capabilities, stream multimedia to a PC, a Mac, a Buffalo™ LinkTheater™ and other DLNA CERTIFIED™ or UPNP media player, as well as sharing movies, photos and documents in a home or small business network via the Internet with the WebAccess feature. The LinkStation™ Duo seamlessly integrates with iTunes® and allows access to music files from your iTunes® software.

With features such as enhanced performance of up to 40MB/s, quick swap via the front panel with two removable drives and easy set-up via a simple web interface, the LinkStation™ Duo is the perfect solution to store, save & share your digital life from one central place.

Gain SSH Access
Source / Credit :

See notes below for Firmware 1.41.

The following passwords are for extracting the firmware, not accessing the live box!

Firmware 1.71 &Firmware 1.68 & Firmware 1.65 & Firmware 1.62 & Firmware 1.57 & Firmware 1.54
Use the following password:

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l

Warning: Firmware 1.68 looks currently unstable.

Firmware 1.64 & Firmware 1.63 & Firmware 1.60 & Firmware 1.41
Use the following password:

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

Firmware 1.58 & Firmware 1.52 & Firmware 1.42
Use the following password:

IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty

Firmware 1.56
Use the following password:

aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB

Firmware 1.41 and later
In this version, it appears that acp_commander no longer provides the capability to execute commands, which prevents most earlier strategies from working. However, it is quite straightforward to solve this problem by using a custom firmware image. The basic principle is described in Create a custom firmware image.

Start with the files downloaded from Buffalo's website. Then, ideally on a Linux platform of some sort...

1) unzip the hddrootfs.img unzip hddrootfs.img

provide the right password for the firmware.

For version 1.41, the third zip password listed in the above mentioned reference proved successful:

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

The result of this is a hddrootfs.buffalo.updated...this is the tared root-filesystem of the firmware image.

2) create a folder where you want to untar the rootfs and untar it

mkdir cd  tar -vxz --numeric-owner -p -f ../hddrootfs.buffalo.updated

3) modify the image to enable sshd logins. This copies an authorized_keys file from your home directory on the Linux box, but any mechanism to make an authorized_keys file will work

cd etc sed -i 's/PermitRootLogin/# PermitRootLogin/' sshd_config cd ../root mkdir .ssh chmod 700 .ssh 3-a) copying authorized_keys (option 1) cp $HOME/.ssh/authorized_keys .ssh/authorized_keys  chmod 600 .ssh/authorized_keys 3-b) generating authorized_keys (if you don't have an authorized_keys file) ssh-keygen -t rsa save as .ssh/key mv key.pub authorized_keys '''3-1) if firmware version is higher than 1.64, you should edit /etc/ftpusers, or the sshd cannot be executed. cd ../etc  sed -i 's/root/#root/g' ./ftpusers

4) create the hddrootfs.buffalo.updated again (you should be in the folder where you extracted the image)

tar -vczf ../hddrootfs.buffalo.updated-new * cd .. mv hddrootfs.buffalo.updated hddrootfs.buffalo.updated-old mv hddrootfs.buffalo.updated-new hddrootfs.buffalo.updated

5) create the hddrootfs.img again

CAUTION: if you use the wrong password, the firmware updater / the linkstation will fail to unzip the hddrootfs.img

zip -e hddrootfs.img hddrootfs.buffalo.updated 6) Perform the update using the normal Buffalo updater (probably after enabling the debug option to reload the image)

7) See the notes about editing the /etc/nas_feature file below and elsewhere on this WIKI.

'''  This is a file that is generated during boot time. ''' The entry SUPPORT_SFTP=0 needs to be changed to SUPPORT_SFTP=1 in order for sshd to start via /etc/init.d/sshd.sh. The following acp_commander command may work post reboot:

java -jar acp_commander.jar -t  -ip  -pw  -c "sed -i 's/SUPPORT_SFTP=0/SUPPORT_SFTP=1/' /etc/nas_feature

8) Use ssh to root@ip_address

Method 1
Follow the instructions in Open Stock Firmware LS-VL, which works for all devices sharing that firmware.

