DSM-G600, DNS-3xx and NSA-220 Hack Forum

Mosil · 2008-03-13 05:28:41

Hey guys,
Let me first start of by saying that I have learnt more about Linux on this site within the last two weeks than I will ever learn in my life. I am pretty much a windows guy. With that being said, I am (obviously) having trouble setting up sftp on my DNS323. Please don't think that I trying to slide by and getting all the instructions spelt for me as I have spent may sleepless night trying to get it to work. I have played around with fonz fun_plug and dropbear. I pretty much accomplished loading in Fonz fun_plug starting SSH and being able to telnet into the DNS. I also was able to start dropbear each time the DNS323 restarts.
My main goal is simple. All I want is all the functions of FTP but for it to be secured. Don't care about anything but users remotely and locally connecting to the DNS and uploading/downloading files. Thats it!! I know this may sound like ABC to some of you but like the site, it is a little to advance for me. There are alot of topics here that covers what needs to be done but like I said they are advanced and I am scared of "bricking" my system. IS there any kind soul out there who could shed some light as what exactly I need to do in a simple, easy way. I am willing to read and don't need to be baby fed. Just don't scare me with all these command lines ....lol.
All inputs would be greatly appreciated. Keep in mind that I am not a programmer ... I did read up on vpn routers..Would this do the trick as well?

Last edited by Mosil (2008-03-13 07:39:29)

jules · 2008-03-13 11:57:42

Same "problem" i had a few month ago. Have you installed the openssh-sftp package? With that you can connect to the dns using a SFTP connection from any ftp client that supports this feature.

HaydnH · 2008-03-13 12:15:47

You can also use scp, I assume from your post you're using Windows on your PC? If so PuTTY comes with a version of scp called pscp and you can run it from a command line, can't remember which slashes to use with pscp, it may be the typical windows \ instead of / - but then I suppose if you use windows you want a gui to sftp the files? ;P

c:> pscp c*.txt username@nas-ip-addy:/mnt/HD_a2/path/

oxygen · 2008-03-13 18:18:38

scp (or under Windows pscp) will work if you have the openssh-sftp package installed. But remember the DNS-323 CPU is quite weak. Encryption will slow down your transfer. Over ssh/scp i get a datarate of ~1 MB/s. Without it's more than 20 MB/s.

Mosil · 2008-03-13 22:37:24

@ Jules
Are you saying that if I do get sftp to work in my dns323 that I would not be able to use my regular web browser to access my files like the way it could be done on ftp?

@HaydnH/Oxygen
I read alot of ur posts/replies and you seem to have alot of knowledge in this area. I am using putty but it does not have scp or pscp. It has Rlogin,ssh,telnet and raw so I guess I may have the wrong ver....and yes HaydnH, I would like pretty much the same GUI as regular ftp on windows. I am not sure what ur command in the bottom means?? Oxygen, I have the fun_plug .3 in my DNS. I also setup dropbear to automatically start. I could telnet into the DNS and if I try to connect using ssh through putty it accepts the username and password but nothing happens. The cmd windows just dissapear. I also forwarded port 22 to the ip of the dns on the router and checked out Accept request to dmz server on my netgear . What do I have to do next to get it to work. I did not use Fonz fun_plug .4 cause i couldn't get it to work. .3 works fine as far as getting dropbear running. Another thing is that I couldn't get telnetd.sh "login" changed to "sh" because whenever i start the dns i am denied access to this file. From the forums that I have read this is a big no no since anyone can telnet my dns.The only other way of doing this i guess would be through a command but I am just guessing.I have to turn it off everytime I am finish playing around with it. I had it for two weeks and still not used it for storage....its been all about Fonz fun_plug. It was exciting at first but now I am at the point where I am going bald...lol. Guys if it is a big hassle I think i should just return it or get a vpn router like some of the posts suggest.Two weeks and no luck...I really like it though ...

Last edited by Mosil (2008-03-13 22:44:05)

HaydnH · 2008-03-14 02:13:20

Hi Mosil,

I'm very tired atm so I won't reply in full to your questions now - it's past midnight and I just got home and have to wake up for work in a few short hours! As I've already read this post it won't show up as unread in the morning so I may miss it unless there's another post after this...

