From NAS-Central Buffalo - The Linkstation Wiki

Contents 1 LinkStation Duo (LS-WXL) 1.1 Variants 1.2 Commercial description 1.3 Gain Root Access 1.3.1 Firmware 1.40 1.3.1.1 Method 1 1.3.1.2 Method 2 1.3.2 Firmware prior to 1.40 1.4 Second method to gain root access 1.5 IPKG 1.6 Firmware Information 1.6.1 uname -a 1.6.2 cpuinfo 1.6.3 meminfo 1.6.4 dmesg 1.7 References

LinkStation Duo (LS-WXL)

Variants

• 1.0TB LS-WX1.0TL/R1
• 2.0TB LS-WX2.0TL/R1
• 4.0TB LS-WX4.0TL/R1

Commercial description

LS-WXL : LinkStation™ Duo @ BUFFALO

The LinkStation™ Duo is a high performance, multimedia, shared RAID network storage solution for the home and small office that requires a central location to share data files, photos, video and music.

The unit is a two drive NAS solution that can be configured in RAID 0 for performance or RAID 1 for redundant storage. In addition to the storage capabilities, stream multimedia to a PC, a Mac, a Buffalo™ LinkTheater™ and other DLNA CERTIFIED™ or UPNP media player, as well as sharing movies, photos and documents in a home or small business network via the Internet with the WebAccess feature. The LinkStation™ Duo seamlessly integrates with iTunes® and allows access to music files from your iTunes® software.

With features such as enhanced performance of up to 40MB/s, quick swap via the front panel with two removable drives and easy set-up via a simple web interface, the LinkStation™ Duo is the perfect solution to store, save & share your digital life from one central place.

Gain Root Access

Source / Credit : [1]

Firmware 1.40

Method 1

Follow the instructions in Open Stock Firmware LS-VL, which works for all devices sharing that firmware.

Method 2

Firmware 1.40 has a different sshd_config with 'PermitRootLogin' set to 'no'. The permissions on this file are not open like the pam sshd file, so it is necessary to add a back door prior to upgrading to 1.40. One technique would be to perform the following

echo '* * * * * /bin/bash /tmp/cron.root.sh' >> /etc/cron/crontabs/root

After the firmware upgrade is complete, you can add commands to /tmp/cron.root.sh and they will be executed once a minute with root privileges. You can use this to replace the sshd_config. You may also wish to keep the cron job enabled in case of future issues, though it does pose a security risk.

Firmware prior to 1.40

Tested with firmware v1.33 and v1.34, but does not work with v1.40. It is possible to gain root access via the web server.

1. Create a shared folder name 'www'

2. Enable the web server in Network -> Web Server

3. Set the Port No. 81

4. Set the target folder to www

5. The default index.php is showing phpinfo();

6. Now with PHP enabled, you can edit /etc/pam.d/sshd via a simple script

7. comment out all lines that begin with 'auth'

8. add the line: auth required pam_permit.so

a simple PHP script like :

<?php
$file = '../../../../etc/pam.d/sshd';
$fh=fopen($file, 'w') or die("can't open file");
$stringData = "account  required   pam_unix.so\n";
fwrite($fh, $stringData);
$stringData = "session  required   pam_unix.so\n";
fwrite($fh, $stringData);
$stringData = "auth required pam_permit.so\n";
fwrite($fh, $stringData);
fclose($fh);
?>

9. Now, you should be able to SSH to LinkStation Duo without any password.

Note: the file /etc/pam.d/sshd gets re-created each time the system starts up

Best way to get permanent root access is to install your SSH public key in the 'authorized_keys' file.

1. mkdir /root/.ssh
2. chmod 700 /root/.ssh

... install your SSH public key in /root/.ssh/authorized_keys

1. chmod 600 /root/.ssh/authorized_keys

N.B. The ssh-copy-id program, which is distributed with OpenSSH, can also be used to easily copy across your SSH public key onto the LinkStation.

Second method to gain root access

Download acp_commander (See http://buffalo.nas-central.org/index.php/Open_Stock_Firmware)

1. Use acp_commander and the sed command (built-in) to edit the /etc/pam.d/sshd file:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "sed 's/auth/#auth/' </etc/pam.d/sshd >/etc/pam.d/sshd.new"

2. Now add the required auth parameters:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "echo 'auth required pam_permit.so' >>/etc/pam.d/sshd.new"

3. Finally, replace the edited version to the right place:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "cp /etc/pam.d/sshd.new /etc/pam.d/sshd"

NOTE: acp_commander may complain about the password being incorrect but this should not affect the outcome. This second method was tested with firmware v1.34. You could potentially use interactive mode in acp_commander (the -s option) to save keystrokes, but the basic approach is the same.