Method 2
Firmware 1.40 has a different sshd_config with 'PermitRootLogin' set to 'no'. The permissions on this file are not open like the pam sshd file, so it is necessary to add a back door prior to upgrading to 1.40. One technique would be to perform the following

echo '* * * * * /bin/bash /tmp/cron.root.sh' >> /etc/cron/crontabs/root

After the firmware upgrade is complete, you can add commands to /tmp/cron.root.sh and they will be executed once a minute with root privileges. You can use this to replace the sshd_config. You may also wish to keep the cron job enabled in case of future issues, though it does pose a security risk.

Firmware prior to 1.40
Tested with firmware v1.33 and v1.34, but does not work with v1.40. It is possible to gain root access via the web server.

1. Create a shared folder name 'www'

2. Enable the web server in Network -> Web Server

3. Set the Port No. 81

4. Set the target folder to www

5. The default index.php is showing phpinfo;

6. Now with PHP enabled, you can edit /etc/pam.d/sshd via a simple script

7. comment out all lines that begin with 'auth'

8. add the line: auth required pam_permit.so

a simple PHP script like :



9. Now, you should be able to SSH to LinkStation Duo without any password.

Note: the file /etc/pam.d/sshd gets re-created each time the system starts up

Best way to get permanent root access is to install your SSH public key in the 'authorized_keys' file.

... install your SSH public key in /root/.ssh/authorized_keys
 * 1) mkdir /root/.ssh
 * 2) chmod 700 /root/.ssh
 * 1) chmod 600 /root/.ssh/authorized_keys

N.B. The ssh-copy-id program, which is distributed with OpenSSH, can also be used to easily copy across your SSH public key onto the LinkStation.

Second method to gain root access
Download acp_commander (See http://buffalo.nas-central.org/index.php/Open_Stock_Firmware)

1. Use acp_commander and the sed command (built-in) to edit the /etc/pam.d/sshd file: java -jar acp_commander.jar -t  -ip  -pw password -c "sed 's/auth/#auth/' /etc/pam.d/sshd.new" 2. Now add the required auth parameters: java -jar acp_commander.jar -t  -ip  -pw password -c "echo 'auth required pam_permit.so' >>/etc/pam.d/sshd.new" 3. Finally, replace the edited version to the right place: java -jar acp_commander.jar -t  -ip  -pw password -c "cp /etc/pam.d/sshd.new /etc/pam.d/sshd"

NOTE: acp_commander may complain about the password being incorrect but this should not affect the outcome. This second method was tested with firmware v1.34. You could potentially use interactive mode in acp_commander (the -s option) to save keystrokes, but the basic approach is the same.

At this point you should be able to get root access without the need of the password. To maintain root access, the public key recommendation remains as noted above. However, every time the box restarts and /etc/pam.d/sshd is replaced, you could rerun the third command above to regain root access without the password.

IPKG
Once you have root access, you can start to install packages from IPKG. To do so, first run the following

cd /tmp wget http://ipkg.nslu2-linux.org/feeds/optware/cs05q3armel/cross/stable/teraprov2-bootstrap_1.2-7_arm.xsh sh ./teraprov2-bootstrap_1.2-7_arm.xsh

Once that's done, edit by typing vi /opt/etc/ipkg.conf and add

src cs08q1 http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/stable/
 * 1) src cs08q1-unstable http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/

Save by typing [esc]:wq[enter]

Open /etc/init.d/rc.optware by typing vi /etc/init.d/rc.optware

find REAL_OPT_DIR=blahblah and change into as your setting as REAL_OPT_DIR=/mnt/disk1/.optware or REAL_OPT_DIR=/mnt/array1/.optware

Save by typing [esc]:wq[enter]

Check for guide on using VI text editor. (Simply you move cursor by cursor key and type 'a' or 'i' then you can add some text')

(If you wish to use the unstable branch you can uncomment it.)

