From NAS-Central Buffalo - The Linkstation Wiki
Revision as of 14:27, 18 October 2015 by Jskywalker (Talk | contribs) (Firmware 1.68 & Firmware 1.65 & Firmware 1.62 & Firmware 1.57 & Firmware 1.54)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search
LinkStation™ Duo LS-WXL

LinkStation Duo (LS-WXL)


  • 1.0TB LS-WX1.0TL/R1
  • 2.0TB LS-WX2.0TL/R1
  • 4.0TB LS-WX4.0TL/R1

Commercial description

LS-WXL : LinkStation™ Duo @ BUFFALO

The LinkStation™ Duo is a high performance, multimedia, shared RAID network storage solution for the home and small office that requires a central location to share data files, photos, video and music.

The unit is a two drive NAS solution that can be configured in RAID 0 for performance or RAID 1 for redundant storage. In addition to the storage capabilities, stream multimedia to a PC, a Mac, a Buffalo™ LinkTheater™ and other DLNA CERTIFIED™ or UPNP media player, as well as sharing movies, photos and documents in a home or small business network via the Internet with the WebAccess feature. The LinkStation™ Duo seamlessly integrates with iTunes® and allows access to music files from your iTunes® software.

With features such as enhanced performance of up to 40MB/s, quick swap via the front panel with two removable drives and easy set-up via a simple web interface, the LinkStation™ Duo is the perfect solution to store, save & share your digital life from one central place.

Gain SSH Access

Source / Credit : [1]

See notes below for Firmware 1.41.

The following passwords are for extracting the firmware, not accessing the live box!

Firmware 1.71 &Firmware 1.68 & Firmware 1.65 & Firmware 1.62 & Firmware 1.57 & Firmware 1.54

Use the following password:


Warning: Firmware 1.68 looks currently unstable.

Firmware 1.64 & Firmware 1.63 & Firmware 1.60 & Firmware 1.41

Use the following password:


Firmware 1.58 & Firmware 1.52 & Firmware 1.42

Use the following password:


Firmware 1.56

Use the following password:


Firmware 1.41 and later

In this version, it appears that acp_commander no longer provides the capability to execute commands, which prevents most earlier strategies from working. However, it is quite straightforward to solve this problem by using a custom firmware image. The basic principle is described in Create a custom firmware image.

Start with the files downloaded from Buffalo's website. Then, ideally on a Linux platform of some sort...

1) unzip the hddrootfs.img

 unzip hddrootfs.img

provide the right password for the firmware.

For version 1.41, the third zip password listed in the above mentioned reference proved successful:


The result of this is a hddrootfs.buffalo.updated...this is the tared root-filesystem of the firmware image.

2) create a folder where you want to untar the rootfs and untar it

 mkdir <foldername>
 cd <foldername>
 tar -vxz --numeric-owner -p -f ../hddrootfs.buffalo.updated

3) modify the image to enable sshd logins. This copies an authorized_keys file from your home directory on the Linux box, but any mechanism to make an authorized_keys file will work

 cd etc
 sed -i 's/PermitRootLogin/# PermitRootLogin/' sshd_config
 cd ../root
 mkdir .ssh
 chmod 700 .ssh

3-a) copying authorized_keys (option 1)

 cp $HOME/.ssh/authorized_keys .ssh/authorized_keys
 chmod 600 .ssh/authorized_keys

3-b) generating authorized_keys (if you don't have an authorized_keys file)

 ssh-keygen -t rsa
 save as .ssh/key
 mv authorized_keys

3-1) if firmware version is higher than 1.64, you should edit /etc/ftpusers, or the sshd cannot be executed.

 cd ../etc
 sed -i 's/root/#root/g' ./ftpusers

4) create the hddrootfs.buffalo.updated again (you should be in the folder where you extracted the image)

 tar -vczf ../hddrootfs.buffalo.updated-new *
 cd ..
 mv hddrootfs.buffalo.updated hddrootfs.buffalo.updated-old
 mv hddrootfs.buffalo.updated-new hddrootfs.buffalo.updated

5) create the hddrootfs.img again

CAUTION: if you use the wrong password, the firmware updater / the linkstation will fail to unzip the hddrootfs.img

 zip -e hddrootfs.img hddrootfs.buffalo.updated

6) Perform the update using the normal Buffalo updater (probably after enabling the debug option to reload the image)

7) See the notes about editing the /etc/nas_feature file below and elsewhere on this WIKI.

