DUAL HDD NAS: Enabling telnet - the other way
The telnet daemon can be legally enabled by the web frontend. The option to do so is *not* visible in the menu but the corresponding page ist existing. To get the page displayed log into you’re NAS device using the web frontend. Assuming that the device has the IP address 192.168.0.13 you can then call the telnet setup page. While logged on chance the URL to
http://192.168.0.13/html/telnet/telnet.html
The next display looks weird, but you if you check the checkbox and press the button telnet is enabled for you. Of course you can disable telnet here, too.
What is following now can be the end of you’re NAS. So be carefull and warned!
After the first “hack” of the firmware ended in a dead box I was more carefull the this time. In the file hddapp.tgz (part of the firmware; this is not a .tgz file but a bzip2 compressed .tar file) the folder “webroot/nav/telnet”, along with the only file “telnet.xml” in it, is missing. On the device the folder is “/usr/webroot/…”. I guess you can image what is the contents of “telnet.xml” once you had a look in a file from on of the other folders. As the webserver is loading the file dynamically you can experiment directly on you’re device. Telnet is working for you!
After adding the “missing” folder and file you can enable/disable telnet comfortably from the “Network Service” menu:
BTW: Every time I enable telnet I also set a password for the root account.
I made myself a new image and flashed. So the option is there after a reset.
Juli 1st, 2007 at 12:49
Followed your article and behold…. I have Telnet access on my NAS:-) Modified the webinterface so I can enable/disable Telnet in a user friendly way. Tx!
I am looking forward to more interesting articles about modding MRT Communication’s Dual HDD NAS.
August 6th, 2007 at 21:34
Hi,
Thanks a lot ! Very good info !
So here’s my contribution : the command-line procedure :
[user@mybox]# telnet NAS-IP-ADRESS
nas-1> mkdir /usr/webroot/nav/telnet
nas-1> cd /usr/webroot/nav/telnet
nas-1> echo ” > telnet.xml
nas-1> exit
[user@mybox]#
That’s all folks !
Samuel
PS : don’t forget to issue a ‘passwd’ to update your root password !
August 7th, 2007 at 00:49
hum,
well,
it seems that i kill my box…
I have dowload :
http://svp.co.uk/helpdeskbigfiles/CentriNAS_v2_3_3a.tar.gz
I have update hddapp.tgz : I have uncompress the file, add the folder “webroot/nav/telnet”, and the telnet.xml file. I have recompressed file in tar.bz2 format, renamed hddapp.tgz.
I have update softwareVersion=”2.3.3a1″ line in th eImageInfo file.
Then I’ve recompressed all the firmware as CentriNAS_v2_3_3a1.tar.gz
but … 25 min after the firmware update … nothing …
argh !
how to restore a running firmware ?
Thanks for help,
Samuel
August 7th, 2007 at 19:24
Hi Samuel,
I’ve killed my box one day. But it’s possible to get it working again. Have a look at Philipps site (see “Some more resources”). A short time after a reboot the device has an open Telnet port on 192.168.2.71 (Port 9000). Using that you’re able to restored the different parts of the flash rom. I did that on my box and now it is working again.
Maybe you ask youself why my box was dead. I’ve flashed a modified firmware which was to large for the flsh rom area so it has overwritten some more bytes.
BTW: Do no flash the bootloader itseld. That’s not necessary and if this goes wrong you device is truely dead.
Good luck,
Tom
August 11th, 2007 at 18:21
Hey you said you made yourself a new image that worked…. ist there a way that you could send it to me or upload it somewhere ??
August 18th, 2007 at 22:24
All right.
Thanks a lot for the help… but I need some more.
Good news : the bootloader is still runnig ! Yes ! The box is alive !
Bad news : I don’t know what to do know …
Witch is the > you’re talking about ???
Or, how to restore the flash rom ?
what I have :
#> telnet 192.168.2.71 9000
Trying 192.168.2.71…
Connected to 192.168.2.71 (192.168.2.71).
