Remote Power off the CH3WNAS

In my previous post, I found out that the CH3WNAS is shutdown by touching a /tmp/shutdown file. It is possible to use the existing web admin pages to trigger a remote shutdown from a script by using 2 wget-commands. One major drawback of this solution is that your admin-password is stored in cleartext in the script.

In this post I show how you can do a remote shutdown via the LAN, without hard coding your admin password. Since this tweak could be misused for a remote DOS attack, make sure you put the CH3WNAS behind a NAT router.

Busybox (activated with the fun_plug script) provides a powerful nc (netcat) command that also has a -l listen mode. This listen-mode is ideal for simple lightweight client/server communication.

Steps for enabling remote shutdown from a script:

• make sure telnet (through busybox) is enabled: http://www.aroundmyroom.com/2008/01/03/ch3wnas-enabling-telnet/
  
  
• create a shutdown_listener.sh script (e.g. with ftp) on the root of HD_a2 with following contents:
  while true
  do
    /mnt/HD_a2/busybox nc -l -p 1234 | while read line
    do
       if [ "$line" -eq "0" ]
       then
         touch /tmp/shutdown
       fi
    done
  done
  This scripts on the NAS listens in a loop on port 1234. When it reads a "0" it puts a /tmp/shutdown file that triggers the immediate poweroff.
  
  
• add the following line to the fun_plug script and restart the CH3WNAS:
  /mnt/HD_a2/shutdown_listener.sh &
  
  
• from the client-side it's enough to create a nc-script that sends a "0" to the NAS.
  on Ubuntu I created a Launcher on my desktop with following command :
  bash -c "echo 0 | nc 192.168.1.30 1234 -w 1"
  
  If you're stuck with Windows, look out for a Windows version of netcat (nc) and put similar commands in a shortcut (cmd /c "..."). Or better, upgrade to Ubuntu :-)

I finally have a script that I can put on all my laptops to trigger a remote shutdown of the NAS. Unfortunately, for powering the device back ON again, you still have to push the powerbutton.

Tweaking the CH3WNAS Power Off

On the CH3WNAS, you have to press the power button for an endless 10s before it finally shuts down. Apparently this 10s delay is determined by the /usr/sbin/chkbutton daemon that polls the power button. There exists a replacement for this process for the dsm-g600 in http://forum.dsmg600.info/t955-chkbutton-replacement.html.
Unfortunately, I couldn't download the attachment to try it out on the CH3WNAS. I asked the author to resubmit his binaries. Maybe for a next post...

There is also shutdown-option in the web-admin pages. After logon, the shutdown is done by firing a POST /goform/sysShootDown request onto the CH3WNAS. After some searching in the sourcecode (download it from the conceptronics' site), I found out that CH3WNAS_GPL/goahead/LINUX/web_api.c handles the shutdown:

void sysShootDown(webs_t wp, char_t *path, char_t *query)
{

if( checkIdleTime(wp) == WEB_IDLE_TIMEOUT )
{

websRedirect(wp, T("web/login.asp"));
return;

}
system("touch /tmp/shutdown");
websRedirect(wp, T("web/tools/shutdown.asp"));

}

--> A simple (but unconventional) touch /tmp/shutdown triggers the shutdown. I suppose it's the same chkbutton daemon process that monitors and picks up the /tmp/shutdown file.


If you need to do a fast remote shutdown, you can exercise the existing web-interface from command line (the wget is standard under linux; under windows, have a look at wget for windows):

wget -o /tmp/test "http://192.168.1.30/goform/formLogin?f_LOGIN_NAME=admin&f_LOGIN_PASSWD=xxx&f_login_type=0"
wget -o /tmp/test2 "http://192.168.1.30/goform/sysShootDown"

Replace the ip & password according to your local setup. Put those commands in a script and you get a simple way to shutdown the unit remotely with a simple double-click. The problem with this code is that you have to put your admin-password in cleartext on your pc. I haven't figured out yet how to circumvent the logon page to remove this security-issue.