SSH root password hacked

Community Archives WD ShareSpace
1

Hi, I’m having a big problem. I open SSH port 22 for a week to NFS configuration from other computer. Somebody hacked into my WD ShareSpace using SSH connection with factory default weak password ‘welc0me’. Now I don’t know this password.

What can I do? I don’t want to lost my data on harddrives. Help me please.

2

Can you change the default password?

3

I think you are in a bit of trouble, here. The password and shadow files are owned by root (passwd file has user info and shadow file is where the actuall password is kept). You can ssh into the unit from a user id or admin, but you have no rights to these 2 files. Only the user and group “root” do.  In a “normal” Linux system (which the sharespace is built on), you can recover by booting off a CD or DVD into single user mode and then mount the file system where the 2 files are kept and then you can change them. But I don’t know about this system. Maybe WD has a tool.

4

Never even think of keeping opened ssh on default port 22.

Just look in syslog (/var/log/messages) and you will be scared of all hack-attempts this port is getting…