Search the Community

Привет. Принес сотрудник на работу флешку в локальную сеть, там был вирус, с его рабочего компа вирус может добраться до открытых портов самбы на DSM Sinology, провести шифрование. Может, если там есть уязвимость. Вот, разработчики самбы выпустили обновление для нее https://www.samba.org/samba/history/security.html Есть опыт установки патча?

After fiddling with it for a day, and getting it to work, I thought it would be nice to share the knowledge, especially since "officially" only ESXi is supported, and ESXi is picky about supporting stuff... The main reason for me to move to a hypervisor was because Synology has not yet introduced NVMe support AT ALL. And even with a kernel driver, the Storage Manager will not see it as an SSD, as an HDD, or anything. Synology is silent about this, even though some have requested it on their forums (although they do not have a model with M.2 NVMe connector yet, they have some models with full sized x16 or x4 PCIe ports, which can be used with an adapter card for NVMe). So I decided to try with a hypervisor. On one hand it makes installation easier, upgrading also, and I don't need a display connected (since most hypervisors provide a VNC connection to the guest OS). On the other hand, I can install the measly 2-3GB hypervisor and all the tools on the NVMe SSD, and have the rest mounted as a VMDK (or any other virtual disk file). The rest of the hard drives would use passthrough of course. I fiddled around with multiple options. XenServer simply refused to boot in UEFI mode, ESXi does not support my network adapter, or my built-in SATA controller (B250 chipset), Microsoft's Hyper-V server has issues if you do not have a domain server on the network, also as soon as the display output goes off, the device drops network connection. It left me with Proxmox. Never used it, and during installation I had some issues with the bootloader (both on 4.4 release and 5.0 beta). Luckily there's a workaround, since it is based on Debian, one can use the Debian netinst image, create a very basic system, and install Proxmox on top. I won't bore you with the details, there are enough guides about installing it to make me think twice before I write an (n+1)th version. So let's begin! Requirements: A working install of Proxmox 5.0 - it can be 4.4 too, but I only tested this on 5.0. Follow the guide to create the bridged network interface! The loader you wish to use. I recommend Jun's Loader, specifically 1.02a2 at the time of the writing of this guide. Steps: 0. Edit the loader (if needed) to your liking - MAC address, serial number, etc. This is especially important if you have multiple XPE systems on the same network. 1. Create a new VM in Proxmox. 1.1 Set the name, and make sure to note down the VM ID (if it is your first VM, it should be 100). I'll be using {VM_ID} as a placeholder from now on. 1.2 OS type should be "Linux 4.x/3.x/2.6 Kernel". 1.3 Set the CD/DVD to "Do not use media" (we will remove the virtual disk drive any way later on). 1.4 For the HDD, you should create a new virtual disk with the format of your liking (qcow2, vmdk or raw), this will be the initial drive. I made sure that it uses nearly the whole storage of the OS drive it was installed on (in my case it was a 256GB NVMe SSD, which, after setup and partitioning, resulted in a 226GiB root drive, of which I had 211GB free, so I set the virtual disk's size to 200GB). You can set it to any kind of bus, EXCEPT VirtIO. With VirtIO I had performance issues, so I went with SCSI (it supports up to 12 devices any way, so it is better). This is for the virtual disk only, VirtIO works just fine with passthrough devices. So apart from the bus, size and format, you don't need to touch a thing. 1.5 For CPU, set kvm64 with as many cores as your host has (incl. virtual cores if you're on a HyperThreading supported CPU!). In my case with the Intel G4560 this is 4. 1.6 For RAM, you should leave some slack for the host OS, I went with 7.5GB from the 8GB I have. Ballooning is not required. 1.7 Networking. This is where many things can go wrong. The VirtIO paravirtualized network adapter should work, but to be safe I went with the Intel E1000. On the left select Bridged Mode, with the previously created bridge as the first choice. You can also enable Firewall if you do not trust Syno's own. Leave the rest of the settings as default. 