Infrant ReadyNAS shell access

Posted by brian Thursday, November 23, 2006 00:12:00 GMT

The Infrant ReadyNAS NV is a great backup server or media server. However, the one critical missing feature that will make any power-user break into a cold sweat is ssh shell/root access. My initial reaction was: Huh!? I’m buying this box to store my precious data and you won’t even tell me the root password or give me shell access? Dubious. I’m sure that this has driven away many potential customers. To be fair, Infrant has promised to add this feature in late 2006, but it’s almost December and it hasn’t happened yet.

As it turns out, gaining root ssh access is trivial, you just need:

  1. Logs from your ReadyNAS
  2. Computer with a free internal SATA port
  3. Knowledge of linux

Don’t try this at home kids

This article is not a step-by-step, copy-and-paste walk-through guide. If you are not comfortable working at a root prompt and have no clue about how linux is configured, then this article will not help you. My intended audience is knowledgeable users who want shell access, but have live data on their ReadyNAS boxes and can’t afford to poke around and screw up their backups.

The system partition

The first thing I did after unpacking the ReadyNAS (no drives installed) was to plug it, connect it directly to my laptop and turn it on. My reasoning was that if the OS runs from a flash memory card, then the system should be accessible even without any disks. This is not the case. Instead, as I had hoped, the ReadyNAS creates a system partition on one of the drives. This means that the problem is essentially the same as that one time when your friend forgot the root password to her linux box and you had to help her “break in”.

Reconnaissance

If the ReadyNAS creates a system partition on a drive, where does that partition live? I’ll give you a hint: Download the logs through frontview and look at them. The file called “partition.log” is a good place to start.

If the ReadyNAS could be booted from a CD and had a monitor and a keyboard, you would just need a linux boot CD and and you’ve have access. It’s not quite that easy, but the drives are very easy to remove. You’ll just need to plug the drive with the system partition into another computer running linux. If you don’t have a linux installed on the system with a SATA controller, try one of the live CDs from Ubuntu or Gentoo. These will even nicely with a PowerMac G5.

Now that you’ve determined where the system partition lives, shutdown your ReadyNAS and remove the drive with the system partition. Plug it in to a computer with an internal SATA controller. Turn on the computer.

Break in (through the unlocked front door)

While you were looking at the log files, you probably noticed that the system partition type is ext3, which is not surprising, since the ReadyNAS runs GNU linux. Mount the partition as ext3. That’s it. You can now modify/create/delete files. However, the engineers at Infrant are clever. Enabling shell access is not as simple as modifying /etc/passwd and putting the drive back in your ReadyNAS.

Don’t steal the marked bills

.enc files

While you’re poking around in /etc, you’ll notice some files with “.enc” extensions. These are encrypted versions of the corresponding files without the extensions. The ReadyNAS updates the .enc files after you make changes to the system through frontview. The catch is that when you boot the ReadyNAS, it apparently compares each normal file with the encrypted version. If they are different, then the encrypted version is used to regenerate the normal file. This means that you won’t be able to modify files that are managed by this mechanism. Trust me, I already tried it. For those following along at home, this rules out:

  • /etc/passwd
  • /etc/exports
  • /etc/sudoers
  • /etc/inittab

I’m sure we can all dream up a few ways to get around this “security” system. I used the method outlined below.

/root

Anything you add to /root appears to get removed when you put the disk back in the ReadyNAS and reboot the system.

Set a trap

Since the usual targets get reset when you boot the ReadyNAS, one route of attack is to plant a trojan horse that will modify these files after the ReadyNAS boot up. Fortunately, /etc/crontab is not controlled by the security encryption, which makes setting the trap trivial.

Write a shell script to add a user with uid = 0 if the user doesn’t already exist. Add a line to /etc/crontab that executes this script as root every minute or so.

Spring the trap

Once you’re happy with your changes, unmount the partition, shutdown your computer, and transfer the drive back into the ReadyNAS. Turn it on and wait for it to boot up. Wait a few minutes for the cron job to execute, then login as your new root user. You’ll probably want to change the configuration settings so that you can login as a normal user and enable root access via sudo.

Cool… now what?

