Category:LS-WXL
Contents
LinkStation Duo (LS-WXL)
Variants
- 1.0TB LS-WX1.0TL/R1
- 2.0TB LS-WX2.0TL/R1
- 4.0TB LS-WX4.0TL/R1
Commercial description
LS-WXL : LinkStation™ Duo @ BUFFALO
The LinkStation™ Duo is a high performance, multimedia, shared RAID network storage solution for the home and small office that requires a central location to share data files, photos, video and music.
The unit is a two drive NAS solution that can be configured in RAID 0 for performance or RAID 1 for redundant storage. In addition to the storage capabilities, stream multimedia to a PC, a Mac, a Buffalo™ LinkTheater™ and other DLNA CERTIFIED™ or UPNP media player, as well as sharing movies, photos and documents in a home or small business network via the Internet with the WebAccess feature. The LinkStation™ Duo seamlessly integrates with iTunes® and allows access to music files from your iTunes® software.
With features such as enhanced performance of up to 40MB/s, quick swap via the front panel with two removable drives and easy set-up via a simple web interface, the LinkStation™ Duo is the perfect solution to store, save & share your digital life from one central place.
Gain Root Access
Source / Credit : [1]
Firmware 1.40
Method 1
Follow the instructions in Open Stock Firmware LS-VL, which works for all devices sharing that firmware.
Method 2
Firmware 1.40 has a different sshd_config with 'PermitRootLogin' set to 'no'. The permissions on this file are not open like the pam sshd file, so it is necessary to add a back door prior to upgrading to 1.40. One technique would be to perform the following
echo '* * * * * /bin/bash /tmp/cron.root.sh' >> /etc/cron/crontabs/root
After the firmware upgrade is complete, you can add commands to /tmp/cron.root.sh and they will be executed once a minute with root privileges. You can use this to replace the sshd_config. You may also wish to keep the cron job enabled in case of future issues, though it does pose a security risk.
Firmware prior to 1.40
Tested with firmware v1.33 and v1.34, but does not work with v1.40. It is possible to gain root access via the web server.
1. Create a shared folder name 'www'
2. Enable the web server in Network -> Web Server
3. Set the Port No. 81
4. Set the target folder to www
5. The default index.php is showing phpinfo();
6. Now with PHP enabled, you can edit /etc/pam.d/sshd via a simple script
7. comment out all lines that begin with 'auth'
8. add the line: auth required pam_permit.so
a simple PHP script like :
<?php $file = '../../../../etc/pam.d/sshd'; $fh=fopen($file, 'w') or die("can't open file"); $stringData = "account required pam_unix.so\n"; fwrite($fh, $stringData); $stringData = "session required pam_unix.so\n"; fwrite($fh, $stringData); $stringData = "auth required pam_permit.so\n"; fwrite($fh, $stringData); fclose($fh); ?>
9. Now, you should be able to SSH to LinkStation Duo without any password.
Note: the file /etc/pam.d/sshd gets re-created each time the system starts up
Best way to get permanent root access is to install your SSH public key in the 'authorized_keys' file.
- mkdir /root/.ssh
- chmod 700 /root/.ssh
... install your SSH public key in /root/.ssh/authorized_keys
- chmod 600 /root/.ssh/authorized_keys
N.B. The ssh-copy-id program, which is distributed with OpenSSH, can also be used to easily copy across your SSH public key onto the LinkStation.
Second method to gain root access
Download acp_commander (See http://buffalo.nas-central.org/index.php/Open_Stock_Firmware)
1. Use acp_commander and the sed command (built-in) to edit the /etc/pam.d/sshd file:
java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "sed 's/auth/#auth/' </etc/pam.d/sshd >/etc/pam.d/sshd.new"
2. Now add the required auth parameters:
java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "echo 'auth required pam_permit.so' >>/etc/pam.d/sshd.new"
3. Finally, replace the edited version to the right place:
java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "cp /etc/pam.d/sshd.new /etc/pam.d/sshd"
NOTE: acp_commander may complain about the password being incorrect but this should not affect the outcome. This second method was tested with firmware v1.34. You could potentially use interactive mode in acp_commander (the -s option) to save keystrokes, but the basic approach is the same.