This is a file that is generated during boot time. The entry SUPPORT_SFTP=0 needs to be changed to SUPPORT_SFTP=1 in order for sshd to start via /etc/init.d/ The following acp_commander command may work post reboot:

 java -jar acp_commander.jar -t <your_NAS_IP> -ip <your_NAS_IP> -pw <your_NAS_admin_password> -c "sed -i 's/SUPPORT_SFTP=0/SUPPORT_SFTP=1/' /etc/nas_feature

8) Use ssh to root@ip_address

Firmware 1.40

Method 1

Follow the instructions in Open Stock Firmware LS-VL, which works for all devices sharing that firmware.

Method 2

Firmware 1.40 has a different sshd_config with 'PermitRootLogin' set to 'no'. The permissions on this file are not open like the pam sshd file, so it is necessary to add a back door prior to upgrading to 1.40. One technique would be to perform the following

echo '* * * * * /bin/bash /tmp/' >> /etc/cron/crontabs/root

After the firmware upgrade is complete, you can add commands to /tmp/ and they will be executed once a minute with root privileges. You can use this to replace the sshd_config. You may also wish to keep the cron job enabled in case of future issues, though it does pose a security risk.

Firmware prior to 1.40

Tested with firmware v1.33 and v1.34, but does not work with v1.40. It is possible to gain root access via the web server.

1. Create a shared folder name 'www'

2. Enable the web server in Network -> Web Server

3. Set the Port No. 81

4. Set the target folder to www

5. The default index.php is showing phpinfo();

6. Now with PHP enabled, you can edit /etc/pam.d/sshd via a simple script

7. comment out all lines that begin with 'auth'

8. add the line: auth required

a simple PHP script like :

$file = '../../../../etc/pam.d/sshd';
$fh=fopen($file, 'w') or die("can't open file");
$stringData = "account  required\n";
fwrite($fh, $stringData);
$stringData = "session  required\n";
fwrite($fh, $stringData);
$stringData = "auth required\n";
fwrite($fh, $stringData);

9. Now, you should be able to SSH to LinkStation Duo without any password.

Note: the file /etc/pam.d/sshd gets re-created each time the system starts up

Best way to get permanent root access is to install your SSH public key in the 'authorized_keys' file.

  1. mkdir /root/.ssh
  2. chmod 700 /root/.ssh

... install your SSH public key in /root/.ssh/authorized_keys

  1. chmod 600 /root/.ssh/authorized_keys

N.B. The ssh-copy-id program, which is distributed with OpenSSH, can also be used to easily copy across your SSH public key onto the LinkStation.

Second method to gain root access

Download acp_commander (See

1. Use acp_commander and the sed command (built-in) to edit the /etc/pam.d/sshd file:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "sed 's/auth/#auth/' </etc/pam.d/sshd >/etc/pam.d/"

2. Now add the required auth parameters:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "echo 'auth required' >>/etc/pam.d/"

3. Finally, replace the edited version to the right place:

 java -jar acp_commander.jar -t <IP_OF_WXL> -ip <IP_OF_WXL> -pw password -c "cp /etc/pam.d/ /etc/pam.d/sshd"

NOTE: acp_commander may complain about the password being incorrect but this should not affect the outcome. This second method was tested with firmware v1.34. You could potentially use interactive mode in acp_commander (the -s option) to save keystrokes, but the basic approach is the same.

At this point you should be able to get root access without the need of the password. To maintain root access, the public key recommendation remains as noted above. However, every time the box restarts and /etc/pam.d/sshd is replaced, you could rerun the third command above to regain root access without the password.


Once you have root access, you can start to install packages from IPKG. To do so, first run the following

cd /tmp
sh ./teraprov2-bootstrap_1.2-7_arm.xsh

Once that's done, edit by typing vi /opt/etc/ipkg.conf and add

src cs08q1
# src cs08q1-unstable

Save by typing [esc]:wq[enter]

Open /etc/init.d/rc.optware by typing vi /etc/init.d/rc.optware

find REAL_OPT_DIR=blahblah and change into as your setting as




Save by typing [esc]:wq[enter]

Check [2] for guide on using VI text editor. (Simply you move cursor by cursor key and type 'a' or 'i' then you can add some text')

(If you wish to use the unstable branch you can uncomment it.)

After that just run `ipkg update` and you can then install packages with `ipkg install package`


To enable NFS on these boxes (specifically firmware versions 1.41 and 1.42), follow the above instructions to install IPKG. See also the section on TeraStation "Conversion".

Then run:

ipkg install e2fslibs
ipkg install portmap

Next, obtain the estimable Kenatonline's NFS Tools:

cd /mnt/array1
cd /
tar xvzf /mnt/array1/nfstools.tar.gz

Finally, create an /etc/exports file according to taste, and start everything:

cd /opt/etc/init.d
S55portmap start
S99nfs start

You're done.

