Sq-040400-308-20150924 lost SSH access

Legacy Products My Cloud OS 3
1

Updated to the latest firmware, sq-040400-308-20150924,  today and as usual I got the host key failure warning. I went ahead and removed the key etc. However now I am unable to ssh with any of the accounts. I even tried disabling ssh and re-enabling and trying it again with the “root/welc0me” account and no dice. Tried the old password as well and nothing. The dashboar/UI works fine with the same passwords. Anyone else having this issue?

$ ssh root@wdmycloud.local
root@wdmycloud.local's password:
Permission denied, please try again.  

I did a support dump via the dashboard and the logs are showing this: Could the default password have changed from “welc0me” ??

2015-09-29T07:50:53.014672-07:00 di=Dnez1cV4jl info sshd[15634]: Failed password for root from X.X.X.X port 64666 ssh2
2

Could the default password have changed from “welc0me” ??

The release notes hint that this is probably the case: go to the Dashboard, disable and re-enable SSH access, and I suspect it will ask you to enter a password, other than the default ‘welc0me’, which was (sensibly) perceived as a security threat:

“Addressed known command injection, SSH default password and CSRF security vulnerabilities”

3

Yeah that is what I thought as well but nope. It does not prompt you just displays the generic root/welc0me user/password prompt.

4

You always used to be able to change the password. Have you tried that?

I haven’t installed a firmware upgrade since 422. I’m waiting for the bugs to be ironed out, which, on the face of things at the moment, may be some time…

6

It doesn’t prompt you to change root password via the UI. I was finally able to fix the problem by doing a “System Only” restore. From there unforunately I had to recreate users/shares but it did allow my to ssh via the default root/welc0me password which then I was able to change via SSH.

7

I deleted ,ssh, which also deleted know_hosts containing old RSA key.

I got some nasty reading messages, but was able to log in. File know_hosts was repopulated.

8

Hello all, 

We have passed this along to support.