DSM-G600, DNS-3xx and NSA-220 Hack Forum

Colin_M · 2008-04-11 14:25:09

I've been using my DNS-323 for several weeks and it's been fine till yesterday

THE PROBLEM
***********
I am no longer able to log into the Admin functions via a browser.

- I can however still see the mapped drives & files from client PCs on the network
- The D-Link "Easy Search utility" can't find the device
- Using "Advanced IP Scanner for Windows" I can see the device
- My Router managemnt tools can see the device
- I can ping the device & get responses
- However entering the IP address into my browser no longer gives me the Admin logon page.

BACKGROUND & WHAT I'VE TRIED
*****************************
Initially, I assumed I'd changed some security settings on my PC. However I get exactly the same problem from each of the other 3 PCs on my network (and they all used to be able to see the Admin logon)

I have tried doing a factory reset. Still the same result

I have contacted D-Link support, who initially asked me to reduce the IE security settings, disable my firewall etc. None of this made any difference

They then suggested connecting the DNS-323 directly to another PC using Ethernet cable. I did this, assigned a specific IP address, as recommended. I cold ping it & get responses, however I still can't use the IP address to connect via a brwoser.

I guess whilst it's working as a Storage device, I don't have an immediate problem. However I don't think this should have happened and will need to do Admin on it again soon.

Can anyone recommend any other courses of action?

Thanks, Colin

fordem · 2008-04-11 17:03:58

Open a web browser and enter \\<ip-of-your-dns-323>\web_page and see what happens - ideally it will openup another browser window showing a single html file - with firmware 1.04 it's called goweb.htm click on that and it should open the admin screen.

Colin_M · 2008-04-11 22:22:41

fordem wrote:
Open a web browser and enter \\<ip-of-your-dns-323>\web_page and see what happens

Yes, I've been doing that quite successfully....up until the point where it stopped working - see my initial message.

It's not just my PC either - every PC that could previous access it using "\\<ip-of-your-dns-323>\web_page" now gets a "Internet Explorer cannot display the webpage" message

Any other ideas?

Colin

fordem · 2008-04-11 22:42:19

So tell me what happens - when does IE report that it can't display the web page - directly you enter \\<ip-of-your-dns-323>\web_page or when you click on the html file?

Or - let's be honest here - you didn't actually try that because you think it's the same as entering //<ip-address-of your-dns-323> into the browser.

Take it from me - there is a difference - and the reason I believe you haven't tried is that if the share is not available, that is not the error message that IE returns.

mig · 2008-04-11 22:47:50

Colin_M, are you sure you are trying the command suggested by fordem:

fordem wrote:
\\<ip-of-your-dns-323>\web_ page

and not just trying http://<ip-of-your-dns-323/

Last edited by mig (2008-04-11 22:49:47)

Colin_M · 2008-04-12 15:44:45

Hi Mig, Fordem, thanks for your comments.

You're right - I hadn't followed Fordem's suggestions exactly. Now that I've done so, I don't feel any further ahead, but at least I've got some slightly different error messages which maybe you can help me decipher?

1) Firstly, I've checked the IP address I believe the DNS-323 is using, with both my router admin s/w and an IP scanner:

2) Following Fordem's suggestion, entering "\\<ip-of-your-dns-323>\web_ page" in IE gives this error message

3) As already mentioned, I can see the shares on the DSN-323 from Windows, including "Volume_1" and "\\DSN-323 name\web_page". If I double click on the file "goweb.htm" within "web_page", I get this error message:

I assume that I probably have some issue with the networking side of things (which I'm not clued-up about), rather than the actual DSN-323. If any of the above helps indicate this, I'd appreciate any suggestions!

Thanks, Colin

fordem · 2008-04-12 16:12:42

OK - what I was trying to do was determine if the web server in the DNS-323 was running, and what I expected was the second error screen, if it wasn't, but not the first - which is why I asked at which point you got the error - getting both of those screens suggests that something is being blocked somewhere.

What I had given you is what is called the UNC - universal naming convention - name for the web_page share - and the quirk here is that even though it is available as a share, IE cannot locate it using UNC, which could point to a browser or even firewall type issue.