TeraStation "Conversion"

According to our board rules, any kind of description, which violates copyrights or licenses, is not allowed.
The "conversion" to a TeraStation would potentially violate licensing agreements Buffalo made with third party companies. Therefore this content was removed.
The firmware consists of more than just GPL'd software.

Firmware Information

Firmware v1.37 is available at [3] or direct link [4]

Generated with v1.58 of 17th April 2012 from 4TB LS-WX4.0TL/R1

uname -a

Linux LS-WXLE0F #1 Fri Apr 6 14:14:26 JST 2012 armv5tel unknown


Processor      : Feroceon 88FR131 rev 1 (v5l)
BogoMIPS       : 598.01
Features       : swp half thumb fastmult edsp
CPU implementer        : 0x56
CPU architecture: 5TE
CPU variant    : 0x2
CPU part       : 0x131
CPU revision   : 1

Hardware       : Feroceon-KW
Revision       : 0000
Serial         : 0000000000000000


MemTotal:         117496 kB
MemFree:            2728 kB
Buffers:           27336 kB
Cached:            63340 kB
SwapCached:          272 kB
Active:            19448 kB
Inactive:          83304 kB
Active(anon):       4832 kB
Inactive(anon):     7516 kB
Active(file):      14616 kB
Inactive(file):    75788 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:        999864 kB
SwapFree:         999592 kB
Dirty:                56 kB
Writeback:             0 kB
AnonPages:         11816 kB
Mapped:             7996 kB
Slab:               8440 kB
SReclaimable:       2284 kB
SUnreclaim:         6156 kB
PageTables:          560 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:     1058612 kB
Committed_AS:      81660 kB
VmallocTotal:     516096 kB
VmallocUsed:       17832 kB
VmallocChunk:     491516 kB