Escape character is ‘^]’.
==> enter Ctrl+C to abort booting within 2 seconds ……
^C
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select:
best regards,
Samuel
August 18th, 2007 at 22:26
argh part of my post has been cut :
between
and
please add
August 18th, 2007 at 22:28
Duh !
Am I crazy ?
second post has been cut too ?!?!?
so the text missing is :
Witch is the “”" Philipps site (see “Some more resources”) “”" you’re talking about ???
Thanks,
Samuel
Sorry for the bad post, someone know how to erase it ?
August 19th, 2007 at 12:04
All rigth ! let’s have some fun, ready for flashing the box ?
Here’s the step by step question/answer when you’re connected to the RedBoot.
A last info, each time the redboot has completed a download (Waiting to receive file ….) he will disable the ethernet while flashing, so you will not see the dots progress (wait 1 to 5 min each time, ethernet is automaticaly reactivted by redboot after each flash-session). The ethernet is disable while flashing because of pins-sharing between Flash / IDE / EMAC / PCI / UART / GPIO (http://www.storlinksemi.com/an3316-04.htm). But now, let’s go baby :
root@burg ~ #
root@burg ~ # arping -f 192.168.2.71 ; telnet 192.168.2.71 9000
ARPING 192.168.2.71 from 192.168.2.5 eth0
Unicast reply from 192.168.2.71 [7A:B3:F4:00:01:AC] 6.435ms
Sent 19 probes (19 broadcast(s))
Received 1 response(s)
Trying 192.168.2.71…
Connected to nas.home.fr (192.168.2.71).
Escape character is ‘^]’.
==> enter Ctrl+C to abort booting within 2 seconds ……
^C
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select: 2
4
Name FLASH addr Mem addr Datalen Entry point
BOOT 0×70000000-7001FFFF 0×70000000 0×00020000 0×70000000
FIS directory 0×707F0000-707FFFFF 0×707F0000 0×00001400 0×00000000
Kern 0×70020000-7019FFFF 0×01600000 0×0016FDD4 0×01600000
Ramdisk 0×701A0000-7039FFFF 0×00800000 0×001D9FC6 0×00000000
Application 0×703A0000-707BFFFF 0×00000000 0×0041EB1F 0×00000000
CurConf 0×707D0000-707EFFFF 0×00000000 0×00020000 0×00000000
VCTL 0×707C0000-707CFFFF 0×00000000 0×00010000 0×00000000
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select: 4
Image Name: Kern
Flash Address: 0×70020000
Memory Address: 0×01600000
Entry Point: 0×01600000
An image named ‘Kern’ exists - continue (y/n)? y
1: Download by X-modem
2: Download by TFTP
2
TFTP Server IP Address: 192.168.2.5
Image Path and name(EX. /images/zImage): /zImage
Waiting to receive file ….
-
Raw file loaded 0×01000000-0×0116fdd3, assumed entry at 0×01000000
Erase flash …
… Erase from 0×70020000-0×70190000: …………………..
OK!
… Program from 0×01000000-0×0116fdd4 at 0×70020000: …………………..
OK!
Update FIS …
… Erase from 0×707f0000-0×70800000: .
… Program from 0×00400000-0×00410000 at 0×707f0000: .
OK!
Upload ‘Kern’ code successfully!
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select: 4
Image Name: Ramdisk
Flash Address: 0×701A0000
Memory Address: 0×00800000
Entry Point: 0×00800000
An image named ‘Ramdisk’ exists - continue (y/n)? y
1: Download by X-modem
2: Download by TFTP
2
TFTP Server IP Address: 192.168.2.5
Image Path and name(EX. /images/zImage): /rd.gz
Waiting to receive file ….
\
Raw file loaded 0×01000000-0×011d9fc5, assumed entry at 0×01000000
Erase flash …
… Erase from 0×701a0000-0×70380000: …………………………
OK!
… Program from 0×01000000-0×011d9fc6 at 0×701a0000: …………………………
OK!