At this point you should be able to get root access without the need of the password. To maintain root access, the public key recommendation remains as noted above. However, every time the box restarts and /etc/pam.d/sshd is replaced, you could rerun the third command above to regain root access without the password.
IPKG
Once you have root access, you can start to install packages from IPKG. To do so, first run the following
cd /tmp wget http://ipkg.nslu2-linux.org/feeds/optware/cs05q3armel/cross/stable/teraprov2-bootstrap_1.2-7_arm.xsh sh ./teraprov2-bootstrap_1.2-7_arm.xsh
Once that's done, edit /opt/etc/ipkg.conf and add
src cs08q1 http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/stable/ # src cs08q1-unstable http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/
(If you wish to use the unstable branch you can uncomment it.)
After that just run `ipkg update` and you can then install packages with `ipkg install package`
Firmware Information
Firmware v1.37 is available at [2] or direct link [3]
Generated with v1.24 of 5th February 2010 from 2TB LS-WX2.0TL/R1
uname -a
Linux LS-WXLE0F 2.6.22.18-88f6281 #50 Tue Dec 22 18:06:23 JST 2009 armv5tejl unknown
cpuinfo
Processor : ARM926EJ-S rev 1 (v5l) BogoMIPS : 599.65 Features : swp half thumb fastmult edsp CPU implementer : 0x56 CPU architecture: 5TE CPU variant : 0x2 CPU part : 0x131 CPU revision : 1 Cache type : write-back Cache clean : cp15 c7 ops Cache lockdown : format C Cache format : Harvard I size : 16384 I assoc : 4 I line length : 32 I sets : 128 D size : 16384 D assoc : 4 D line length : 32 D sets : 128 Hardware : Feroceon-KW Revision : 0000 Serial : 0000000000000000
meminfo
MemTotal: 125832 kB MemFree: 13080 kB Buffers: 136 kB Cached: 57636 kB SwapCached: 0 kB Active: 46468 kB Inactive: 39416 kB SwapTotal: 999864 kB SwapFree: 999864 kB Dirty: 4 kB Writeback: 0 kB AnonPages: 27544 kB Mapped: 13328 kB Slab: 20536 kB SReclaimable: 3100 kB SUnreclaim: 17436 kB PageTables: 1060 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 1062780 kB Committed_AS: 313276 kB VmallocTotal: 516096 kB VmallocUsed: 17476 kB VmallocChunk: 491516 kB
dmesg
Linux version 2.6.22.18-88f6281 (root@build2.dd-hot24.nas.buffalo.local) (gcc version 4.2.0 20070413 (prerelease)) #50 Tue Dec 22 18:06:23 JST 2009 CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977 Machine: Feroceon-KW Using UBoot passing parameters structure Memory policy: ECC disabled, Data cache writeback On node 0 totalpages: 32768 DMA zone: 256 pages used for memmap DMA zone: 0 pages reserved DMA zone: 32512 pages, LIFO batch:7 Normal zone: 0 pages used for memmap CPU0: D VIVT write-back cache CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets Built 1 zonelists. Total pages: 32512 Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,12M panic=5 BOOTVER=0.15 mtdparts=nand_mtd:0x1000000(boot),0xe800000(rootfs),0x800000(reserve) PID hash table entries: 512 (order: 9, 2048 bytes) Console: colour dummy device 80x30 Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 64MB 64MB 0MB 0MB = 128MB total Memory: 113280KB available (3772K code, 301K data, 124K init) Calibrating delay loop... 599.65 BogoMIPS (lpj=2998272) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 CPU Interface ------------- SDRAM_CS0 ....base 00000000, size 64MB SDRAM_CS1 ....base 04000000, size 64MB SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e8000000, size 128MB PEX0_IO ....base f2000000, size 1MB INTER_REGS ....base f1000000, size 1MB NFLASH_CS ....base fa000000, size 2MB SPI_CS ....base f4000000, size 16MB BOOT_ROM_CS ....no such DEV_BOOTCS ....no such CRYPT_ENG ....base f0000000, size 2MB Marvell Development Board (LSP Version KW_LSP_4.2.6)-- MVWXL Soc: 88F6281 A0 LE Detected Tclk 166666667 and SysClk 300000000 MV Buttons Device Load Marvell USB EHCI Host controller #0: c1432600 PEX0 interface detected no Link. PCI: bus0: Fast back to back transfers enabled SCSI subsystem initialized NET: Registered protocol family 2 Time: kw_clocksource clocksource has been installed. IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered checking if image is initramfs...it isn't (no cpio magic); looks like an initrd Freeing initrd memory: 12288K RTC registered MICON ctrl (C) BUFFALO INC. V.1.00 installed. Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.1.00 installed. Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed. Kernel event proc (C) BUFFALO INC. V.1.00 installed. Use the XOR engines (acceleration) for enhancing the following functions: o RAID 5 Xor calculation o kernel memcpy o kenrel memzero Number of XOR engines to use: 4 cesadev_init(c0011e38) MV Buttons Driver Load VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. SGI XFS with ACLs, large block numbers, no debug enabled SGI XFS Quota Management subsystem io scheduler noop registered io scheduler anticipatory registered (default) RAMDISK driver initialized: 2 RAM disks of 32768K size 1024 blocksize loop: module loaded Loading Marvell Ethernet Driver: o Cached descriptors in DRAM o DRAM SW cache-coherency o Single RX Queue support - ETH_DEF_RXQ=0 o Single TX Queue support - ETH_DEF_TXQ=0 o Receive checksum offload enabled o Transmit checksum offload enabled o Network Fast Processing (Routing) supported o Driver ERROR statistics enabled o Driver INFO statistics enabled o Proc tool API enabled o Rx descripors: q0=128 o Tx descripors: q0=532 o Loading network interface(s): o eth0, ifindex = 1, GbE port = 0 o eth1, ifindex = 2, GbE port = 1 mvFpRuleDb (c10ac000): 1024 entries, 4096 bytes Integrated Sata device found scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter scsi 0:0:0:0: Direct-Access WDC WD10EADS-00M2B0 01.0 PQ: 0 ANSI: 5 scsi 1:0:0:0: Direct-Access WDC WD10EADS-00M2B0 01.0 PQ: 0 ANSI: 5 sd 0:0:0:0: [sda] 1953525168 512-byte hardware sectors (1000205 MB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00 sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA sd 0:0:0:0: [sda] 1953525168 512-byte hardware sectors (1000205 MB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00 sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA sda: sda1 sda2 sda3 sda4 sda5 sda6 sd 0:0:0:0: [sda] Attached SCSI disk sd 1:0:0:0: [sdb] 1953525168 512-byte hardware sectors (1000205 MB) sd 1:0:0:0: [sdb] Write Protect is off sd 1:0:0:0: [sdb] Mode Sense: 23 00 10 00 sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, supports DPO and FUA sd 1:0:0:0: [sdb] 1953525168 512-byte hardware sectors (1000205 MB) sd 1:0:0:0: [sdb] Write Protect is off sd 1:0:0:0: [sdb] Mode Sense: 23 00 10 00 sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, supports DPO and FUA sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6 sd 1:0:0:0: [sdb] Attached SCSI disk sd 0:0:0:0: Attached scsi generic sg0 type 0 sd 1:0:0:0: Attached scsi generic sg1 type 0 NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $ SPI Serial flash detected @ 0xf4000000, 512KB (8sec x 64KB) NAND device: Manufacturer ID: 0x20, Chip ID: 0xda (ST Micro NAND 256MiB 3,3V 8-bit) Scanning device for bad blocks 3 cmdlinepart partitions found on MTD device nand_mtd Using command line partition definition Creating 3 MTD partitions on "nand_mtd": 0x00000000-0x01000000 : "boot" 0x01000000-0x0f800000 : "rootfs" 0x0f800000-0x10000000 : "reserve" mice: PS/2 mouse device common for all mice Linux telephony interface: v1.00 md: linear personality registered for level -1 md: raid0 personality registered for level 0 md: raid1 personality registered for level 1 raid6: int32x1 55 MB/s raid6: int32x2 65 MB/s raid6: int32x4 65 MB/s raid6: int32x8 57 MB/s