Anyway, do a search for my ATTN fonz ipkg thread in this forum and see the latest video (near the end of the thread) - I'm currently working on a plugin to provide an addition to the standard web config gui which will allow you to install extra software without any knowledge of Linux (all you need to know is how to click your mouse!). I should have a release out within the next week or so (actually it's pretty much finished for testing bar a few cleanups as I had a little time today to work on it) so it may be worth holding on to your dns for a little while longer depending on when the return policy runs out.

Haydn.

sjmac · 2008-03-14 10:58:51

Mosil wrote:
I did read up on vpn routers..Would this do the trick as well?

I use a VPN router to access my DNS323 from my laptop when I travel.

It is good because the VPN router has special hardware in to keep the data rate high even though security is used, it doesn't require any special configuration of the DNS323 (except maybe giving it a static IP address), and you should have instructions in the user guide that comes with the router.

Not only will the VPN give you access to the DNS323, but also to any other computers on your network.

Hope that helps.

jules · 2008-03-14 13:32:04

Mosil wrote:
@ Jules
Are you saying that if I do get sftp to work in my dns323 that I would not be able to use my regular web browser to access my files like the way it could be done on ftp?

Hmm... i don't know if the browsers ie/firefox/opera support sftp... if they don't, you could use some free ftp client like filezilla, free,lightweight and with a familiar explorer-like interface.

Mosil wrote:
I think i should just return it or get a vpn router like some of the posts suggest.Two weeks and no luck...I really like it though ...

Don't worry man, with a bit of help your problems will be solved easily.

Mosil wrote:
The cmd windows just dissapear.

This is a login error, you should check the option "never close the window" in putty configuration to discover which one you get.
As far as i remember there are two possible causes, all of them related to an unfixed shadow/passwd file:
1- Login with an user with invalid home dir
2- Login with an user with no password (root)

Are you trying to connect to the box through ssh using root without fixing the etc/shadow first?
If that is the case, you must only set a valid password for the root user. You can do that in two way, call passwd from telnet when you are logged as root (an than call a store-pwd-whatever.sh script to save the pwd because at the next reboot the password will be erased accordingly to the content of the shadow file contained in the flash, but forget this for now, go on reading) or add a meaningful line to the /etc/shadow i.e. a line that define the root password copying the admin's one (this can be added to the funplug, to set a password at every boot thus enabling ssh access again, without writing stuff in the flash).
For now try to set the password with passwd without saving to flash and look if ssh start working.

I've some security concerns about exposing the dns box with ssh to the world, ssh is secure, if you want you can put on the box openvpn, but one thing that will be missing in this simple setup is an access control system that monitors the accesses to the box... preventing brute-force attacks or similar. I remember that in some discussion related to the debian chroot someone pointed out this issue, maybe haydnh or fordem. I've found in the optware ipks a script that apparently does some access verification... maybe i'll open a topic about it any time soon (if i get it to work).
So, you can expose the box to the outside world using ssh, but, imo some access control facilities are needed.
Using a router that supports vpn/access control/etc...? It can be a solution, but all those stuff can be done on the dns too...

Mosil · 2008-03-14 17:30:04

@HaydnH
I appreciate your support and thanks for shedding light on this matter.No need in both of us spending sleepless night ...lol Atleast I know there is hope now.I did not get a time to look up Fonz ipkg thread just yet as I am currently at work. I will definetely do so tonight. The plugin that you're working on sounds like what I am looking for. As far as the warranty goes, I have 2 more weeks remaining. I have already waited 2 weeks, I guess one more week b4 ur plugin release wouldn't hurt. Well do keep us updated as to when the plugin will be released and once again thks for your time and help.

@sjmac
Hey sjmac thanks for the info. At this point I think my next step would be to wait on HaydnH's new plugin. Hopefully this works for me. I am willing to use the vpn router as a last resort. I was actually looking at some from netgear but they are expensive. Just out of curiousity though. Correct me if I am wrong here.....With the vpn routers I could log into my dns (or any of my pc in that case) using windows explorer or maybe firefox to access it (e.g ftp:// xxx.xxx.xxx.xxx/port #)--username + password. Obviously i would have to forward the specific port to the dns ip address. I just want to know if this is how it works.My main thing is that I am very comfortable with ftp as far as setting up and using. I just want to be secure but simply. Thanks for your input pertaining to this matter.