This is a shot in the dark - but could you try to reach the same UNC name using Windows explorer - Start/Run - type Explorer in the run dialog box, and when Windows Explorer starts enter \\192.168.2.3\web_page in the address bar - if this opens the share, it would suggest that the problem may be IE related (although I suspect IE may be working fine for other web sites - you would have mentioned that if it wasn't) or firewall related.

I notice you seem to have McAfee Security Suite loaded - I have found that to be particularly quirky at times, and have been forced on a couple of occassions to uninstall it to get certain applications to run - you might want to take a look in that direction - there is a possibility that a security update might have changed settings to to prevent access

Another thing you might like to try is adding the URL for the NAS to IE's trusted sites and see what effect that has.

Colin_M · 2008-04-12 19:17:19

Ok, here's a couple of updates.
(1) Though I swear I haven't changed any settings, I re-tried putting "\\192.168.2.3\web_page" into the address bar of IE and instead of the error message above, it now opens up a separate Explorer (ie. Windows File Explorer) window, open on the folder web_page within the DNS-323, showing the single file "goweb.htm" that exists there.

Sadly clicking this file still gives the same result as before: "Internet Explorer cannot display the webpage"

(2) Should have mentioned this before but I can ping the IP address and get a response back. That appears to indicate that at the network level, both Ping and the Port Scanner s/w can see the device on this IP address. Strange then that the bundled D-Link utility "Easy search" used to be able to find the device but now can't.

??? Are there any other tools other than IE that I can use to communicate with the DNS-323? I see references to Telnet, but don't know a) how to run it and b) whether it would help in this diagnosis. In the end, my main objective is to get the Web Interface back so I can do admin on the DNBS0323.

In the meantime, some replies for Fordem:

fordem wrote:
This is a shot in the dark - but could you try to reach the same UNC name using Windows explorer - Start/Run - type Explorer in the run dialog box, and when Windows Explorer starts enter \\192.168.2.3\web_page in the address bar

Well, I tried this, but basically get the same result as running IE in the standard manner. I also tried getting it to open the address directly (iexplore.exe \\192.168.2.3\web_page) and got the same result.

fordem wrote:
I notice you seem to have McAfee Security Suite loaded - I have found that to be particularly quirky at times, and have been forced on a couple of occassions to uninstall it to get certain applications to run - you might want to take a look in that direction - there is a possibility that a security update might have changed settings to to prevent access

Good suggestion - however when I tried disabling the McAfee firewall, there was no change.

fordem wrote:
Another thing you might like to try is adding the URL for the NAS to IE's trusted sites and see what effect that has.

Ok, I tried this (as well as reducing the security levels). I also did it whilst the firewall was switched off. Again, it made no difference.

Thanks for persevering on this. Any other ideas?

Colin

fordem · 2008-04-12 19:42:13

You might have noticed - in my mention of McAfee, I said I had to uninstall it - disabling it didn't work for me, and as a result, I no longer use it.

With the new information, it could be that the web server on the DNS-323 is not running, and at least in theory a reset which you mention in the your first post should have fixed that, heck a rebbot should fix that, as long as you haven't been fooling around with fun_plug and the configuration.

Failing that - I think it's DLink to replace the unit under warranty.

Last edited by fordem (2008-04-12 19:42:46)

mig · 2008-04-13 10:35:22

Since you still have access to the DNS-323 share, you could try installing fonz's fun_plug v0.4
http://www.inreto.de/dns323/fun-plug, installation is very easy...

fun_plug README.txt wrote:
-- Installation --

Unpack funplug-0.4.tar.gz to the root of the first volume. It
contains two files: fun_plug and fun_plug.tar. Reboot and wait a
minute.

The telnet server will start automatically.

NOTE: Do not use WinZip, it will corrupt the fun_plug script.

Once successfully installed, this would give you telnet access to
your DNS-323 and you can access the DNS-323 via telnet and
query the DNS-323 to see if the web server process "webs" is running.

Last edited by mig (2008-04-13 10:36:44)

Colin_M · 2008-04-13 11:15:47

fordem wrote:
You might have noticed - in my mention of McAfee, I said I had to uninstall it - disabling it didn't work for me, and as a result, I no longer use it.

Understood.

Before I removed the antivirus & firewall for my main PC, I wanted to check a few other things (like Mig's and your suggestion of checking the webserver). I may need some advice on how to use Telnet to do this.

