Feiniu Qunhui makes it easy to open SSH, and forwarding port 22 is scanned every day.

When I was struggling with hard drive hibernation last year, I wanted to keep an eye on what the NAS was writing to the disk every minute. The backend of the web page was turned upside down and there was no such function. In the end, I logged in via SSH and hung up iotop for one night before I found out qBittorrent that had secretly written to the disk. I wrote this troubleshooting process in Hard drive hibernation article Here - that was the first time I really used SSH. In my eyes, this switch was "something only advanced users touch", and I was frightened for a year.

What is SSH: The backdoor that cannot be clicked in the background of the web page

For example, the web management interface of NAS is like a front desk receptionist. You can ask anything, but you can only press the buttons provided by it to get things done. ； SSH is the back door. After entering, you are faced with the entire underlying system of this machine. Feiniu is Debian, and Synology is also based on Linux. You can't click on any web page that can be done through the command line.

Later, when I looked back at the NAS articles I had written, I discovered that most of the troubleshooting and tossing could not be separated from this door.: To check who woke up the hard disk from hibernation, you have to log in and run iotop to see the writes per minute. ； To clean up duplicate files in 40,000 photos, you need to install apt fdupes removes duplicates ； Sometimes the hard disk is not recognized, so you have to use dmesg to translate it. kernel log . These tasks have one thing in common - there is no corresponding page in the background of the web page.

So SSH is not a hacking tool, it is another login method for NAS. The account and password you usually use remain the same, you just change them from the browser to a black window to enter them. Systems after Windows 10 come with this client. You can use it by holding down the Win key and entering "Terminal" or "cmd" to open it. No need to install any software.

Feiniu opens SSH: A matter of switch

Feiniu's entrance is hidden shallowly and can be completed in two steps:

Log in to Feiniu desktop, click Settings in the lower left corner, and enter the security column, where there is an SSH item. Check "Enable SSH service". The default port is 22. Leave it alone and save it. For newer firmware, this switch is placed in the security page of settings. For older versions, look for the word SSH in the system settings of the control panel. The name is the same. If you can't find it, it means it's time to upgrade the firmware.

Then go back to your computer, open a terminal, and type this line:

ssh 你的用户名@192.168.31.20

Replace the username with your FN ID account and the IP with the address of your own NAS - if you don’t know the IP, go find it in the router device list. My NAS is tied to a static IP. 192.168.31.20 , to prevent me from being unable to connect if the DHCP number changes someday.

The first time you connect it, it will throw out a warning saying "Unable to confirm the authenticity of the host" and ask you if you want to continue. This is recording the fingerprint of this NAS. Just enter yes and press Enter, and you will not be asked again in the future. Then enter the password - note that when you enter the password, not a word is displayed on the screen. It is not that the keyboard is broken. Press Enter after typing blindly. When you see the command prompt change, you are already inside the NAS.

At this time, ordinary users are still logged in. If they want to install software and view system logs, they have to raise their rights again.:

sudo -i

Enter your password once, and the prompt turns into a pound sign, and you are root. The base layer of Feiniu is Debian, so you can install things directly with apt. I used fdupes to clear duplicate files and installed them in 20 seconds.

Synology opens SSH: control panel tick

I helped my cousin get his second-hand Synology, and the path was more straightforward.: In the control panel, find "Terminal and SNMP", check "Enable SSH function", the port also defaults to 22, and it will take effect after application. The connection commands are exactly the same. The account uses your administrator account. Synology’s default name is usually admin.

The difference is after entering. Synology does not have apt. If you want to install tools that are not in the package center, you can either download the statically compiled executable file and throw it in to run, or you can use Docker to create a container and work around it - I will clear the duplicate files. How to install the downloader I have written about this comparison, and regarding Feiniu and his group’s apt, Synology has to turn a corner.

But the troubleshooting commands are applicable to both because they are both Linux. His hard drive was sometimes unrecognized. I just SSHed in and typed dmesg and grep. After seeing the record of repeated resets of the SATA link, I changed the direction from "the disk is broken" to "the cable is loose." It cost six yuan to replace the cable. sudo -i privilege escalation is also universal.

What can you do after you connect?: The five things I use most

There is no need to memorize commands, just search for whatever is needed, just copy into the black window and press Enter. These five items cover 90% of my daily needs:

The next step is to use SSH with password-free login. I used it when I used it for remote backup on my mother’s old Synology.: The local ssh-keygen generates the key and pushes the public key to the peer machine. In the future, there is no need to manually enter the password when running scripts between the two NAS. There is a permission trap here that I have stepped on - the peer's home directory and .ssh directory must be 700, authorized_The keys file must be 600. If the permissions are loosened, the system will pretend that it has not seen the key and silently return to ask for the password. It took me half a night to find out. Equipped with two NAS for off-site backup I completely recorded the whole process.

Three bottom lines of safety: Repost 22 I was scanned every day during the half month

Here are the lessons. The year before last, I wanted to save trouble and wanted to be able to SSH back to my home NAS from outside, so I forwarded port 22 to the public network on the router. Half a month later, I checked Synology’s security log and felt a chill down my back.: There are thousands of login failure records, all of which are overseas IPs, and the accounts tried are all admin, root, test, and ubuntu, several times a second, purely relying on scripts to run the dictionary.

The only thing that didn't happen was the password being long enough and luck. I deleted the retweet that day, and there was no more failure record after that. Since then, I have set three bottom lines for myself, and you should copy them too.:

Bottom line one, SSH ports should never be forwarded to the public network. If you want to connect back outside, use VPN or Networking tools such as Tailscale , after connecting, you are in the network environment at home, and then SSH the intranet address, which is exactly the same as at home. This is different from NAS Anti-ransomware That "administration page is not exposed" is the same truth. The attacker can't touch the door, so you don't need to race with his dictionary.

Bottom line two, don't be too superstitious when changing high-level ports. Online tutorials all teach you to change 22 to a high-level port such as 18022. This is useful, but it only prevents scripts that scan the entire section - attackers who are targeting you will scan all ports. I don’t even bother to change the port on my home intranet because I can’t get out of the house anyway.

Bottom line three, key login is an advanced option, not a requirement. The key is harder than the password, but the configuration process has permission pitfalls, and once the key file is lost and the password login is turned off in advance, you will lock yourself out. In home scenarios, it is enough to ensure that the first one is not exposed to the public network, the password is 16 digits upwards, and automatic blocking is enough - Synology has "Automatic blocking on failed login" in the security and account of the control panel. If you enable it, the source IP will be locked up in the dark room after several failures. This is a matter of two clicks on the graphical interface, which is less troublesome than using a key. The security settings of Feiniu's new firmware also include a similar automatic ban switch, just turn it on if you have it.

Under what circumstances should it be opened and under what circumstances should it be avoided?

Not everyone can drive it. I turned on the one at home because it was a lot of work. ； I turned it on for my mother's station to run the backup script. ； But if my cousin only uses the NAS to store photos and watch movies, there will be no loss if he leaves this switch on for the rest of his life.

Give an order at the end: First turn on the SSH switch in the system settings, use a LAN computer to confirm that you can log in, and if you want to run scripts, use a password-free password. Turn on the automatic blockade, and then remember the bottom line - do not forward ports, use VPN remotely. The switch itself is not dangerous. What is dangerous is that you think it will be over when you turn it on, and then directly expose it to the public network.