DSM-G600, DNS-3xx and NSA-220 Hack Forum

plopiplop · 2012-11-23 09:55:03

Hello All,

After a "rm -r /" (nice joke isn't it ?) i started loosing all the file in my drives but after few seconds I stopped it.
RM erased everything by alphabetical order, so i lost :
/bin /dev /etc /home

I managed to recreate some usefull /dev device (urandom) in order to make ssh working again (only if i disable tty allocation)

So i've 4 questions for you :
- If i restart my nas, what will happen ?
- If i manage to login in web-interface (i can't for the moment) will i be able to flash the firmware ? will it solve my problems ?
- If i do factory reset (with physical button) will it fix everything ?
- Can somebody tar me their /bin /dev /etc files ? (you can clear your password of course, but i need uid/gui for admin account and maybe other system accounts ?) [If i copy back these files, il will work no ?]

Thanks in advance
Plopiplop.

Mijzelf · 2012-11-23 11:08:08

AFAIK those 4 directories are all on a ramdisk, so they will just reappear when you restart the box.

On the other hand, it would be strange if you was fast enough to stop a 'rm -r /' on a ramdrive before it deleted /lib. But if /lib is also gone the next station is /mnt, which contains the whole data partition, so then you would certainly have time to stop it, but you'll have lost some user data.

plopiplop · 2012-11-23 11:21:13

Good new for these 4 directories, but indeed, /lib is gone too (but i guess it will be restore as well on reboot ?). (Can someone confirm that /bin /etc will be restored at reboot ? from where ?)
My data seems to be there but i didn't check everything... After checking, my first folder is /mnt/HD_a2/Plop and i can't remember something important before... (Is there more folder in /mnt than /mnt/HD_[ab][24] ?)
edit : it's sorted capital letter first and then small letter, so /ffp and other thing in small letter are still there, do ffp install something here with capital letter ?

So at your point of view, if i reboot everything will work as before, and the only thing i'll loose is the data which were present "before" /mnt/HD_a2/Plop ?

One more question : if /etc is restored at boot time, how can the modifications (user added for example) are stored permanently ? (I had some user to manage right in the share, will they be restored ? from where again ?)

Thanks a lot

Last edited by plopiplop (2012-11-23 11:40:18)

Mijzelf · 2012-11-23 12:18:10

Yes, /lib is also on the ramdisk.

plopiplop wrote:
the only thing i'll loose is the data which were present "before" /mnt/HD_a2/Plop ?

And possibly some stuff inside /mnt/HD_a2/Plop.

do ffp install something here with capital letter ?

FFP itself doesn't. It stays inside the ffp directory. But some packages might.

if /etc is restored at boot time, how can the modifications (user added for example) are stored permanently ?

According to /ffp/sbin/store_passwd.sh they are stored in 2 flash blocks:

Code:

#!/bin/sh

echo "Copying files to mtd1..."
mount -t minix /dev/mtdblock0 /sys/mtd1
cp -f /etc/passwd /sys/mtd1/.
cp -f /etc/group /sys/mtd1/.
cp -f /etc/shadow /sys/mtd1/.
cp -f /etc/samba/smbpasswd /sys/mtd1/.
#cp -f /etc/ftp_tbl /sys/mtd1/.
#cp -f /etc/ftpgroup /sys/mtd1/.
sync
umount /sys/mtd1
    
echo "Copying files to mtd2..."
mount -t minix /dev/mtdblock1 /sys/mtd2
cp -f /etc/passwd /sys/mtd2/.
cp -f /etc/group /sys/mtd2/.
cp -f /etc/shadow /sys/mtd2/.
cp -f /etc/samba/smbpasswd /sys/mtd2/.
#cp -f /etc/ftp_tbl /sys/mtd2/.
#cp -f /etc/ftpgroup /sys/mtd2/.
sync
umount /sys/mtd2

echo "Done."

So I suppose some startup script will copy them back.

plopiplop · 2012-11-23 12:32:55

Mijzelf wrote:
Yes, /lib is also on the ramdisk.