 Normal zone: 32512 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 32512
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,12M panic=5 BOOTVER=0.21 mtdparts=nand_mtd:0x1000000(boot),0xfe800000(rootfs),0x800000(reserve)
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB 64MB = 128MB total
Memory: 104916KB available (4972K code, 271K data, 152K init, 0K highmem)
Hierarchical RCU implementation.
Console: colour dummy device 80x30
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
xor: measuring software checksum speed
   arm4regs  :   544.400 MB/sec
   8regs     :   413.200 MB/sec
   32regs    :   462.400 MB/sec
xor: using function: arm4regs (544.400 MB/sec)
NET: Registered protocol family 16
Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.
CPU Interface
SDRAM_CS0 ....base 00000000, size  64MB 
SDRAM_CS1 ....base 04000000, size  64MB 
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
PEX1_MEM such
PEX1_IO such
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
CRYPT_ENG ....base f0000000, size   2MB 
  Marvell Development Board (LSP Version KW_LSP_5.1.3_patch13)-- MVWXL  Soc: 88F6281 A1 LE
 Detected Tclk 166666667 and SysClk 300000000 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c403e800
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
mvPexLocalBusNumSet: ERR. Invalid PEX interface 1
bio: create slab <bio-0> at 0
SCSI subsystem initialized
raid6: int32x1     61 MB/s
raid6: int32x2     70 MB/s
raid6: int32x4     67 MB/s
raid6: int32x8     59 MB/s
raid6: using algorithm int32x2 (70 MB/s)
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (no cpio magic); looks like an initrd
Freeing initrd memory: 12288K
RTC has been updated!!!
rtc mv_rtc: rtc core: registered kw-rtc as rtc0
RTC registered
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.1.00 installed.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
initial_polarity_val = 0x00000000
initial_polarity_val_high = 0x00038e50
Buffalo GPIO SATA Hotplug Event Driver (C) BUFFALO INC. Ver.1.00 installed.
XOR registered 4 channels   
XOR 2nd invalidate WA enabled
MV Buttons Driver Load      
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
Installing knfsd (copyright (C) 1996
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.12)
SGI XFS with ACLs, security attributes, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
msgmni has been set to 229  
alg: No test for cipher_null (cipher_null-generic)
alg: No test for ecb(cipher_null) (ecb-cipher_null)
alg: No test for digest_null (digest_null-generic)
alg: No test for compress_null (compress_null-generic)
alg: No test for stdrng (krng)
alg: No test for hmac(digest_null) (hmac(digest_null-generic))
async_tx: api initialized (sync-only)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
console [ttyS0] enabled     
serial8250.1: ttyS1 at MMIO 0xf1012100 (irq = 34) is a 16550A
brd: module loaded          
loop: module loaded         
Integrated Sata device found
mvSataInitAdapter : regVal changed(0x00000010)
IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
** BUFFALO Disable Command Queuing Function [0 0] **
** BUFFALO Disable Command Queuing Function [0 1] **
scsi 0:0:0:0: Direct-Access     Seagate  ST2000DL003-9VT1 CC32 PQ: 0 ANSI: 5
scsi 1:0:0:0: Direct-Access     Seagate  ST2000DL003-9VT1 CC32 PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
sd 0:0:0:0: [sda] 3907029168 512-byte logical blocks: (2.00 TB/1.81 TiB)
sd 0:0:0:0: [sda] 0-byte physical blocks
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 23 00 00 00
sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512.
sd 1:0:0:0: [sdb] 3907029168 512-byte logical blocks: (2.00 TB/1.81 TiB)
sd 1:0:0:0: [sdb] 0-byte physical blocks
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: Attached scsi generic sg1 type 0
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency 
  o 2 Giga ports supported  
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o Receive checksum offload supported
  o Transmit checksum offload supported
  o Network Fast Processing (Routing) supported - (Disabled)
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled   
  o SKB Reuse supported - (Disabled)
  o SKB Recycle supported - (Disabled)
  o Gateway support enabled 
     o Using Marvell Header Mode
     o L2 IGMP support
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
     o register under mv88fx_eth platform
 sda:     o eth0, ifindex = 2, GbE port = 0
sd 1:0:0:0: [sdb] Write Protect is off
sd 1:0:0:0: [sdb] Mode Sense: 23 00 00 00
     o eth1, ifindex = 3, GbE port = 1
mvFpRuleDb (c4d6f000): 1024 entries, 4096 bytes
sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512.
SPI Serial flash detected @ 0xf4000000, 512KB (8sec x 64KB)
NAND device: Manufacturer ID: 0xc1, Chip ID: 0xc1 (Unknown NAND 128MiB 3,3V 16-bit)
NAND bus width 8 instead 16 bit
No NAND device found!!!     
mice: PS/2 mouse device common for all mice
Linux telephony interface: v1.00
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised:
 sda1 sda2 sda3 sda4 sda5 sda6
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
TCP cubic registered        
NET: Registered protocol family 17
NET: Registered protocol family 15
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
sd 0:0:0:0: [sda] Attached SCSI disk
rtc mv_rtc: setting system clock to 2000-01-01 00:00:01 UTC (946684801)
 sdb1 sdb2 sdb3 sdb4 sdb5 sdb6
sd 1:0:0:0: [sdb] Sector size 0 reported, assuming 512.
sd 1:0:0:0: [sdb] Attached SCSI disk
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...             
md: ... autorun DONE.       
RAMDISK: gzip image found at block 0
VFS: Mounted root (ext2 filesystem) on device 1:0.
md: md0 stopped.            
md: bind<sdb1>              
md: bind<sda1>              
raid1: raid set md0 active with 2 out of 2 mirrors
md0: detected capacity change from 0 to 1023868928
 md0: unknown partition table
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md0, internal journal
EXT3-fs: mounted filesystem with writeback data mode.
md: md10 stopped.           
md: bind<sdb5>              
md: bind<sda5>              
raid1: raid set md10 active with 2 out of 2 mirrors
md10: detected capacity change from 0 to 1023868928
md: md1 stopped.            
md: bind<sdb2>              
md: bind<sda2>              
raid1: raid set md1 active with 2 out of 2 mirrors
md1: detected capacity change from 0 to 5119934464
 md1: unknown partition table
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md1, internal journal
EXT3-fs: recovery complete. 
EXT3-fs: mounted filesystem with writeback data mode.
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md1, internal journal
EXT3-fs: mounted filesystem with writeback data mode.
VFS: Mounted root (ext3 filesystem) on device 9:1.
Trying to move old root to /initrd ... okay
Freeing init memory: 152K   
EXT3-fs: Unrecognized mount option "relatime" or missing value
 md10: unknown partition table
Adding 999864k swap on /dev/md10.  Priority:-1 extents:1 across:999864k 
kjournald starting.  Commit interval 5 seconds
EXT3 FS on md0, internal journal
EXT3-fs: mounted filesystem with writeback data mode.
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found  
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
uhci_hcd: USB Universal Host Controller Interface driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usblp
eth1: link down             
eth1: started               
eth1: link up, full duplex, speed 1 Gbps
program smartctl is using a deprecated SCSI ioctl, please convert it to SG_IO
md: md2 stopped.            
md: bind<sdb6>              
md: bind<sda6>              
raid1: raid set md2 active with 2 out of 2 mirrors
md2: detected capacity change from 0 to 1984830812160
 md2: unknown partition table
XFS mounting filesystem md2 
Ending clean XFS mount for filesystem: md2
bfSetMagicKey > Changed to 0x71 from 0x5c
program smartctl is using a deprecated SCSI ioctl, please convert it to SG_IO


Link.png This article is currently a stub. You can help this Wiki by expanding it

. This template will categorize articles that include it into Category:Stubs.