@jules
Hey jules I am not sure if this is a login error or not. Maybe I was a little mileading or confusing in my explanation. When using Putty I input the ip address of my DNS and select the ssh. The port # automatically changes to 22 I believe. I then click on "OK". The cmd window opens and prompts for a username. It doesn't matter what I input on that field, it accepts it and ask for a password. If I put any password it would confirm that the password is incorrect and prompt for the password again.It does this over and over. Now, If I use the username and passwd that I use to access my DNS config screen the windows simply disappears as if though it accept it but nothing happens afterwards.At first I thought that it would bring up a window but nothing happened. Please don't over think this matter cause I am sure I am probably doing somthing stupidly wrong and this is probably somthing a 5th grader could figure out.
As far as passwd, i went ahead and followed Fonz instructions on how to create it in /shadow so that it stays with the firmware upon reboot. I don't know if it makes a difference or not but I use the command passwd instead of smbpasswd and I followed the cmd line he stated in his readme file. Maybe that is what it is. As for now I removed all folders again from the DNS again for the millionth time.The only folder there now is the "system"which was there since I got the unit. I am going to wait on HaydnH plugin and then give it a shot again. This would be my last attempt and hopefully it works...if not I think I am going to have to pay the price for a router because of my limited knowledge of hacking in Linux. I want to say thanks again for all your efforts and time you have dedicated to help me with my issue. It is very much appreciated. I will keep you all posted when I try the new plugin next week.

Last edited by Mosil (2008-03-14 17:36:11)

sjmac · 2008-03-14 17:44:40

Mosil wrote:
I am willing to use the vpn router as a last resort. I was actually looking at some from netgear but they are expensive. Just out of curiousity though. Correct me if I am wrong here.....With the vpn routers I could log into my dns (or any of my pc in that case) using windows explorer or maybe firefox to access it (e.g ftp:// xxx.xxx.xxx.xxx/port #)--username

So do it properly as a last resort - I do that myself a lot ;-)

If you use, for example, Windows XP, you can create a new network connection that is a VPN connection. This works a lot like a dial up connection: you give it a VPN server address, a user name and a password. Your computer then makes a connection to the VPN server, and you can access anything on that network just like you are back at home or in the office.

So, you can use ftp://user@xx.xx.xx.xx/ in a web browser, or you can do browse the file shares in File Explorer with \\xx.xx.xx.xx

There is no port forwarding, a network connection "tunnel" is made through the internet in to your home network. You might use the dial up/VPN client software that is built in to your computer, but often a router will come with its own easier to set up software for making the connection.

That all sounds great, but they can be tricky to set up. I'd expect a Netgear to be well documented and supported.

Last edited by sjmac (2008-03-14 17:45:08)

Mosil · 2008-03-16 16:24:39

@sjmac
Thanks, I'll get back to you if I get the router.

Mosil · 2008-03-19 05:39:43

HaydnH, I looked at the clip that you were talking about. It looks awesome and pretty simply with the GUI. Any idea as to when this plugin would be available? I know ur pretty busy but I am really looking forward to play around with it.

Mosil · 2008-03-23 07:09:30

Hey guys,
It been well over 3 weeks and I am still having some issues here setting up my DNS323. Here is my story.Please let me know if I am missing anything .....
So far I have successfully installed Fonz fun_plug 0.4. I also downloaded putty and I am able to telnet into busybox. I installed the dropbear and openssh-sftp addons. I was able to configure dropbear to start automatically on reboot but NOT the openssh_sftp(I am assuming that this works with dropbear and does not need to be automatically started----correct me if I am wrong).I then setup a regular passwd so I can SSH into the box.I stopped the 00telnetd application for security reasons.I now use SSH to access busybox as root.I downloaded the puttygen application since I am a windows guy and created public/private keys. I converted the private keys >>Conversion>> "Export openssh key" and moved it to Volume_1. I then use the following commands....