1.8 On the Confirm page, confirm your settings and create the VM. 2. After the VM is created, first thing to do is to remove the virtual disk drive (IDE 2, if everything went right). Then comes the hard part. 3. You have to add each and every HDD to the config file that you want to use for passthrough. The command is simple: qm set {VM_ID} -[protocol][port] /dev/disk/by-id/[disk-id] The {VM_ID} part is obvious, but what about the rest? [protocol] is the connection protocol you want to use. This can be sata, ide, scsi or virtio. I'm using SATA here, but you can use anything (IDE is not IDEal for us). SATA supports up to 6 devices (port indexes 0-6), scsi supports up to 12 devices, and virtio does not have a limitation to my knowledge. [port] is the first unused port of said protocol. E.g. if you set the initial disk during setup to SATA0, and you want to use SATA further here, you have to start numbering from 1. [disk-id] is the unique identifier of your HDD. Go to /dev/disk/by-id/ and list the disks you see. For most SATA devices, you'll see entries like "ata-[MANUFACTURER]_[MODEL]_[sERIAL]". So let's say I have 4 disks, with the disk-id's ata-1, ata-2, ata-3, and ata-4 (yours will be a lot longer, but don't worry, you can use the bash autocomplete with the tab key). For this to work I execute the following commands: qm set 100 -sata1 /dev/disk/by-id/ata-1 qm set 100 -sata2 /dev/disk/by-id/ata-2 qm set 100 -sata3 /dev/disk/by-id/ata-3 qm set 100 -sata4 /dev/disk/by-id/ata-4 Of course later on you can add further HDDs to a VM config by using the same command, just keep in mind the limitations of the protocols. 4. Now comes the hard part, we'll have to add the bootloader image file to the config. The config file is located under /etc/pve/qemu-server/, and is named {VM_ID}.conf. Open it with nano. This config file defines everything about the VM. Disks to mount, which device to use for booting, RAM amount, CPU cores, name of the VM, et cetera. Don't touch anything else than the lines you see here! Copy the synoboot.img to somewhere on your server. If you want to be consistent with the Proxmox setup, copy it under /var/lib/vz/images/{VM_ID}/ - you'll need root for that. After that, come back to the conf file, and open it again. You'll enter a few things here, make sure you pay attention! Enter the following line into the conf file, and make sure you replace the parts in the path! args: -device 'piix3-usb-uhci,addr=0x18' -drive 'id=synoboot,file=/var/lib/vz/images/{VM_ID}/synoboot.img,if=none,format=raw' -device 'usb-storage,id=synoboot,drive=synoboot' Make sure to replace the path to the synoboot.img with your own! One more thing to edit here, the boot device. Find the line that begins with "boot: " and replace it so it looks like this: boot: synoboot Save the file, then start the VM. It should start up without an issue, and you'll be able to use find.synology.com to find your server and install it.

I created a tutorial for the French section so I thought, what the heck, let's do it for the English one as well. Here it goes. As most of you know by now Jun was able to find a way to install DSM 6 on non Synology boxes. Here is the thread that I recommend reading. At least make an effort and read the OP: https://xpenology.com/forum/topic/6253-dsm-6xx-loader/ Below is what you need for the operation. I will assume you are doing all this under Windows 10, 8, 7 or XP. If you are on a MAC computer have a look at this post I made on how to burn the image to a USB drive and then mounting the USB drive for editing the content. The rest of the tutorial still applies. If you are currently using DSM 5.1 or below first update to DSM 5.2. If you are doing a fresh install of DSM 6.0 then carry on with the tutorial and omit references to DSM 5.2. - Win32 Disk Imager to make a bootable USB drive; - A 4GB (or any size really) USB drive (flash drive) to install the loader. Not that this is necessary but use preferably a brand name (Kingston, SanDisk...); - A way to read your USB drive VID/PID. Here is a how-to >>> VID and PID; - A good text editor: Notepad++ I really don't recommend using Windows's Notepad; - DSM 6.0.2. The file comes straight from Synology servers; - Jun's official v1.01 loader (mirror). This is a hybrid UEFI/BIOS loader so it should work in most machines. Loader supports Intel and AMD CPUs; - Customized extra.lzma ramdisk. This ramdisk is optional and should only be used if the default ramdisk included in the loader is not detecting your hardware. I am just providing it for those who are having issues with network detection or unrecognised HDD controllers. This custom ramdisk contains additional modules (drivers) that were mostly taken from Quicknick's loader. I don't warranty they all work but I think most do. If you chose to use this ramdisk, you will need to replace (or rename, so you can revert) the default extra.lzma ramdisk from Jun's loader with this one. See change log at the end of the tutorial for additional modules. - Make sure your drives are plugged in direct succession starting from the 1st SATA port. Usually the first port is described as SATA0 on motherboards. Check with your MB manufacturer for exact nomenclature. - OSFMount to modify the grub.cfg file within the loader's image. This is not strictly necessary as Jun has made it possible to configure what needs to be modified via