Root / su recovery for Seagate Central

Many people have lost root access to their Seagate Centrals after a particular firmware upgrade. Here I attempt to provide a procedure to recover root access that is as painless as possible. Note that there are a few alternative procedures posted elsewhere on the internet however my procedure has the advantage over the others that it does NOT require access to an external linux system because it makes use of the linux software running on the Seagate Central itself. It also does NOT require you to crack open the Central and take out the hard drive.

I'm assuming that you have a little bit of pre-requisite knowledge before we begin. Namely …

• You know how to establish an ssh session into your Seagate Central (If you don't then why do you want root access?)

• You know how to transfer files between your external computer and your Seagate Central. (If you don't then what are you using a Seagate Central for??)

• You understand a few basic computer file concepts like "files", "directories", "copying", "zipping" and "editing". (If you don't then, Hello there Grandma Jones! I'm thrilled that you're reading my blog!!)

Part 1 : Try to revert to the "old" firmware.

If you have a non blank root password, and if the previously running firmware on your Seagate Central did have sudo/root access enabled then first try the procedure in the previous blog post called "Revert to previous firmware on Seagate Central" and then proceed to "Part 3 : Make sure root access is enabled from now on". If reverting to the old firmware doesn't work then proceed to Part 2 below. 

Part 2 - Create then load a modified firmware image

In this part we are going to take a Seagate Central firmware image, modify it to remove the "su" disabling functionality, and then load it back onto the Central. Our friends at Seagate might be somewhat alarmed by this step but I hope they come to the conclusion that anyone who is technically literate enough to perform this procedure is probably trustworthy enough to deserve "su" access to their beloved Central. In addition I think the spirit of the GNU General Public Licences which Seagate uses extensively for software in the Central product means that the software should be able to be improved and modified which is what we're doing here.

Note this procedure involves running a number of linux/unix commands. I have developed this method on the assumption that we are going to perform this procedure using the linux system running on the Central itself. You can use an external linux box to perform these steps however I think that for many people who have a Seagate Central, the Central may be the only linux system they have easy access to!! That is why this technique makes use of the Central itself and not an external system.

Step 1 : ssh into the Seagate Central. In this procedure I use the "admin" account but you can use any existing username you've set up on the system.

Create a new directory to perform our procedure in and navigate to that directory. In this example we create a new directory called "firmware".

admin@Seagate-5A4B6C:~$ mkdir firmware

admin@Seagate-5A4B6C:~$ cd firmware

admin@Seagate-5A4B6C:~/firmware$

Step 2 : Obtain a copy of your desired version of Seagate Central Firmware and upload it to the new folder on the Central.

I got my firmware by navigating to the Seagate Download finder tool at https://apps1.seagate.com/downloads/request.html and entering the required details. You need to enter your Seagate Central's serial number and what country you live in and then you'll be given a download link.

In the example shown here I downloaded a file called Seagate-HS-update-201509160008F.zip . You have to decompress/unzip this file to get an "img" file. You can do this on the PC you downloaded the file to and then transfer the "img" file to the new "firmware" folder on the Seagate Central or you can upload the zip file to the new "firmware" folder on the Seagate Central and decompress it on the Central.

admin@Seagate-5A4B6C:~/firmware$ unzip Seagate-HS-update-201509160008F.zip

Archive:  Seagate-HS-update-201509160008F.zip

  inflating: ReadMe.pdf

  inflating: Seagate-HS-update-201509160008F.img

Confirm that the image is in the "firmware" folder.

admin@Seagate-5A4B6C:~/firmware3$ ls -l *.img

-rw-r--r-- 1 admin admin 130199138 Nov 17 21:52 Seagate-HS-update-201509160008F.img

Step 3 : Obtain a copy of the squashfs-tools for Seagate Central.

I have compiled binary versions of these tools (version 4.3) for the Seagate Central and made them available at the following links

https://sites.google.com/site/seagatecentralenhancementclub/squashfs-tools/mksquashfs

https://sites.google.com/site/seagatecentralenhancementclub/squashfs-tools/unsquashfs

If you don't trust my binaries (I swear I stopped spying for North Korea months ago) and want to make them yourself then you can obtain the source code from the squashfs-tools homepage at http://squashfs.sourceforge.net/ . You can also find instructions for compiling binaries for the Seagate Central using an external linux system at https://sites.google.com/site/modcentralnas/ .

You can use your external PC to obtain these binaries and then upload them to your Central or if your Seagate Central has internet access then you can download the files directly to the Central by running the "curl" commands as follows.

admin@Seagate-5A4B6C:~/firmware$ curl -L -O https://sites.google.com/site/seagatecentralenhancementclub/squashfs-tools/mksquashfs

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

100  343k  100  343k    0     0  60087      0  0:00:05  0:00:05 --:--:--  288k

admin@Seagate-5A4B6C:~/firmware$ curl -L -O https://sites.google.com/site/seagatecentralenhancementclub/squashfs-tools/unsquashfs

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

100  257k  100  257k    0     0  48704      0  0:00:05  0:00:05 --:--:--  299k

Now change the attributes of the files so that they are executable

admin@Seagate-5A4B6C:~/firmware$ chmod a+x mksquashfs

admin@Seagate-5A4B6C:~/firmware$ chmod a+x unsquashfs

Note : If you are performing this procedure on an external Linux system instead of on the Central then you'll have to get the version of the squashfs-tools for your particular linux distribution. You can't run the binaries seen above, they only work on the Seagate Central.