Well, now you can modify any file you want, install your favorite software, and configure everything exactly the way you want. Slow down. Before you get too excited, let’s think about this for a minute:

  1. The Infrant processor runs @ ~250 MHz. You’re probably not going to want to run your database-backed app off of the ReadyNAS. It can barely handle ssh file transfers without maxing out the CPU.
  2. The OS is a minimal version of Debian Linux. It does not have a working build environment.

Come back and look for the next article, which will cover building a sparc-linux cross-compiler with crosstool.

UPDATE

If you arrived at this page from a search engine and you’re looking for an easier way to enable ssh access that doesn’t require futzing with hardware, read this article.

Comments

Leave a response

  1. Kyle DrakeDecember 12, 2006 @ 10:04 PM

    Just broke in a few minutes ago, thanks for the awesome tipoff. I’ve got a simple entry you can stick into /etc/crontab to do the job without needing a shell script:

            • /usr/sbin/usermod -p ‘$1$RVWNkJR9$CaniKWqUxyXC3ETsWKrCE1’ root

    the password after this command is run should be: letmein

    I’ll try to get CVS running on it tomorrow ;-)

    And hell, it has 2GB of space for the partition.. why CAN’T we install the compiler stuff? through dpkg maybe?

  2. Brian ChapadosDecember 12, 2006 @ 11:04 PM

    Thanks for taking the time to comment and adding the extra tip. I haven’t tried installing the generic sparc-linux gcc with dpkg, but I built a cross compiler on a linux box using crosstool. I haven’t run the test suite on the cross compiler, but I have successfully compiled rsync, python, and some libraries necessary for rdiff-backup, so it seems to be able to handle userland programs without a problem. Compiling gdb and a working kernel might be another issue. I was hoping to get the tests done before I post the instructions for building the cross compiler and installing rdiff-backup. I’ll try to get that stuff done this weekend.

  3. Kyle DrakeDecember 13, 2006 @ 04:54 PM

    Another tip: If you have a Windows XP machine and want to mount EXT2/EXT3, you can use this tool: http://www.fs-driver.org/

    Happy hacking!

  4. Kyle DrakeDecember 13, 2006 @ 06:52 PM

    Just an update… I went and got the apt package frontend, to simplify adding new packages. You can get it here:

    http://packages.debian.org/stable/admin/apt

    And then put it on the machine and run:

    dpkg -i apt0.5.28.6sparc.deb

    Presto, now you have apt-get!

    I’ve gotten CVS installed on it through apt-get so far.. had less luck getting the compiler suite going.. it installed gcc and make okay, but I’m missing some libraries. When I try to compile my own copy of apache, I get the following message:

    ** A test compilation with your Makefile configuration ** failed. The below error output from the compilation ** test will give you an idea what is failing. Note that ** Apache requires an ANSI C Compiler, such as gcc.

    ======== Error Output for sanity check ======== cd ..; gcc -DLINUX=22 -DUSEHSREGEX -DUSEEXPAT -I./lib/expat-lite -DNO_DL_NEED ED ./apaci -o helpers/dummy helpers/dummy.c -lm /usr/bin/ld: crt1.o: No such file: No such file or directory collect2: ld returned 1 exit status make: * [dummy] Error 1 ============= End of Error Report =============

    A google of the error message says to run apt-get install libc6-dev, but that blows up when I try to run it (not too surprisingly).

    I’ll keep at it and post my progress. I guess this means you’ve become the official home of ReadyNAS modifying ;)

  5. Kyle DrakeDecember 13, 2006 @ 08:40 PM

    One last update before I go to bed:

    I’ve got most of the compiler stuff in (had to put a lot of it in by hand.. ugh), but now it’s giving me the weirdest compiler error: It’s not doing the #ifdef functionality correctly. So it’s trying to include a lot of header files that don’t exist or are designed for some crazy operating system somewhere. I have no idea what to do to resolve this one. I might try to re-install the system and try from scratch tomorrow.

  6. KDDecember 13, 2006 @ 09:44 PM

    Couldn’t resist:

    http://75.72.176.15:8080/

  7. Brian ChapadosDecember 14, 2006 @ 01:33 AM

    If you get a working compiler installed through apt-get/dpkg then let me know. However, if the solution requires manually installing things under /usr/lib, then I’m personally not so keen to go that route. If you look at the public patches released by Infrant in order to satisfy the GPL, one of them is libc. If you overwrite the existing libc in the process of trying to install gcc via apt-get, I’m sure something bad will happen. Also remember that the CPU is not a standard SPARC processor so it’s quite possible that the vanilla gcc for gnu-sparc-linux might not work. I’m actually using the box for live backups at this point, so I’m hesitant to do something that might trash the system. Building a cross-compiler avoids this issue.