After that just run `ipkg update` and you can then install packages with `ipkg install package`

NFS
To enable NFS on these boxes (specifically firmware versions 1.41 and 1.42), follow the above instructions to install IPKG. See also the section on TeraStation "Conversion".

Then run:

ipkg install e2fslibs ipkg install portmap

Next, obtain the estimable Kenatonline's NFS Tools:

cd /mnt/array1 wget http://downloads.buffalo.nas-central.org/Users/kenatonline/NFSKernel/nfstools.tar.gz cd / tar xvzf /mnt/array1/nfstools.tar.gz

Finally, create an /etc/exports file according to taste, and start everything:

cd /opt/etc/init.d S55portmap start S99nfs start

You're done.

TeraStation "Conversion"
'''[Moderator] According to our board rules, any kind of description, which violates copyrights or licenses, is not allowed. The "conversion" to a TeraStation would potentially violate licensing agreements Buffalo made with third party companies. Therefore this content was removed. The firmware consists of more than just GPL'd software. '''[/Moderator]

Firmware Information
Firmware v1.37 is available at or direct link

Generated with v1.58 of 17th April 2012 from 4TB LS-WX4.0TL/R1

uname -a
Linux LS-WXLE0F 2.6.31.8 #1 Fri Apr 6 14:14:26 JST 2012 armv5tel unknown

cpuinfo
Processor     : Feroceon 88FR131 rev 1 (v5l) BogoMIPS      : 598.01 Features      : swp half thumb fastmult edsp CPU implementer       : 0x56 CPU architecture: 5TE CPU variant   : 0x2 CPU part      : 0x131 CPU revision  : 1 Hardware      : Feroceon-KW Revision      : 0000 Serial        : 0000000000000000

meminfo
MemTotal:        117496 kB MemFree:            2728 kB Buffers:           27336 kB Cached:            63340 kB SwapCached:          272 kB Active:            19448 kB Inactive:          83304 kB Active(anon):       4832 kB Inactive(anon):     7516 kB Active(file):      14616 kB Inactive(file):    75788 kB Unevictable:           0 kB Mlocked:               0 kB SwapTotal:        999864 kB SwapFree:         999592 kB Dirty:                56 kB Writeback:             0 kB AnonPages:         11816 kB Mapped:             7996 kB Slab:               8440 kB SReclaimable:       2284 kB SUnreclaim:         6156 kB PageTables:          560 kB NFS_Unstable:          0 kB Bounce:                0 kB WritebackTmp:          0 kB CommitLimit:     1058612 kB Committed_AS:      81660 kB VmallocTotal:     516096 kB VmallocUsed:       17832 kB VmallocChunk:     491516 kB

dmesg
Normal zone: 32512 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 32512 Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,12M panic=5 BOOTVER=0.21 mtdparts=nand_mtd:0x1000000(boot),0xfe800000(rootfs),0x800000(reserve) PID hash table entries: 512 (order: 9, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 64MB 64MB = 128MB total Memory: 104916KB available (4972K code, 271K data, 152K init, 0K highmem) Hierarchical RCU implementation. NR_IRQS:128 Console: colour dummy device 80x30 Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok xor: measuring software checksum speed arm4regs :   544.400 MB/sec 8regs    :   413.200 MB/sec 32regs   :   462.400 MB/sec xor: using function: arm4regs (544.400 MB/sec) NET: Registered protocol family 16 Feroceon L2: Enabling L2 Feroceon L2: Cache support initialised.