Step 4 : The Seagate firmware image is in gzipped tar format. Decompress the image with the following "tar" command. This takes about 30 seconds to complete.

admin@Seagate-5A4B6C:~/firmware$ tar -zxpvf Seagate-HS-update-201509160008F.img

rfs.squashfs

uImage

config.ser

Step 5 : Extract the new firmware's filesystem.

Here we use the unsquashfs tool you downloaded in Step 3 to extract the file system contained in the Seagate firmware image. Note that this can take about 500M of disk space! This takes about 2 minutes to complete.

admin@Seagate-5A4B6C:~/firmware$ ./unsquashfs rfs.squashfs

You may see some error messages similar to the following. Just ignore them.

create_inode: could not create character device squashfs-root/dev/apm_bios, because you're not superuser!

You should now have a new directory called "squashfs-root" in your firmware folder. This contains the new filesystem that we are going to modify.

Step 6 : On many linux systems, including the Seagate Central, access to the "su" command is governed by the "/etc/pam.d/su" configuration file.

In the new Seagate Central firmware there is a section in this file which disables "su" access for regular users as follows…

# Uncomment this if you want members of a specific group to not

# be allowed to use su at all.

auth       required   pam_wheel.so deny group=users

We need to re-enable root access for normal users by editing this file in the new firmware. Here we use the "nano" editor as follows.

admin@Seagate-5A4B6C:~/firmware$ nano squashfs-root/etc/pam.d/su

Once the editor is open scroll down about 20 lines to the text as seen above and add a "#" to the start of the "auth  required" line to comment it out and disable it. After making the change the section looks like this

# Uncomment this if you want members of a specific group to not

# be allowed to use su at all.

#auth       required   pam_wheel.so deny group=users

Save your changes by typing Control-X to exit, then answering "Y" when you're asked to "Save modified buffer" and pressing enter to confirm the "File Name to Write".

Step 7 : If you have a blank root password the new firmware will reset it to a secret value each time the system boots with the startup script  "/etc/init.d/finish"

Here we will change this behaviour so that instead of using a secret value, we use a known value. In this example we set the root password to "test123". Obviously change "test123" to something unique for your system. We edit the "finish" startup script as follows

admin@Seagate-5A4B6C:~/firmware$ nano squashfs-root/etc/init.d/finish

Once the editor is open scroll to the very bottom of the file and add the following lines to the end of the file.

# Is the root password set as blank?

if grep -q "^root:x:" /etc/passwd

then

# Change the root password to test123.

    echo "root:test123" | chpasswd

# Make sure the changes are in the Central's backup config folder.

    rsync -Rva /etc/passwd /usr/config/backupconfig

fi

Save your changes by typing Control-X to exit, then answering "Y" when you're asked to "Save modified buffer" and pressing enter to confirm the "File Name to Write".

N.B. You might think it's a bit insecure setting the root password to a value just specified in a script file. Well it is! That's why in Step 10 we change the root password again to something else.

Step 7.5 : Make sure that the "sudo" and "su" commands have the correct unix file attributes.

In some versions of Seagate Central firmware the "sudo" and "su" commands do not have the required "read" and "set userID" file attributes set.

This isn't the case in all versions of firmware but just to make certain run the following commands.

admin@Seagate-5A4B6C:~/firmware$ chmod 4555 squashfs-root/usr/bin/sudo 

admin@Seagate-5A4B6C:~/firmware$ chmod 4555 squashfs-root/usr/bin/su         

To check that the changes have taken affect run the following "ls" commands and check that the "r" (readable) and "s" (set userID) bits as seen below are present for each file.

admin@Seagate-5A4B6C:~/firmware$ ls -l squashfs-root/usr/bin/su

-r-sr-xr-x 1 admin admin 23692 Sep 17 09:06 squashfs-root/usr/bin/su

admin@Seagate-5A4B6C:~/firmware$ ls -l squashfs-root/usr/bin/sudo

-r-sr-xr-x 1 admin admin 87316 Sep 17 09:06 squashfs-root/usr/bin/sudo

Step 8 : Run the following commands to create a new firmware image called Seagate-allow-root.img. Note that the first command (mksquashfs) takes about 5 minutes and the second (tar) takes about 3 minutes to complete. Also note that we are using the least powerful compression-level (1) in the mksquashfs command because this lets the command run most quickly. You can use any number up to the most powerful compression level "9" however the command could then potentially take hours to run for the sake of saving maybe only a few megabytes.

admin@Seagate-5A4B6C:~/firmware$ ./mksquashfs squashfs-root rfs.squashfs -all-root -noappend -Xcompression-level 1

admin@Seagate-5A4B6C:~/firmware$ tar -cvzf Seagate-allow-root.img rfs.squashfs uImage config.ser

Step 9 : Upgrade the Seagate Central with the new firmware.