mv /mnt /HD_a2/ private_key.openssh /mnt/HD_a2/fun_plug.d/etc/dropbear

I then use the "dropbearconvert openssh dropbear" tool to convert it for dropbear to recognise it but get the error -->Currently encrypted keys aren't supported, neither is agent forwarding. At some
stage both hopefully will be.... ---which is exactly what is stated in Fonz dropbear.readme. The instructions in the readme are a little to complicated for me.My question is how do I generate public/private keys to use. Am I stuck using the default keys outputted by the dropbear installation(dropbear_rsa_host_key)? I am using WinSCP to sftp the DNS323. I have no problem logging in remotely from the outside world. I just put the ip address.....username...and password when prompted on the main screen and I am in. I also have it set to sftp. Another thing is that I see all the root files when I log in. I haven't gotten time to read on a fix for that yet but will do so as soon as I get the keys figured out. The good news is that I can log in remotely and locally....only that I am not using any private key in the winSCP log on screen. Q> would this indicate that my username and password is in plain text or that it is encrypted and the files transfered and in plain text? I know this might be a dumb Q. but I am new to this and don't quite understand the concept of it all. I pretty much read the forums and do as said.....and may I add ....many thanks to the forums and the ppl in here. Please let me know what direction should I go in from here. Remember any advice is good advice...

I also noticed that in some of the post a .ssh/authorized_key directory is mention.I did create this directory but don't know where to go from here. Any input on this would be greatly appreciated as I am on the verge of throwing this thing out of the window. Linux is cool though (compared to windows)..--Don't tell anyone I said that!!

P.S. I want to use the the DNS as a server ....Does this mean that I am suppose to use the public key instead of the private key?? I am also using port 22. Can I change this to a different # or is this set for sftp?

Last edited by Mosil (2008-03-23 07:44:10)

fonz · 2008-03-23 11:22:32

It's $HOME/.ssh/authorized_heys. See http://www.linuxmanpages.com/man1/ssh.1.php (Section on SSH protocol version 2) for how the authorized_keys file is used. It's the openssh man page, but authorized_keys works the same with dropbear. Creating the authorized_keys file is essential for password-less login to work. Also be sure you get the permissions of the key files and the .ssh directory right, or it will not work. Read this thread for the details: http://dns323.kood.org/forum/p10503-200 … tml#p10503

Note that sftp is more like ssh with an ftp-like front-end application, and much less like ftp with added encryption. So you need to focus on your ssh setup. If that works without password, sftp will work, too.

Mosil · 2008-03-24 07:13:38

Ok, thanks....

It took me a while but I got it working. Thanks Fonz. My next mission would be to limit remote users from logging into shell. I read only a few forums in here pertaining to this matter.From what I understand, it is complicated to do. I just want to know if its worth me trying since I have limited Linux experience. I also want to know that since I have fun_plug and dropbear/sftp-server running on my DNS323 system...do I need to install the file that enhances the fan to cool the system down? Would appreciate if someone could point me in the right direction or link.

Last edited by Mosil (2008-03-30 02:34:15)

Mosil · 2008-03-30 18:54:23

Did anyone get user restrictions to work on there DNS323. Appears that everyone logging in had root access.

mastervol · 2008-09-18 20:34:00

^^ i need that as well

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2008-03-13 05:28:41

sftp

#2 2008-03-13 11:57:42

Re: sftp

#3 2008-03-13 12:15:47

Re: sftp

#4 2008-03-13 18:18:38

Re: sftp

#5 2008-03-13 22:37:24

Re: sftp

#6 2008-03-14 02:13:20

Re: sftp

#7 2008-03-14 10:58:51

Re: sftp

Mosil wrote:

#8 2008-03-14 13:32:04

Re: sftp

Mosil wrote:

Mosil wrote:

Mosil wrote:

#9 2008-03-14 17:30:04

Re: sftp

#10 2008-03-14 17:44:40

Re: sftp

Mosil wrote:

#11 2008-03-16 16:24:39

Re: sftp

#12 2008-03-19 05:39:43

Re: sftp

#13 2008-03-23 07:09:30

Re: sftp

#14 2008-03-23 11:22:32

Re: sftp

#15 2008-03-24 07:13:38

Re: sftp

#16 2008-03-30 18:54:23

Re: sftp

#17 2008-09-18 20:34:00

Re: sftp

Board footer