CPU Interface - SDRAM_CS0 ....base 00000000, size 64MB SDRAM_CS1 ....base 04000000, size 64MB SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size  1MB PEX1_MEM ....no such PEX1_IO ....no such INTER_REGS ....base f1000000, size  1MB NFLASH_CS ....base fa000000, size  2MB SPI_CS ....base f4000000, size 16MB BOOT_ROM_CS ....no such DEV_BOOTCS ....no such CRYPT_ENG ....base f0000000, size  2MB

Marvell Development Board (LSP Version KW_LSP_5.1.3_patch13)-- MVWXL Soc: 88F6281 A1 LE

Detected Tclk 166666667 and SysClk 300000000 MV Buttons Device Load Marvell USB EHCI Host controller #0: c403e800 PEX0 interface detected no Link. PCI: bus0: Fast back to back transfers enabled mvPexLocalBusNumSet: ERR. Invalid PEX interface 1 bio: create slab  at 0 SCSI subsystem initialized raid6: int32x1    61 MB/s raid6: int32x2    70 MB/s raid6: int32x4    67 MB/s raid6: int32x8    59 MB/s raid6: using algorithm int32x2 (70 MB/s) NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 Trying to unpack rootfs image as initramfs... rootfs image is not initramfs (no cpio magic); looks like an initrd Freeing initrd memory: 12288K RTC has been updated!!! rtc mv_rtc: rtc core: registered kw-rtc as rtc0 RTC registered MICON ctrl (C) BUFFALO INC. V.1.00 installed. Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.1.00 installed. Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed. Kernel event proc (C) BUFFALO INC. V.1.00 installed. initial_polarity_val = 0x00000000 initial_polarity_val_high = 0x00038e50 Buffalo GPIO SATA Hotplug Event Driver (C) BUFFALO INC. Ver.1.00 installed. XOR registered 4 channels XOR 2nd invalidate WA enabled cesadev_init(c000fd64) MV Buttons Driver Load VFS: Disk quotas dquot_6.5.2 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) Installing knfsd (copyright (C) 1996 okir@monad.swb.de). JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.12) SGI XFS with ACLs, security attributes, large block numbers, no debug enabled SGI XFS Quota Management subsystem msgmni has been set to 229 alg: No test for cipher_null (cipher_null-generic) alg: No test for ecb(cipher_null) (ecb-cipher_null) alg: No test for digest_null (digest_null-generic) alg: No test for compress_null (compress_null-generic) alg: No test for stdrng (krng) alg: No test for hmac(digest_null) (hmac(digest_null-generic)) async_tx: api initialized (sync-only) Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler anticipatory registered (default) Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A console [ttyS0] enabled serial8250.1: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A brd: module loaded loop: module loaded Integrated Sata device found mvSataInitAdapter : regVal changed(0x00000010) IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter ** BUFFALO Disable Command Queuing Function [0 0] ** ** BUFFALO Disable Command Queuing Function [0 1] ** scsi 0:0:0:0: Direct-Access    Seagate  ST2000DL003-9VT1 CC32 PQ: 0 ANSI: 5 scsi 1:0:0:0: Direct-Access    Seagate  ST2000DL003-9VT1 CC32 PQ: 0 ANSI: 5 sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512. sd 0:0:0:0: [sda] 3907029168 512-byte logical blocks: (2.00 TB/1.81 TiB) sd 0:0:0:0: [sda] 0-byte physical blocks sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Mode Sense: 23 00 00 00 sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512. sd 1:0:0:0: [sdb] 3907029168 512-byte logical blocks: (2.00 TB/1.81 TiB) sd 1:0:0:0: [sdb] 0-byte physical blocks sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512. sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 1:0:0:0: Attached scsi generic sg1 type 0 Loading Marvell Ethernet Driver: o Cached descriptors in DRAM o DRAM SW cache-coherency o 2 Giga ports supported o Single RX Queue support - ETH_DEF_RXQ=0 o Single TX Queue support - ETH_DEF_TXQ=0 o Receive checksum offload supported o Transmit checksum offload supported o Network Fast Processing (Routing) supported - (Disabled) o Driver ERROR statistics enabled o Driver INFO statistics enabled o Proc tool API enabled o SKB Reuse supported - (Disabled) o SKB Recycle supported - (Disabled) o