the Grub Boot Menu. I recommend you use OSFMount for now although it adds an extra step. If you prefer using Jun's new feature simply skip Point 5, read Note 4 instead and pick up at Point 6. PLEASE READ EVERYTHING PRIOR ATTEMPTING ANYTHING Use this loader at your own risk. I wont be held responsible for any loss of data or black smokes that may result in the use of this loader. Please note that this loader is based on DSM 6.0 Beta 2 branch 7274 and that a limited amount of drivers are included in the loader. If it is fundamental for you to have a NAS operating as quick as possible I recommend you look at the included drivers first at the bottom of this tutorial. If they are not there you will have to compile your own drivers. One last thing: DO NOT UPDATE DSM BEYOND VERSION 6.0.2 (6.0.3, 6.1, 6.1.X, 6.2) with loader v1.01. You have been warned. Here we go: 1 - BACKUP your data and save your configuration prior any attempts to migrate from DMS 5.2 to DSM 6.0.2. I can't stress this enough. JUST DO IT, as Nike likes to say. Also, print this tutorial if you can. It will make your life easier. 2 - Turn off your NAS and unplug the USB drive you are currently using with DSM 5.2. I recommend you put this USB drive aside in case migration to DSM 6.0.2 doesn’t go as expected and you need to revert to DSM 5.2. It will just make your life easier. 3 - Now go to your workstation/PC, plug a new USB drive (or the old one if you really don’t have any spare USB drives). Use the link I provided earlier to check your USB drive VID/PID. Write down the info somewhere as we will need it later. 4 - Unzip the loader you downloaded earlier. You will end up with a folder containing several files. Since we are installing on bare-metal you will only need the image file "synoboot.img". 5 - Now launch OSFMount. Select Mount New, then select the image file (i.e. synoboot.img) to open. Now select partition 0 (the one that is 30 MB). Click Ok. Then at the bottom of the window make sure to un-tick the "Read only drive". Click Ok. The EFI partition of the image file should now be mounted in file explorer. At this point you can navigate to the /image/DS3615xs directory and replace the extra.lzma ramdisk with the one provided above. When you are done come back to the root directory and go to the /grub directory and edit the grub.cfg file. Below is what you will see in the file. I am only showing below the portion of the code that is relevant for the purpose of this tutorial [...] set extra_initrd="extra.lzma" set info="info.txt" set vid=0x058f set pid=0x6387 set sn=C7LWN09761 set mac1=0011322CA785 set rootdev=/dev/md0 set netif_num=1 set extra_args_3615='' set common_args_3615='syno_hdd_powerup_seq=0 HddHotplug=0 syno_hw_version=DS3615xs vender_format_version=2 console=ttyS0,115200n8 withefi elevator=elevator quiet' set sata_args='sata_uid=1 sata_pcislot=5 synoboot_satadom=1 DiskIdxMap=0C SataPortMap=1 SasIdxMap=0' set default='0' set timeout='1' set fallback='1' [...] You want to modify the following: Change vid=0x090C to vid=0x[your usb drive vid] Change pid=0x1000 to pid=0x[your usb drive pid] Change sn=C7LWN09761 to sn=generate your sn here with DS3615xs model Change mac1=0011322CA785 to mac1=[your NIC MAC address]. You can also add set mac2=[your NIC MAC address #2] and so on until mac4 if you have multiple NICs. However, this is not necessary. Optional: Change set timeout='1' to set timeout='4' - This will allow you more time to make a selection in the Grub Boot Menu when it appears. Once you are done editing the grub.cfg file, save it and close your text editor. Now in OSFMount click on Dismount all & Exit. You are now ready to burn the image to your USB drive. 6 - Now use Win32 Disk Imager to burn the image file onto the USB drive. This will also make the USB drive bootable. 7 - Eject and unplug the USB drive from your workstation. Plug it in your NAS (avoid USB 3.0 ports. Use USB 2.0 port if available). Boot your NAS and before doing anything fancy, access your BIOS so to make your USB drive the 1st boot drive if it's not the case. The loader can boot in UEFI or in legacy BIOS, so you chose what suits you best. Also, make sure your HDDs are booting in AHCI mode and not in IDE, else it wont work. Finally, if disabled, also enable the serial port in BIOS. Some BIOS don't have this option so don't get too cranky on this if you can't find it. Save changes to the BIOS and REBOOT the NAS. 8 - Once rebooted, if you have a monitor connected to your NAS you will see the following Grub Boot Menu: If you are on an Intel based machine you can simply let it be and the loader will automatically start. However, if you are on a AMD based machine you will need to select the 4th line and then press enter. ADVICE: even before you see the Grub Boot Menu press the up/down key. This will stop the countdown so you will be able to select the desired line. You won’t see much other than the following after you press enter: If you booted the USB drive in EFI mode then you will see the same text without the last 3 lines but that's ok. 9 - Now go back to your workstation, and launch Synology Assitant or go to http://find.synology.com. Within one minute or so you should normally be able to see your NAS on the local network (it took 55 seconds on a test I did on a VM). Just follow the instructions and either chose "Install" if you wish to have a clean install or chose “Migration” if you are coming from DMS 5.2 and wish to update while retaining your data. You will be asked to provide the .PAT file you downloaded earlier (DSM_DS3615xs_8451.pat). 