After that I'm happy to try removing McAfee, as you're right about these "security suites" - they seem to be turning into a Tron-style Master Control Program! I noticed on the McAfee status screens that it checks the status of all machines on your LAN and indicates which ones don't have McAfee installed (eg. potential sources of risk). Of course the DNS-323 is listed - (so McAfee is also able to see it!). I'll see if it's trying to do anything like block traffic from it....

Colin

Colin_M · 2008-04-13 21:47:32

mig wrote:
Since you still have access to the DNS-323 share, you could try installing fonz's fun_plug v0.4

Once successfully installed, this would give you telnet access to
your DNS-323 and you can access the DNS-323 via telnet and
query the DNS-323 to see if the web server process "webs" is running.

Thanks Mig. I have installed this and have been able to use Telnet to connect to the DNS-323.

However at this stage I don't know enough to get any further and a few attempts at Googling hasn't thrown up any obvious answers. I'm sorry to be raising newbie unix questions on this forum, but could you advise or point me to any resources that describe:
a) the Telnet commands I need to run to do this
b) any steps I'd have to follow to:
- confirm the status of the web server process
- restart it, or generally unblock it?

Thanks, Colin

Last edited by Colin_M (2008-04-13 22:24:14)

fordem · 2008-04-14 00:20:15

I'm one step away from being a linux newbie, so I can only offer limited help - the first command you need is ps - which will show the processes that are running, and the one you are looking for should show up in the list as /web/webs

Don't feel too bad about displaying your lack of linux knowledge, for many of us, it seems, this device has been our introduction to linux and at least for me, the folks here have guided me a lot of the way and I recognize that I'm probably never going to reach to where some of them are.

You can display the contents of a folder using ls and you should see a folder called /web and it should contain what I think is an executable file called webs - and at least in theory, you can restart it with /web/webs

BTW - you do need to pay attention to the direction of the slash - I mention this only because I believe it may have been the cause of some confusion earlier on in the thread - see post #8 - if you use the wrong slash with IE it changes the meaning of the command sequence, at the command line, linux uses front slashes, where DOS/Windows use backslashes

fonz · 2008-04-14 00:26:15

fordem wrote:
and at least in theory, you can restart it with /web/webs

"webs" is also restarted automatically (may take a minute or two).

fordem · 2008-04-14 01:32:45

Hi fonz - I suspect, primarily because he can't get to the admin web page, that the webserver may not be running - it's either that or something on all of his pcs is blocking port 80 traffic from local addresses.

mig · 2008-04-14 07:41:00

Colin_M, post the output of the "ps" command

Here is what "ps" returns on my DNS-323 FWv1.04 (ffp v0.4)

Code:

BusyBox v1.8.1 (2007-11-20 23:39:08 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # ps
PID   USER     COMMAND
    1 root     init
    2 root     [ksoftirqd/0]
    3 root     [events/0]
    4 root     [khelper]
    5 root     [kthread]
   11 root     [kblockd/0]
   14 root     [khubd]
   50 root     [pdflush]
   51 root     [pdflush]
   53 root     [aio/0]
   52 root     [kswapd0]
  189 root     [scsi_eh_0]
  190 root     [scsi_eh_1]
  197 root     [mtdblockd]
  215 root     [kcryptd/0]
  216 root     [kmirrord/0]
  227 root     [loop0]
  837 root     atd
  842 root     smbd -D
  844 root     nmbd -D
  852 root     smbd -D
  872 root     crond
 1062 root     chkbutton
 1080 root     /web/webs
 1090 root     fancontrol
 1115 root     op_server 3 3 3
 1122 root     -sh
 1145 root     pure-ftpd (SERVER)
 1154 root     lpd Waiting
 1225 root     /mnt/HD_a2/fun_plug.d/sbin/telnetd -l /mnt/HD_a2/fun_plug.d/bin/
 1174 root     /mnt/HD_a2/fun_plug.d/bin/sh
 1175 root     ps

the line that begins with 1080 shows the 'webs' process is running

andrey · 2008-04-14 20:53:37

Did you modify your samba in any way? Also, try removing hard drives, and than resetting and restarting your DNS-323. Athough you won't have telnet access that way, at least if everything is okay with your DNS, you should be able to get to the web page.

Colin_M · 2008-04-15 00:49:17

Thanks for all the input guys – I’ve only just been able to catch up with this again.