Update FIS …
… Erase from 0×707f0000-0×70800000: .
… Program from 0×00400000-0×00410000 at 0×707f0000: .
OK!
Upload ‘Ramdisk’ code successfully!
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select: 4
Image Name: Application
Flash Address: 0×703A0000
Memory Address: 0×00000000
Entry Point: 0×00000000
An image named ‘Application’ exists - continue (y/n)? y
1: Download by X-modem
2: Download by TFTP
2
TFTP Server IP Address: 192.168.2.5
Image Path and name(EX. /images/zImage): /hddapp.tgz
Waiting to receive file ….
-
Raw file loaded 0×01000000-0×0141eb1e, assumed entry at 0×01000000
Erase flash …
… Erase from 0×703a0000-0×707c0000: …………………………………………………………
OK!
… Program from 0×01000000-0×0141eb1f at 0×703a0000: …………………………………………………………
OK!
Update FIS …
… Erase from 0×707f0000-0×70800000: .
… Program from 0×00400000-0×00410000 at 0×707f0000: .
OK!
Upload ‘Application’ code successfully!
Boot Menu
====================================================================
1: Start the Kernel Code
2: List Image
3: Delete Image
4: Create New Image
5: Set IP adderss
6: Setting MAC address
X:Upgrade Boot Y:Upgrade Kernel
=> Select: 1
Wait 5 min … It’s done ! You nas is alive !
Best regards, Samuel
Oktober 31st, 2007 at 18:10
Thanx for this info,
So if something goes wrong installing a new firmware there is the possibility to recover the dual nas device via RedBoot…like in the Fonera
Can you post somewhere the firmware image with telnet page active?
November 5th, 2007 at 11:17
Hi Samuel and thank you very much for the thorough walk-through.
I applied the procedure as you described to restore original FW, but the NAS does not boot, I tried pressing the reset switch for 30 secons (with power on) but no change. Is my NAS definitely dead?
Thanks in advance.
Dezember 26th, 2007 at 23:45
I updatet my dual nas with the latest firmwate G5S52233211.tar.gz from the mrt webside. now the nas is dead. i cannot reach the webinterface anymore. how can i bring my nas back to life?
Januar 5th, 2008 at 19:26
I Update the NAS similar at the PacManMr , I am have a NAS HDD SATA ,the NAS now is DEAD , I Follow the Instruction of Samuel post But the NAS NOT RESPONSE
, Help . Thanks !
Januar 31st, 2008 at 19:34
I Update the NAS similar at the Fabio, PacManMr and ertrax, I am have a DUAL NAS HDD SATA from MRT COMMUNICATION LTD, the NAS now is DEAD , I Follow the Instruction of Samuel post But the NAS NOT RESPONSE
, Help . Thanks !
Februar 14th, 2008 at 19:23
Hello !!!
I update my dual nas with the latest firmware G5S52233211.tar.gz from the mrt webside but the web interface is dead …
The telnet from 192.168.2.71 9000 is OK … I have access …
How to upgrade firmware complete by telnet ?
Or if someone can give me the address list memory (kern, ramdisk, application, curconf …) of the new firmware
Thank … Sorry for my english but i’m french
Februar 17th, 2008 at 00:21
Hey guys,
I brought my NAS back to live.
the IP is OK!
You just have to execute the telnet-prog at the same time like turning your nas ON… Otherwise, your telnet will stay blank.
Cheers
Mai 30th, 2008 at 19:03
Hi. I have a IB-NAS2001. It uses the same firmware as the dual HDD NAS. However my root password does not seem to be blank. Do you know how i can reset it?
Mai 31st, 2008 at 01:57
I’ve figured the problem. See here if you’re interested: http://xanox.net/blog/
Juli 17th, 2008 at 17:54
Hi all,
hi Samuel BURG, could you please tell me approximately how much did it take to download the image to the NAS thru telnet (tftp)?
I have to download an image of 2 megabytes, but the telnet tells me that “Waiting to receive file” and thats it.