First, and this bit is optional, I'd suggest copying your newly created firmware, "Seagate-allow-root.img", to your local PC harddrive. It will be about 140MB so if you don't want to use up the space then don't worry about it.

Next start the upgrade procedure by logging in as admin to the Seagate Central management web page in your web browser, and navigating to the "Settings" Tab, then the "Advanced "menu, then the "Firmware Update" page.

From here click on the "Browse" or "Choose file" button and in the file dialogue box that appears navigate to the new software you've created "Seagate-allow-root.img". Now click on the "Install" button and let the upgrade process commence. The management web page should show a progress bar as the upgrade proceeds.

If you like you can get a scrolling live log of the progress of the upgrade by running the command "tail -f /var/log/syslog" in an ssh session on the Central while the upgrade is occurring. Hit Control-C to stop viewing the log. Most of the output of the log is useless but if you see something that is obviously indicative of an error or a problem then perhaps you can cut and paste it and add it as a comment to this blog post so we can take a look.

It took the firmware upgrade on my test Central system about 30 minutes to complete. Also it seemed to be stuck at the "86%" mark for ages according to the progress meter on the management webpage.

Once the system has booted up your new firmware should be running and you should have root access again.

Part 3 : Make sure root access is enabled from now on

Step 10 : If your root password has been changed to "test123" as per "Step 7" then you should change your root password to something else because any user can look at that /etc/init.d/finish script and see that the root password could be changed to that. Do this by logging in as root and running the following commands. 

Seagate-5A4B6C:~$ su root

Password: test123
Seagate-5A4B6C:/Data/admin# passwd

Enter new UNIX password: I-love-my-Central

Retype new UNIX password: I-love-my-Central

passwd: password updated successfully

Seagate-5A4B6C:/Data/admin# cp /etc/passwd /usr/config/backupconfig/etc/

Seagate-5A4B6C:/Data/admin# cp /etc/shadow /usr/config/backupconfig/etc/

Step 11 : Make sure "su" is enabled from now on. Even after another firmware upgrade.

The Seagate Central stores a backup of all it's important configuration files in the "/usr/config/backupconfig" folder. Every time the central boots up it copies the contents of this folder to the root filesystem. If you want to see the details then have a look at the "/etc/init.d/firmware-init-1bay" startup script on the Seagate Central.

Incidentally this is why some people complain that when they set a root password on the Central it reverts to blank or the old password after a reboot. You have to make sure that your password changes are reflected in the "/usr/config/backupconfig" folder as well as the normal locations otherwise they'll be overwritten on a reboot.

The way the new Seagate Central firmware disables "su" access is by changing the "/etc/pam.d/su" file. (See Step 6 for details)

At this point, because we have root access now, we know that the system is using a version of the "/etc/pam.d/su" file that works properly.

What we want to do is copy this working version of "/etc/pam.d/su" to the "/usr/config/backupconfig" folder so that each time the Seagate Central boots up this "good" version of the file is restored even if a firmware upgrade tries to modify it.

As root run the following commands

Seagate-5A4B6C:~# mkdir -p /usr/config/backupconfig/etc/pam.d

Seagate-5A4B6C:~# cp /etc/pam.d/su /usr/config/backupconfig/etc/pam.d/

Note that from now on if you decide to modify the "/etc/pam.d/su" file for any reason, say to restrict "su" access to certain users, you'll have to remember to copy the changes to the "/usr/config/backupconfig/etc/pam.d/su" file as well otherwise your changes will be lost on reboot.

Conclusion

If you have performed the procedures above but still can't get root access then please let me know at what point things seemed to fail and any relevant details. I'm keen to make this procedure work for everyone. In addition if you notice any errors, things that need correcting, or suggestions to improve this procedure then I'm keen to hear about that too.

Just to briefly mention, if things have failed there is yet another alternative. You can crack open the Central (goodbye warranty), take out the hard drive and mount it on an external system, manually modify the files we manipulated above (init.d/finish  pam.d/su) as per the steps above, then put the drive back into the Central. You can certainly do this with a linux system and possibly even a windows system (maybe). If there's anyone who needs a procedure to do that then let me know and I'll try to write one up.

Finally there is one rather clever alternative procedure for creating the modified firmware as we did in Part 2. It makes use of an automated script running on an external linux system. You can find that here

https://github.com/detain/seagate_central_sudo_firmware

Good luck!

Edit 3-Aug-2017 : Modified Part 3 Step 10 to add copying the "/etc/shadow" file to /usr/config/backupconfig/etc  after you change your root password as well. SFAIC