F@st 5566 SSH

F@st 5566 SSH

Prior to performing any of the following instructions, back-up your config.

Files

• bellyflop3k.xml maintains the mods necessary to enable admin and root SSH access.
• bellyflop3k.cfg is the compressed and encoded version of bellyflop3k.xml for the purpose of config restoration via the F@st 5566 web UI.

Config Mods

Already applied to bellyflop3k.xml and bellyflop3k.cfg

The F@st 5566 start config requires a single mod to the root and/or admin user accounts for SSH access.

Enable SSH

Enable SSH access on the LAN interface.

<RemoteAccesses element-count="1" new-id="2">
	<RemoteAccess uid="1" Service="SSH">
		<Enabled>true</Enabled>
		<WiFiRestriction>ACCESS_DISABLE</WiFiRestriction>
-		<LANRestriction>ACCESS_DISABLE</LANRestriction>
+		<LANRestriction>ACCESS_ENABLE_ALL</LANRestriction>
		<WANRestriction>ACCESS_DISABLE</WANRestriction>
		<MNGRestriction>ACCESS_DISABLE</MNGRestriction>
	</RemoteAccess>
</RemoteAccesses>

Restore Config

Use web UI

Restore using bellyflop3k.cfg; When asked for a password, enter: admin.

SSH

SSH will use the root password stored in /etc/passwd for 1st access ie. root

upnatom@belfast:~$ sshpass -p 'root' ssh root@192.168.2.1

Semi-Permanent SSH

bellyflop3k.cfg exploits the start config or /opt/squashfs/etc/start-cfg.xml to gain SSH access via restore, and in doing so, overwrites the generated settings retrieved from the permanent parameters.

To keep SSH enabled and also the generated settings, one needs to exploit the restore script.

Copy

Copy all the required files from the read-only fs over to the overlay fs.

root@mynetwork:~# cp /opt/squashfs/etc/start-cfg.xml /opt/filesystem1/rootfs/etc/
root@mynetwork:~# cp /opt/squashfs/etc/init.d/check_restore_default /opt/filesystem1/rootfs/etc/init.d/

Modify

Use vi

Re-enable SSH for both root and admin user accounts in /opt/filesystem1/rootfs/etc/start-cfg.xml

upnatom@belfast:~$ vi /opt/filesystem1/rootfs/etc/start-cfg.xml

--- /opt/squashfs/etc/start-cfg.xml
+++ /opt/filesystem1/rootfs/etc/start-cfg.xml
@@ -7620,7 +7620,7 @@
               <WiFiRestriction>ACCESS_DISABLE_NO_SECURITY</WiFiRestriction>
               <WANRestriction>ACCESS_DISABLE</WANRestriction>
               <MNGRestriction>ACCESS_DISABLE</MNGRestriction>
-              <LANRestriction>ACCESS_DISABLE</LANRestriction>
+              <LANRestriction>ACCESS_ENABLE_ALL</LANRestriction>
             </RemoteAccess>
             <RemoteAccess uid="2" Service="HTTP">
               <Enabled>true</Enabled>
@@ -7670,7 +7670,7 @@
                             <!--<Enabled/>-->
                             <Enabled>true</Enabled>
                             <WiFiRestriction>ACCESS_DISABLE</WiFiRestriction>
-                             <LANRestriction>ACCESS_DISABLE</LANRestriction>
+                             <LANRestriction>ACCESS_ENABLE_ALL</LANRestriction>
                             <WANRestriction>ACCESS_DISABLE</WANRestriction>
               <MNGRestriction>ACCESS_DISABLE</MNGRestriction>
                            </RemoteAccess>

Prevent /opt/filesystem1/rootfs/etc/init.d/check_restore_default from removing /opt/filesystem1/rootfs/etc/start-cfg.xml

upnatom@belfast:~$ vi /opt/filesystem1/rootfs/etc/init.d/check_restore_default

--- /opt/squashfs/etc/init.d/check_restore_default
+++ /opt/filesystem1/rootfs/etc/init.d/check_restore_default
@@ -19,7 +19,7 @@
        if [ -f $SYSCONF_DIR/conf_erased ]; then
         cp $SYSCONF_DIR/scratchpad /opt/data/scratchpad
        rm -fr $SYSCONF_DIR/* 2> /dev/null
-        find /opt/filesystem2/rootfs -type f | xargs rm -f
+        find /opt/filesystem2/rootfs -type f | grep -vF -e "/etc/start-cfg.xml" -e "/etc/init.d/check_restore_default" | xargs rm -f
         find /opt/filesystem2/rootfs -type l | xargs rm -f
 # to be used by mgmt-smu and removed
                  touch /opt/filesystem1/rstdone

Dump PP

It's imperative to retrieve the root password prior to a factory reset from the permanent parameters; It's stored as clear-text under VENDOR_INFO1.

root@mynetwork:~# get_pp all

Optionally, modify the root password, eg. root

Not Recommended

root@mynetwork:~# get_pp all | sed "/VENDOR_INFO1=/c\VENDOR_INFO1=root" > /tmp/pp
root@mynetwork:~# write_pp.sh /tmp/pp
root@mynetwork:~# rm -f /tmp/pp

Factory Reset

Use the web UI whenever possible, or...

root@mynetwork:~# xmo-client -x restore-partial

Verify SSH

upnatom@belfast:~$ sshpass -p 'pp_root_password' ssh root@192.168.2.1

Backup Gen Config

upnatom@belfast:~$ scp root@192.168.2.1:/opt/conf/backup-cfg.xml.stable ~/

Create restore config

https://github.com/up-n-atom/gsdfcrypt/releases/tag/v1.2

upnatom@belfast:~$ gsdfcrypt -c -k 128 -p admin ~/backup-cfg.xml.stable ~/backup-cfg.cfg

Trigger TR-069

Navigate your ISP walled garden.