Modify Firmware Image to get root SSH access on Buffalo LinkStation LS-WXL Pro
First we download the new Firmware 1.63 from the Buffalo Download Page and extract them as follow:
tux@earth:~$ unzip userfiles_file_downloads_LS-series-fw163_fwwin.zip
Then we create a directory build where we modify the firmware image.
tux@earth:~$ mkdir build
tux@earth:~$ cp ls_series-163/hddrootfs.img build/
Then we go into the build directory and extract the password protected hddrootfs.img image.
tux@earth:~$ cd build/
tux@earth:~/build$ unzip hddrootfs.img
The Password for the firmware 1.63 is YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4. Thanks to stonie!
Now we create a directory rootfs and extract the linux filesystem of the buffalo linkstation.
tux@earth:~/build$ mkdir rootfs
tux@earth:~/build$ cd rootfs/
tux@earth:~/build/rootfs$ tar -vxz --numeric-owner -p -f ../hddrootfs.buffalo.updated
To grand root ssh login we have to modify the etc/sshd_config
. We change the Param PermitRootLogin from no to yes with the vi command or we use the following sed command to comment the Param (default is PermitRootLogin = yes).
tux@earth:~/build/rootfs$ cd etc/
tux@earth:~/build/rootfs/etc$ sed -i 's/PermitRootLogin/# PermitRootLogin/' sshd_config
Next we go into the root HOME directory and create a ~/.ssh
directory and create an ~/.ssh/authorized_keys
file with our public key inside. If you don’t have an ssh key, we create one with the ssh-keygen command. If you only use Windoof to connect via putty to the LinkStation use the puttygen.exe to create your ssh key (the key have to convert to unix). Do not copy & paste the cat ~/.ssh/id_rsa.pub
… command, use your own path to your public key file.
tux@earth:~/build/rootfs/etc$ cd ../root
tux@earth:~/build/rootfs/root$ mkdir .ssh
tux@earth:~/build/rootfs/root$ chmod 700 .ssh
tux@earth:~/build/rootfs/root$ cat ~/.ssh/id_rsa.pub > .ssh/authorized_keys
tux@earth:~/build/rootfs/root$ chmod 600 .ssh/authorized_keys
Now we create a tar archive of our modified rootfs.
tux@earth:~/build/rootfs/root$ cd ..
tux@earth:~/build/rootfs$ tar -vczf ../hddrootfs.buffalo.updated-new *
The original tar archive we rename into hddrootfs.buffalo.updated-old, and the newly created archive we rename into hddrootfs.buffalo.updated.
tux@earth:~/build/rootfs$ cd ..
tux@earth:~/build$ mv hddrootfs.buffalo.updated hddrootfs.buffalo.updated-old
tux@earth:~/build$ mv hddrootfs.buffalo.updated-new hddrootfs.buffalo.updated
We delete the original hddrootfs.img image and pack the new created archiv to hddrootfs.img. On this part we have to use the above password YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4 to encode the image again.
tux@earth:~/build$ rm hddrootfs.img
tux@earth:~/build$ zip -e hddrootfs.img hddrootfs.buffalo.updated
Now we clean the temporary created rootfs directory.
tux@earth:~/build$ rm -rf rootfs
At least we zip the firmware directory to the original name userfiles_file_downloads_LS-series-fw163_fwwin.zip.
tux@earth:~/build$ zip -r userfiles_file_downloads_LS-series-fw163_fwwin.zip ls_series-163