Happy to hear that

Mijzelf wrote:
And possibly some stuff inside /mnt/HD_a2/Plop.

Yes of course, but nothing really really important there...

Mijzelf wrote:
FFP itself doesn't. It stays inside the ffp directory. But some packages might.

If packages delete do not affect the boot-up process of the whole thing, it's OK. I'll re-install concerned packages

Mijzelf wrote:
According to /ffp/sbin/store_passwd.sh they are stored in 2 flash blocks:
Code:
cp -f /etc/passwd /sys/mtd1/.  [...]
cp -f /etc/passwd /sys/mtd2/. [...]
So I suppose some startup script will copy them back.

Hum, I do not have anything in /sys/mtd[12] excepted "mt-daapd.conf" (which i don't care of)
But users of the NAS were persistent over reboot in the past...
I guess we will see after "the" reboot (hopefully the root user won't be deleted, so i can recreate the other users with the same UID then before)

And you just hit a question : how should I turn off my device ?
If i manage to turn it off properly, It may save my "current" configuration (ie almost nothing) and erase my old correct config ?
(By config, I mean /etc/passwd etc.)

Mijzelf · 2012-11-23 13:13:40

Hum, I do not have anything in /sys/mtd[12] excepted "mt-daapd.conf" (which i don't care of)

Did you mount /dev/mtdblock[01] on it? According to the script, it's not mounted by default.

how should I turn off my device ?

The shutdown scripts aren't there, anymore, so I suppose /sbin/reboot won't work (and /lib is also gone). If you can umount your harddisk (don't think so, I suppose you are in a ffp shell), or remount it read-only, you can just pull the plug.

plopiplop · 2012-11-23 15:10:52

I managed to recreate mtds nodes and yes, my config is there !
So i'll just cross my finger and pull the plug

Answer on Monday ! (maybe cry before)

Last edited by plopiplop (2012-11-23 15:11:06)

plopiplop · 2012-11-25 19:15:43

Bad guess, since the reboot, the NAS is somewhere between nowhere and /dev/null...
It do not get it's IP (with my dhcp, configure to give it always the same IP)

However the NAS seems to boot up normally (with fan boost etc) and read disks at the beggining...
The device scan utility of dlink do not find it on my local network.

I tried to hardware-reset it but it do not seems to change anything...
Any ideas of what i can do ? (link it without dhcp, to hope it will get the 192.168.0.32 ip ?)

Mijzelf · 2012-11-25 19:25:57

Sorry to hear that! I wonder if something important was inside /mnt.

Anyway, you could install Wireshark on a PC, connect the NAS directly to that PC, and let Wireshark monitor the network port while the NAS boots up. It has told me the IP address of random devices numerous times.

plopiplop · 2012-11-26 11:48:35

After directly connecting the nas the my PC, it got his 192.168.0.32 IP and... everything was working ! (excepted users which i thing the hardware-reset removed...[Do you know other thing which are removed by that ?])
After telnet and setting root password, I was able to log in again.
So i plugged back my nas to his usual place, and now everything is working again !
Thanks a lot

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2012-11-23 09:55:03

Disaster recovery

#2 2012-11-23 11:08:08

Re: Disaster recovery

#3 2012-11-23 11:21:13

Re: Disaster recovery

#4 2012-11-23 12:18:10

Re: Disaster recovery

plopiplop wrote:

Code:

#5 2012-11-23 12:32:55

Re: Disaster recovery

Mijzelf wrote:

Mijzelf wrote:

Mijzelf wrote:

Mijzelf wrote:

Code:

#6 2012-11-23 13:13:40

Re: Disaster recovery

#7 2012-11-23 15:10:52

Re: Disaster recovery

#8 2012-11-25 19:15:43

Re: Disaster recovery

#9 2012-11-25 19:25:57

Re: Disaster recovery

#10 2012-11-26 11:48:35

Re: Disaster recovery

Board footer