raid6: using algorithm int32x2 (65 MB/s) md: raid6 personality registered for level 6 md: raid5 personality registered for level 5 md: raid4 personality registered for level 4 raid5: measuring checksumming speed arm4regs : 545.200 MB/sec 8regs : 379.200 MB/sec 32regs : 452.400 MB/sec raid5: using function: arm4regs (545.200 MB/sec) device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com dm_crypt using the OCF package. TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. RAMDISK: Compressed image found at block 0 VFS: Mounted root (ext2 filesystem). md: md10 stopped. md: md1 stopped. md: md0 stopped. md: bind<sdb1> md: bind<sda1> raid1: raid set md0 active with 2 out of 2 mirrors kjournald starting. Commit interval 5 seconds EXT3 FS on md0, internal journal EXT3-fs: mounted filesystem with ordered data mode. md: md10 stopped. md: bind<sdb5> md: bind<sda5> raid1: raid set md10 active with 2 out of 2 mirrors md: md1 stopped. md: bind<sdb2> md: bind<sda2> md: md1: raid array is not clean -- starting background reconstruction raid1: raid set md1 active with 2 out of 2 mirrors md: resync of RAID array md1 md: minimum _guaranteed_ speed: 1000 KB/sec/disk. md: using maximum available idle IO bandwidth (but not more than 50000 KB/sec) for resync. md: using 128k window, over a total of 4999936 blocks. Filesystem "md1": Disabling barriers, not supported by the underlying device XFS mounting filesystem md1 Starting XFS recovery on filesystem: md1 (logdev: internal) Ending XFS recovery on filesystem: md1 (logdev: internal) Filesystem "md1": Disabling barriers, not supported by the underlying device XFS mounting filesystem md1 Ending clean XFS mount for filesystem: md1 VFS: Mounted root (xfs filesystem). Trying to move old root to /initrd ... okay Freeing init memory: 124K Warning: unable to open an initial console. Filesystem "md1": Disabling barriers, not supported by the underlying device Adding 999864k swap on /dev/md10. Priority:-1 extents:1 across:999864k kjournald starting. Commit interval 5 seconds EXT3 FS on md0, internal journal EXT3-fs: mounted filesystem with ordered data mode. usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb ehci_marvell ehci_marvell.70059: Marvell Orion EHCI ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1 ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100 ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver USB Universal Host Controller Interface driver v3.0 Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver eth1: change mtu 1500 (buffer-size 1536) to 9676 (buffer-size 9728) eth1: link down eth1: started eth1: link up, full duplex, speed 1 Gbps md: md2 stopped. md: bind<sdb6> md: bind<sda6> md: md2: raid array is not clean -- starting background reconstruction raid1: raid set md2 active with 2 out of 2 mirrors md: delaying resync of md2 until md1 has finished (they share one or more physical units) Filesystem "md2": Disabling barriers, not supported by the underlying device XFS mounting filesystem md2 Starting XFS recovery on filesystem: md2 (logdev: internal) Ending XFS recovery on filesystem: md2 (logdev: internal) bfSetMagicKey > Changed to 0x71 from 0x5c md: md1: resync done. md: resync of RAID array md2 md: minimum _guaranteed_ speed: 1000 KB/sec/disk. md: using maximum available idle IO bandwidth (but not more than 50000 KB/sec) for resync. md: using 128k window, over a total of 961749888 blocks. RAID1 conf printout: --- wd:2 rd:2 disk 0, wo:0, o:1, dev:sda2 disk 1, wo:0, o:1, dev:sdb2
References
![]() |
This article is currently a stub. You can help this Wiki by expanding it . This template will categorize articles that include it into Category:Stubs. |
Pages in category "LS-WXL"
The following 10 pages are in this category, out of 10 total.
AD |
D cont.ILO |
O cont.P |