    Thanks for the link to the ext2/3 drivers for windows. There are also ext2/3 drivers for os x, but they didn’t work correctly in this case, so I decided that a linux Live CD was the safest option.

    As for Infrant, I think they’ve done something great in producing the ReadyNAS. There’s no point in trying to post this info or any references to it on their forums. They will just delete it anyway. It’s unfortunate that providing ssh access has not been a higher priority for the company. However, I have no doubt that they will eventually deliver on their promise to provide “official” ssh access. In the meantime, people who want the information will ask google, and find the answer.

  8. KDDecember 14, 2006 @ 10:34 AM

    I’ve got a mostly working compiler suite - I pretty much tore into /lib, /usr, and /usr/lib to do it, and didn’t break the system in any way that I can tell (except the hang when I tried to overwrite working libc files in /lib, but it came right back up on reboot). It’s a lot tougher to break than I expected. Doing a dpkg install on libc6-dev fails with a strange error I don’t remember ATM, but actually just copying the files over seems to work. I don’t think there is any compiler errors due to the CPU.. If there was, I’d be getting more than just #ifdef bugs. That’s definetely a bug with something in the dev tools.

    That said, removing the offending apache header #ifdefs allowed me to get apache compiled and going, so I’m definetely on the right track.

    I’m going to re-install the base system, and come up with a specific procedure for putting in the compiler suite. I agree though, a cross compiler would be very handy here, so I’m looking forward to your guide.

  9. DavidDecember 15, 2006 @ 12:25 PM

    Wicked! I was going back and forth between buying one of these or going with a full x86 box, but I prefer this as a solution…How about samba on the NV? Is it a vanilla version of version 3.x? does it do LDAP/AD? I will buy one after the weekend if I can use the NV+ as a domain controller…hmmm…is the NV+ hackable in the same way as the NV?

  10. Brian ChapadosDecember 15, 2006 @ 08:19 PM

    Samba appears to be version 3.0.22 (returned by smbd -V on the box) or 3.0.21a according to infrant. Since samba is licensed under the GPL, you can download the source for yourself and see if there are any substantial changes. I don’t know for sure, but I do know that SMB/CIFS unfortunately (for me) seems to be the optimal protocol for file transfers to/from the ReadyNAS. The ldap daemon (slapd) does not appear to be installed, but you could probably add it. I don’t know about AD (active directory?). I personally have no need for AD, ldap or samba. Kyle seems to be on Windows so maybe he knows more about that area. I’m guessing that these “instructions” would work for the NV+. However, all of this is obviously completely unsupported, so there are no guarantees. Before you buy, check the Infrant forums regarding any performance issues, depending on what your needs are.

  11. DavidDecember 16, 2006 @ 02:17 PM

    Many Thanks…I think that I will pick one up come Monday….hopefully I will have something to contribute to the ongoing endeavor. I will post my results after i mess with it a bit. I am assuming that its possible to return the unit to factory condition with a firmware update of some sort?

    I know that it was mentioned somewhere about the firmware bins being encrypted. I imagine that it may be possible to supply a completely independent OS bin to this device. As for bricking the machine, I have bricked enough routers through the openwrt project (www.openwrt.org) and that it is not exactly a warranty-friendly process…

  12. KDDecember 17, 2006 @ 08:47 AM

    I ‘bricked’ the machine a couple days ago on perpose, to see if I could get the system restored. Basically, I deleted the partition on one of the drives, put it in with no other drives. It won’t re-install on its own, which tells me there’s some kind of storage in the system (probably on flash) that records the past history of your configuration. Re-setting it all is simple: There’s directions on how you hold the reset switch in the back down while powering the unit up, which is described in the quick install. Doing this installs a fresh copy on the hard drive. You might do something that deletes your data, but since the OS data you’re messing with is on the hard drive, it is -extremely- hard to brick this machine. Which makes it even more of a mystery as to why the Infrant guys are so afraid of opening access to the machine.