Ok, the plot thickens:

1) Running ps does not reveal "/web/webs" in the list of processes
I've pasted my list below. It reveals many similarities with the one posted by Mig. However there are some he has that I don't, and vica verca.

Some of these will probably be down to what's been specifically installed on each unit. For mine I've only added the Funplug recommended earlier for Telnet. In addition, I downloaded v1.04 of the firmware when I first acquired the unit and that's what it's been running since then.

2) There is a /webs directory.
If I enter the command "/web/webs", I get the following:

/ # /web/webs
Quota Start
Set Daylight :/usr/sbin/daylight f &
country = 66
Daylight mode : NONE
/web/ddns.conf:2: no such option '-----------------------------7d82ce1e2016a--'
Segmentation fault

I don't know how to interpret this, but the last two lines don't seem that promising!

3) Final response to andrey. You mention samba - I have not made any changes to the DNS-323 before I started having these problems (other than installing firmware v1.04). Since then I've added the Telnet funplug.

I'll leave all this for you to consider whilst I have a go at connecting to the unit without any hard drives.

Thanks again for your support - it's really appreciated.

Colin

Results of running "ps" on my DNS-323
PID USER COMMAND
1 root init
2 root [ksoftirqd/0]
3 root [events/0]
4 root [khelper]
5 root [kthread]
11 root [kblockd/0]
14 root [khubd]
50 root [pdflush]
51 root [pdflush]
53 root [aio/0]
52 root [kswapd0]
189 root [scsi_eh_0]
190 root [scsi_eh_1]
200 root [mtdblockd]
218 root [kcryptd/0]
219 root [kmirrord/0]
230 root [loop0]
1237 root atd
1242 root smbd -D
1244 root nmbd -D
1252 root smbd -D
1275 root crond
1318 root [md0_raid1]
1506 root chkbutton
1529 root fancontrol
1568 root lpd Waiting
1584 nobody mt-daapd
1585 nobody mt-daapd
1587 root mt-daapd
1590 root mt-daapd
1606 root op_server 0 0 0
1612 root -sh
2299 root /mnt/HD_a2/fun_plug.d/sbin/telnetd -l /mnt/HD_a2/fun_plug.d/bin/
2382 root mt-daapd
11362 root smbd -D
11413 root /mnt/HD_a2/fun_plug.d/bin/sh
11414 root ps

mig · 2008-04-15 04:01:47

Colin_M, looks to me like the webs process is not running, and perhaps the file
/webs/ddns.conf is causing the crash.

You could try editing the contents of your ddns.conf to match the listing here (from FWv1.04)

Code:

/ # cat /web/ddns.conf
CF-DDNS-ENABLE = "0"
CF-DDNS-USERNAME = ""
CF-DDNS-PASSWORD = ""
CF-DDNS-DOMAIN = ""
CF-DDNS-SERVER = ""
CF-DDNS-TIMEOUT = "2073600"

Make sure the file permission match this:

Code:

/ # ls -la /web/ddns.conf
-rwxr-xr-x    1 root     root          133 Mar 14 14:16 /web/ddns.conf

and make sure your file editor preserves the unix style line endings.

After you edit the file try to start the /web/webs process again.

fordem · 2008-04-15 05:48:52

Before we go editing configuration files ...

Let's bear in mind that Colin_M did not even have fun_plug installed prior to the web server problem - what, on an unmodified, unhacked DNS-323 cause this problem, and do we really want to fiddle with it, as compared to RMA'ing it and getting a warranty replacement, assuming that it is still under warranty.

mig · 2008-04-15 18:29:44

O.K. that's a prudent suggestion, fordem. RMA replacement is a good option.

Colin_M, could you post the contents of your /web/ddns.conf file.
The error suggests that line #2 of that file contains the characters
'-----------------------------7d82ce1e2016a--' and these are not valid
options for the dyndns config file.

If you post the entire file, perhaps this would illuminate the nature of
the config file corruption.

Last edited by mig (2008-04-15 18:31:53)

Colin_M · 2008-04-15 22:19:28

Colin_M, could you post the contents of your /web/ddns.conf file.
The error suggests that line #2 of that file contains the characters
'-----------------------------7d82ce1e2016a--' and these are not valid
options for the dyndns config file.

Ok, I had difficulty getting a straight listing of the file and ended up using "vi" (a bit scary and I'd need help if I ever had to make any actual changes with it).