At this point you should be able to get root access without the need of the password. To maintain root access, the public key recommendation remains as noted above. However, every time the box restarts and /etc/pam.d/sshd is replaced, you could rerun the third command above to regain root access without the password.

IPKG

Once you have root access, you can start to install packages from IPKG. To do so, first run the following

cd /tmp
wget http://ipkg.nslu2-linux.org/feeds/optware/cs05q3armel/cross/stable/teraprov2-bootstrap_1.2-7_arm.xsh
sh ./teraprov2-bootstrap_1.2-7_arm.xsh

Once that's done, edit /opt/etc/ipkg.conf and add

src cs08q1 http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/stable/
# src cs08q1-unstable http://ipkg.nslu2-linux.org/feeds/optware/cs08q1armel/cross/unstable/

(If you wish to use the unstable branch you can uncomment it.)

After that just run `ipkg update` and you can then install packages with `ipkg install package`

Firmware Information

Firmware v1.37 is available at [2] or direct link [3]

Generated with v1.24 of 5th February 2010 from 2TB LS-WX2.0TL/R1

uname -a

Linux LS-WXLE0F 2.6.22.18-88f6281 #50 Tue Dec 22 18:06:23 JST 2009 armv5tejl unknown

cpuinfo

Processor	: ARM926EJ-S rev 1 (v5l)
BogoMIPS	: 599.65
Features	: swp half thumb fastmult edsp 
CPU implementer	: 0x56
CPU architecture: 5TE
CPU variant	: 0x2
CPU part	: 0x131
CPU revision	: 1
Cache type	: write-back
Cache clean	: cp15 c7 ops
Cache lockdown	: format C
Cache format	: Harvard
I size		: 16384
I assoc		: 4
I line length	: 32
I sets		: 128
D size		: 16384
D assoc		: 4
D line length	: 32
D sets		: 128

Hardware	: Feroceon-KW
Revision	: 0000
Serial		: 0000000000000000

meminfo

MemTotal:       125832 kB
MemFree:         13080 kB
Buffers:           136 kB
Cached:          57636 kB
SwapCached:          0 kB
Active:          46468 kB
Inactive:        39416 kB
SwapTotal:      999864 kB
SwapFree:       999864 kB
Dirty:               4 kB
Writeback:           0 kB
AnonPages:       27544 kB
Mapped:          13328 kB
Slab:            20536 kB
SReclaimable:     3100 kB
SUnreclaim:      17436 kB
PageTables:       1060 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:   1062780 kB
Committed_AS:   313276 kB
VmallocTotal:   516096 kB
VmallocUsed:     17476 kB
VmallocChunk:   491516 kB

dmesg

Linux version 2.6.22.18-88f6281 (root@build2.dd-hot24.nas.buffalo.local) (gcc version 4.2.0 20070413 (prerelease)) #50 Tue Dec 22 18:06:23 JST 2009
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 32768
  DMA zone: 256 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 32512 pages, LIFO batch:7
  Normal zone: 0 pages used for memmap
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 32512
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,12M panic=5 BOOTVER=0.15 mtdparts=nand_mtd:0x1000000(boot),0xe800000(rootfs),0x800000(reserve)
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB 64MB 0MB 0MB = 128MB total
Memory: 113280KB available (3772K code, 301K data, 124K init)
Calibrating delay loop... 599.65 BogoMIPS (lpj=2998272)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16 

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size  64MB 
SDRAM_CS1 ....base 04000000, size  64MB 
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB 

  Marvell Development Board (LSP Version KW_LSP_4.2.6)-- MVWXL  Soc: 88F6281 A0 LE

 Detected Tclk 166666667 and SysClk 300000000 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c1432600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 12288K
RTC registered
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.1.00 installed.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
Use the XOR engines (acceleration) for enhancing the following functions:
  o RAID 5 Xor calculation
  o kernel memcpy
  o kenrel memzero
Number of XOR engines to use: 4
cesadev_init(c0011e38)
MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
SGI XFS with ACLs, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
io scheduler noop registered
io scheduler anticipatory registered (default)
RAMDISK driver initialized: 2 RAM disks of 32768K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
    o eth0, ifindex = 1, GbE port = 0
    o eth1, ifindex = 2, GbE port = 1