10 - When the migration is finished you will most probably have to update some of your packages. You can then proceed and update DSM 6.0 up to DSM 6.0.2-8451 update 11. It is possible you might either need to hard reboot or re-image your usb drive. DO NOT UPDATE DSM TO VERSIONS 6.0.3, 6.1, 6.1.x, 6.2, with loader v1.01. Make sure to deactivate auto-updates within DSM. 11 - You are done. If you have questions, first search the forum and/or Google then leave a comment if nothing helps. Please provide your hardware specifications (motherboard model, LAN controller, driver controller etc). Failure to prove such information will lead to the post being deleted. -------------- Note 1: If after following the tutorial you can’t find your NAS through http://find.synology.com ou Synology Assistant it is highly possible that the drivers of your NIC are not included in the ramdisk of the loader. Make an effort and use Google to know what modules your NIC and HDD controller are using, then check if those modules are included in the custom extra.lzma ramdisk. If yes then use the custom ramdisk. Don't ask me to look for you. If nothing works then ask your question. Note 2: Synology increased security in DSM 6. Root access through SSH is no longer available out of the box. You can however use your admin account and elevate permissions with the following command sudo -i Note 3: Please check you have the right VID/PID prior proceeding. If you get the following error ”Failed to install the file. The file is probably corrupted. (13)" it means your VID and/or PID is wrong. If you are 200% sure that your VID/PID is correct and you still get that error message then try to 'Force Install'. If that doesn't work then try another USB drive. Note 4: Changes made to the grub.cfg file can also be done directly during the Grub Boot Menu, so technically you can skip Point 5 and burn the image on the USB drive without editing anything (read Point 6 onward first). If you wish to do the changes from the Grub Boot Menu directly you need to press the letter 'C' when you see the Boot Menu. You will literally only have one second, so be fast. Once you press C you will be in a Grub command line environment. To change your VID enter the following: vid 0xYOUR 4 DIGITS USB DRIVE VID Do the same for pid, sn and mac1. Press enter at each command. The commands are: pid 0xYOUR 4 DIGITS USB DRIVE PID sn YOUR NAS SERIAL NUMBER mac1 YOUR NAS MAC1 ADDRESS If you have multiple NICs you can also issue mac2, mac3 and mac4 as commands. Maximum is mac4. See below: mac2 YOUR NAS MAC2 ADDRESS mac3 YOUR NAS MAC3 ADDRESS mac4 YOUR NAS MAC4 ADDRESS If you think you made a mistake in the numbers simply re-issue the command. When you are done press esc and select the appropriate menu entry. Below is an example of how it looks under the Grub command line environment: Note 5: If your encounter the error "We've detected errors on your hard drives [drive number] and the SATA ports have also been disabled" during installation, try the Force Install menu entry in the Grub Boot Menu. If this does not work then you have to fallback to adding SataPortMap to the grub environment. Press the letter 'C' at the Grub Boot Menu and then add the following: append SataPortMap=XX where XX is the number of drives. Don’t forget to update this parameter if you add additional drives to your machine. If you use Force Install, don't forget to re-select the first line of the Boot Menu once the NAS has rebooted after the installation else the Loader will re-select Force Install and you will be faced with some issues so please beware of this. @@@@@@@@ What does SataPortMap mean? @@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############## Know issues ##################### - When running on a slow single core machine, there is a race condition that causes the patcher to load too late. The most obvious sign is that console is not working properly. - Some ethernet drivers crash when set MTU above about 4096 (Jumbo frame). ############# Included default modules in Jun's Loader ############# ############# Additional modules in the custom extra.lzma ramdisk ############# ############## Tutorial UPDATES ##################