  13. KDDecember 18, 2006 @ 06:18 PM

    Crap.. I just realized there was a simple mistake in the above /etc/crontab line. Use this one instead:

            • root /usr/sbin/usermod -p ‘$1$RVWNkJR9$CaniKWqUxyXC3ETsWKrCE1’ root
  14. DavidDecember 22, 2006 @ 07:18 PM

    Brilliant…hack works like a charm…remote syslogging all the ReadyNAS log messages to my syslog server certainly helps in maintaining the transition to this little machine.

    The samba distribution looks to be complete…nicely laid out, and has full LDAP support. Thanks for the info…I have been looking for a hackable NAS for the last little while, and while there is no official support for what I am doing, I think that I have found the best solution for the small network that I maintain.

  15. KDDecember 22, 2006 @ 09:28 PM

    There’s still one problem though that I can’t resolve for the life of me. Compiling programs works fine after installing libc6-dev (by hand, because using dpkg directly doesn’t work, but its easy to copy the files because they’re all in /usr.. once you do that you can dpkg -i apt and use apt-get to get gcc and all the other tools).

    But when configuring programs, the system header file check fails. My example I’ve been using is Apache 1.3. Try to configure and make it, and it tries to include headers that are not supposed to be available for the linux build.

    The reason I believe it does this is that the system headers check is performed by trying to compile a file like this (see src/Configure and src/tools/checkheaders.sh):

    include <bstring>

    SYNTAX ERROR

    And then checking the response gotten back from the executed program (so. the return of gcc), through the shell variable $? . I have no idea why, but this always returns 0, instead of returning 1 on failure like it’s supposed to (you know when you do an int main() on a c program, and return for main? That’s what this number is).

    If anybody has any idea how to fix this, I’d love to hear suggestions. I’ve tried replacing the shell with a different one.. no luck. Hacking the headers out of the configure manually works of course, but it’s a pain.

  16. DavidDecember 28, 2006 @ 02:16 PM

    Is there a particular starting point that you could direct me to for building packages on the ReadyNAS, or at least binaries? I would like to build a project called partimage for a particular deployment.

    How’s the article for using crosstool coming along?

  17. Brian ChapadosJanuary 05, 2007 @ 04:18 PM

    Sorry guys. I thought I would have time to write up the crosstool stuff over the holiday, but it didn’t happen. I still haven’t run the proper gcc tests, but I will just post something regardless so that others can go forward.

  18. apnarJanuary 11, 2007 @ 10:40 AM

    Care to share your precompiled rdiff-backup and python? That’s all I was really looking for so if you have them no need to setup a cross compiler. Thanks.

    -apnar

  19. apnarJanuary 12, 2007 @ 06:53 PM

    With regard to the ‘marked bills’… Once you are in it’s easy enough to tweak any file you like and them create your own .enc files. There is an executable that you can run to generate the .enc files called /usr/bin/hwencrypt. It takes two parameters, first the name of the input file and second the name of the output files. So you would run it like:

    /usr/bin/hwencrypt /etc/passwd /etc/passwd.enc

    -apnar

  20. LouJanuary 12, 2007 @ 10:27 PM

    I’m a unix/linux noob, and am having trouble getting my root password to change. I have the following line in my crontab file:

    1 * * * * root /usr/sbin/usermod -p ‘Ynv8NAEC5ghJ6’ root

    Ynv8NAEC5ghJ6 = infrant1 (the default password for admin)

    i don’t know if i am using the correct characters ’ to surround the encrypted password, but i have tried a few variation ’ ” and the character used in the original example.

    after making the change to the crontab file and attempting to login as root via putty, then poweringdown and remounting drive to see if the passwd file changed. I notice it did change somewhat, but not to what i put in the crontab.

    example: this is what passwd says root:$1$hT5/wz7e$sFbgA.UNlm469vOMJVrdP/:0:0:root:/root:/bin/bash passwd- has the following root:$1$uQA0kr7e$NausyvlekOtRYzipVzXBN/:0:0:root:/root:/bin/bash

    before attempting the change via crontab, both these files had same exact encrypted password.. so i assume the passwd- is the backup

    If anyone can tell me what i am doing wrong please email me at luxferro397 at yahoo.com. thanks!