mvFpRuleDb (c10ac000): 1024 entries, 4096 bytes
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi 0:0:0:0: Direct-Access     WDC      WD10EADS-00M2B0  01.0 PQ: 0 ANSI: 5
scsi 1:0:0:0: Direct-Access     WDC      WD10EADS-00M2B0  01.0 PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] 1953525168 512-byte hardware sectors (1000205 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
sd 0:0:0:0: [sda] 1953525168 512-byte hardware sectors (1000205 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
 sda: sda1 sda2 sda3 sda4 sda5 sda6
sd 0:0:0:0: [sda] Attached SCSI disk
sd 1:0:0:0: [sdb] 1953525168 512-byte hardware sectors (1000205 MB)
sd 1:0:0:0: [sdb] Write Protect is off
sd 1:0:0:0: [sdb] Mode Sense: 23 00 10 00
sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, supports DPO and FUA
sd 1:0:0:0: [sdb] 1953525168 512-byte hardware sectors (1000205 MB)
sd 1:0:0:0: [sdb] Write Protect is off
sd 1:0:0:0: [sdb] Mode Sense: 23 00 10 00
sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, supports DPO and FUA
 sdb: sdb1 sdb2 sdb3 sdb4 sdb5 sdb6
sd 1:0:0:0: [sdb] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: Attached scsi generic sg1 type 0
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
SPI Serial flash detected @ 0xf4000000, 512KB (8sec x 64KB)
NAND device: Manufacturer ID: 0x20, Chip ID: 0xda (ST Micro NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
3 cmdlinepart partitions found on MTD device nand_mtd
Using command line partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x01000000 : "boot"
0x01000000-0x0f800000 : "rootfs"
0x0f800000-0x10000000 : "reserve"
mice: PS/2 mouse device common for all mice
Linux telephony interface: v1.00
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     55 MB/s
raid6: int32x2     65 MB/s
raid6: int32x4     65 MB/s
raid6: int32x8     57 MB/s
raid6: using algorithm int32x2 (65 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :   545.200 MB/sec
   8regs     :   379.200 MB/sec
   32regs    :   452.400 MB/sec
raid5: using function: arm4regs (545.200 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
md: md10 stopped.
md: md1 stopped.
md: md0 stopped.
md: bind<sdb1>
md: bind<sda1>
raid1: raid set md0 active with 2 out of 2 mirrors
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md0, internal journal
EXT3-fs: mounted filesystem with ordered data mode.
md: md10 stopped.
md: bind<sdb5>
md: bind<sda5>
raid1: raid set md10 active with 2 out of 2 mirrors
md: md1 stopped.
md: bind<sdb2>
md: bind<sda2>
md: md1: raid array is not clean -- starting background reconstruction
raid1: raid set md1 active with 2 out of 2 mirrors
md: resync of RAID array md1
md: minimum _guaranteed_  speed: 1000 KB/sec/disk.
md: using maximum available idle IO bandwidth (but not more than 50000 KB/sec) for resync.
md: using 128k window, over a total of 4999936 blocks.
Filesystem "md1": Disabling barriers, not supported by the underlying device
XFS mounting filesystem md1
Starting XFS recovery on filesystem: md1 (logdev: internal)
Ending XFS recovery on filesystem: md1 (logdev: internal)
Filesystem "md1": Disabling barriers, not supported by the underlying device
XFS mounting filesystem md1
Ending clean XFS mount for filesystem: md1
VFS: Mounted root (xfs filesystem).
Trying to move old root to /initrd ... okay
Freeing init memory: 124K
Warning: unable to open an initial console.
Filesystem "md1": Disabling barriers, not supported by the underlying device
Adding 999864k swap on /dev/md10.  Priority:-1 extents:1 across:999864k
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md0, internal journal
EXT3-fs: mounted filesystem with ordered data mode.
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
USB Universal Host Controller Interface driver v3.0
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
eth1: change mtu 1500 (buffer-size 1536) to 9676 (buffer-size 9728)
eth1: link down
eth1: started
eth1: link up, full duplex, speed 1 Gbps
md: md2 stopped.
md: bind<sdb6>
md: bind<sda6>
md: md2: raid array is not clean -- starting background reconstruction
raid1: raid set md2 active with 2 out of 2 mirrors
md: delaying resync of md2 until md1 has finished (they share one or more physical units)
Filesystem "md2": Disabling barriers, not supported by the underlying device
XFS mounting filesystem md2
Starting XFS recovery on filesystem: md2 (logdev: internal)
Ending XFS recovery on filesystem: md2 (logdev: internal)
bfSetMagicKey > Changed to 0x71 from 0x5c
md: md1: resync done.
md: resync of RAID array md2
md: minimum _guaranteed_  speed: 1000 KB/sec/disk.
md: using maximum available idle IO bandwidth (but not more than 50000 KB/sec) for resync.
md: using 128k window, over a total of 961749888 blocks.
RAID1 conf printout:
 --- wd:2 rd:2
 disk 0, wo:0, o:1, dev:sda2
 disk 1, wo:0, o:1, dev:sdb2

References

• buffalo-technology.com: LinkStation™ Duo LS-WXL

This article is currently a stub. You can help this Wiki by expanding it . This template will categorize articles that include it into Category:Stubs.