Gateway support enabled o Using Marvell Header Mode o L2 IGMP support o Rx descripors: q0=128 o Tx descripors: q0=532 o Loading network interface(s): o register under mv88fx_eth platform sda:    o eth0, ifindex = 2, GbE port = 0 sd 1:0:0:0: [sdb] Write Protect is off sd 1:0:0:0: [sdb] Mode Sense: 23 00 00 00 o eth1, ifindex = 3, GbE port = 1 mvFpRuleDb (c4d6f000): 1024 entries, 4096 bytes sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512. SPI Serial flash detected @ 0xf4000000, 512KB (8sec x 64KB) sdb: NAND device: Manufacturer ID: 0xc1, Chip ID: 0xc1 (Unknown NAND 128MiB 3,3V 16-bit) NAND bus width 8 instead 16 bit No NAND device found!!! mice: PS/2 mouse device common for all mice Linux telephony interface: v1.00 md: linear personality registered for level -1 md: raid0 personality registered for level 0 md: raid1 personality registered for level 1 md: raid6 personality registered for level 6 md: raid5 personality registered for level 5 md: raid4 personality registered for level 4 device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised: dm-devel@redhat.com sda1 sda2 sda3 sda4 sda5 sda6 sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512. TCP cubic registered NET: Registered protocol family 17 NET: Registered protocol family 15 RPC: Registered udp transport module. RPC: Registered tcp transport module. sd 0:0:0:0: [sda] Attached SCSI disk rtc mv_rtc: setting system clock to 2000-01-01 00:00:01 UTC (946684801) sdb1 sdb2 sdb3 sdb4 sdb5 sdb6 sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512. sd 1:0:0:0: [sdb] Attached SCSI disk md: Waiting for all devices to be available before autodetect md: If you don't use raid, use raid=noautodetect md: Autodetecting RAID arrays. md: Scanned 0 and added 0 devices. md: autorun ...             md: ... autorun DONE. RAMDISK: gzip image found at block 0 VFS: Mounted root (ext2 filesystem) on device 1:0. md: md0 stopped. md: bind md: bind raid1: raid set md0 active with 2 out of 2 mirrors md0: detected capacity change from 0 to 1023868928 md0: unknown partition table kjournald starting. Commit interval 5 seconds EXT3 FS on md0, internal journal EXT3-fs: mounted filesystem with writeback data mode. md: md10 stopped. md: bind md: bind raid1: raid set md10 active with 2 out of 2 mirrors md10: detected capacity change from 0 to 1023868928 md: md1 stopped. md: bind md: bind raid1: raid set md1 active with 2 out of 2 mirrors md1: detected capacity change from 0 to 5119934464 md1: unknown partition table kjournald starting. Commit interval 5 seconds EXT3 FS on md1, internal journal EXT3-fs: recovery complete. EXT3-fs: mounted filesystem with writeback data mode. kjournald starting. Commit interval 5 seconds EXT3 FS on md1, internal journal EXT3-fs: mounted filesystem with writeback data mode. VFS: Mounted root (ext3 filesystem) on device 9:1. Trying to move old root to /initrd ... okay Freeing init memory: 152K EXT3-fs: Unrecognized mount option "relatime" or missing value md10: unknown partition table Adding 999864k swap on /dev/md10. Priority:-1 extents:1 across:999864k kjournald starting. Commit interval 5 seconds EXT3 FS on md0, internal journal EXT3-fs: mounted filesystem with writeback data mode. usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci_marvell ehci_marvell.70059: Marvell Orion EHCI ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1 ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100 ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver uhci_hcd: USB Universal Host Controller Interface driver Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver usblp eth1: link down eth1: started eth1: link up, full duplex, speed 1 Gbps program smartctl is using a deprecated SCSI ioctl, please convert it to SG_IO md: md2 stopped. md: bind md: bind raid1: raid set md2 active with 2 out of 2 mirrors md2: detected capacity change from 0 to 1984830812160 md2: unknown partition table XFS mounting filesystem md2 Ending clean XFS mount for filesystem: md2 bfSetMagicKey > Changed to 0x71 from 0x5c program smartctl is using a deprecated SCSI ioctl, please convert it to SG_IO