  21. apnarJanuary 13, 2007 @ 10:45 AM

    Lou,

    Looks like you are using the crypted version of the password instead of the md5ed version. You can generate the md5 version of the password by running:

    openssl passwd -1

    -apnar

  22. LouJanuary 13, 2007 @ 09:28 PM

    apnar,

    I have even tried the exact password as posted in the first comment: $1$RVWNkJR9$CaniKWqUxyXC3ETsWKrCE1 which is supposed to be letmein. I tried this prior to my previous comment.

    is it safe to assume that $1$RVWNkJR9$CaniKWqUxyXC3ETsWKrCE1 is in md5, as you mentioned in your post? If so, then i still don’t know why it won’t work for me. Are you guys using latest infrant firmware too?

  23. BrianJanuary 14, 2007 @ 02:26 PM

    I’m a unix/linux noob, and am having trouble getting my root password to change. I have the following line in my crontab file:

    1 * * * * root /usr/sbin/usermod -p ‘Ynv8NAEC5ghJ6’ root

    I suspect this might not a problem with the password string. Check the syntax for crontab timing again (from scrounge.org):

    Here is the format of a cron job file:
    
    [min] [hour] [day of month] [month] [day of week] [program to be run]
    
    where each field is defined as
    [min]   Minutes that program should be executed on. 0-59. Do not set as * or the program will be run once a minute.
    [hour]  Hour that program should be executed on. 0-23. * for every hour.
    [day of month]  Day of the month that process should be executed on. 1-31. * for every day.
    [month] Month that program whould be executed on. 1-12 * for every month.
    [day of week]   Day of the week. 0-6 where Sunday = 0, Monday = 1, &#8230;., Saturday = 6. * for every day of the week.
    [program]   Program to be executed. Include full path information.
    
  24. apnarJanuary 15, 2007 @ 09:23 PM

    @lou,

    The full string listed above is the MD5 checksum version (format is ‘$1$[salt]$[md5 pass]’), just the one you listed was the crypted version which won’t work.

    @Brian,

    The syntax you listed is correct for per-user crontabs or “normal” crontabs. On most Debian based distro’s (like that of infrant) there is a global, system wide crontab located at /etc/crontab (which the above posts are inplicitly referencing) that adds a parameter between the time specification and the program to be run which identifies the user to run the command as.

    @Lou,

    you editing the /etc/crontab? or did you go for the more classic /var/spool/crontab/root? If so the above syntax is wrong.

    -apnar

  25. LouJanuary 16, 2007 @ 05:09 AM

    apnar,

    I edited the /etc/crontab file. and used the example in the first comment (actually the corrected one a few comments below). which should be ‘letmein’

    1 * * * * root /usr/sbin/usermod -p ‘$1$RVWNkJR9$CaniKWqUxyXC3ETsWKrCE1’ root

    I believe the above is the correct format for the cron job. the above should run every minute, if i am not mistaken.

    Am i doing this correctly? (sorry for all the questions - i don’t mean to mess up the blog thingy lol)

  26. apnarJanuary 16, 2007 @ 06:02 AM

    Lou,

    That commands look good, it just doesn’t run every minute. It runs on the first minute of every hour, so 00:01, 01:01, 02:01, etc. To run every minute you need a star for all 5 columns. Also make sure that the quotes surrounding the password are both single quotes and not backticks (might be blogging software showing off smart quotes though). Anyway, try to connect again now might have been you didn’t wait until the first minute of the hour.

    -apnar

  27. BrianJanuary 16, 2007 @ 12:33 PM

    apnar: You are correct, for /etc/crontab entries, there should be a user entry.

    Lou: My original intent was that this not be a walkthrough, copy and paste guide. Infrant already gave me a hard time about posting this in the first place, although there reasoning was pretty lame. However, I decided that the least I could do was not make it too easy. My last comment was meant for you to check the time string format. The incorrect format for /etc/crontab (no user) was a mistake. In the grand scheme of things, coming up with a correct crontab entry is trivial, so I guess I should stop kidding myself and update the original article to include more info.

    Everyone: I turned off the "smartypants" filter, so your quotes shouldn't get mangled anyone. Comments are filtered using Markdown. I was all set to remind everyone to use a markdown code block (indent the line with 4+ spaces) in order to get the correct quote behavior, but it turns out that smartypants was causing problems inside codeblocks too, so it's gone until I have time to fix it.

  28. NVJanuary 23, 2007 @ 11:00 PM

    @Brian - Found any interesting info that may help the rest of us get in to running systems? My NAS is already built up with 4x HDDs, so modding offline isn't sounding so do-able.