Looks like it's a definite candidate:

Contents of /web/ddns.conf on problem DNS-323 with no web server running

^M
-----------------------------7d82ce1e2016a--^M
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
- /web/ddns.conf 1/2 50%

Now I think fordem has raised a good point - why did this get corrupted like this (assuming none of the rest of you see things like this happening regularly?) I do get occaisional power outages here...

However RMA here in the UK will mean being without the unit for a good week or more, whilst it gets returned by mail. I will therefore contact D-Link support to check their view on the warranty remaining valid if I try the edit myself and mess something else up.

At this stage however, I will definitely need more tuition on how to do the editing (ideally using functions already present on thge DNS-323).

Thanks for your patience guys. You were pretty close right from the start fordem!!

Colin

Colin_M · 2008-04-19 23:47:44

Well, some good news, but some bad news.

Having rung D-Link support twice and failed to get anywhere, I followed the advice given by mig above. It seemed to work and after I ran the /web/webs command I got the web interface back again.

As a final check, I used this to shut down the DNS-323. I then powered it up again.

The shares became available again....but the web interface was gone again. When I telnet'd in again, the /web/ddns.conf file seemed to have exactly the same (corrupted) contents again as was there before I'd edited it.

Can anyone explain this? Any advice on what I do next (other than never shut down....)?

Colin

mig · 2008-04-20 00:14:54

O.K. looks like the copy of the ddns.conf file in NVRAM is corrupted too, and it is
being copied over your corrected file at reboot by line 68 of the the script, /etc/rc.sh

Line 68 of /etc/rc.sh
cp -f /sys/mtd1/ddns.conf /web/ddns.conf

If you recreate the edits to correct the corrupted file on the disk (/web/ddns.conf),
I think you can use the web gui to save thoes values to NVRAM (/sys/mtd1).

First, re-do the edits to correct the /web/ddns.conf file
Then start the web gui with /# /web/webs
Then use your web browser and navigate to the Tools->ddns page of the DNS-323 web gui
Make a simple change to one setting, like change enable to disable (or vice versa)
and click the save settings button on the ddns page

Hopefully, this will write the corrected file to NVRAM.
Then try to reboot the DNS-323 to confirm this has been corrected.

Last edited by mig (2008-04-20 00:19:07)

Colin_M · 2008-04-20 13:13:54

mig, you are a star!

Following this final step has given me back the web admin screens (again) and they also survive a shutdown & re-start.

Guess the final question is "what could have caused this to happen and will I have to do this again in the future?" Any views?

Finally, I find this all very ironic - I bought the DNS-323 because I was cheesed off with having to learn Linux to get my previous home made server to talk to my wintel PC's, set correct access rights via Samba etc. I thought I'd finally escaped from having to work with Linux........no such luck!

Colin

ps - I've drawn on the technical expertise of several you here to make up for my lack of knowledge. If I can return the favour for any of you needing help with photography or gardening, drop me a line!

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2008-04-11 14:25:09

Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#2 2008-04-11 17:03:58

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#3 2008-04-11 22:22:41

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fordem wrote:

#4 2008-04-11 22:42:19

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#5 2008-04-11 22:47:50

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fordem wrote:

#6 2008-04-12 15:44:45

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#7 2008-04-12 16:12:42

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#8 2008-04-12 19:17:19

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fordem wrote:

fordem wrote:

fordem wrote:

#9 2008-04-12 19:42:13

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#10 2008-04-13 10:35:22

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fun_plug README.txt wrote:

#11 2008-04-13 11:15:47

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fordem wrote:

#12 2008-04-13 21:47:32

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

mig wrote:

#13 2008-04-14 00:20:15

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#14 2008-04-14 00:26:15

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

fordem wrote:

#15 2008-04-14 01:32:45

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#16 2008-04-14 07:41:00

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

Code:

#17 2008-04-14 20:53:37

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#18 2008-04-15 00:49:17

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#19 2008-04-15 04:01:47

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

Code:

Code:

#20 2008-04-15 05:48:52

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#21 2008-04-15 18:29:44

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#22 2008-04-15 22:19:28

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#23 2008-04-19 23:47:44

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#24 2008-04-20 00:14:54

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

#25 2008-04-20 13:13:54

Re: Help - can't find Admin Logon screen & Easy Search fails to find DNS32

Board footer