小米智能存储一键开启 ssh
| # Ver: 1.0.8.425.F24C26D24-REL | |
| # 脚本默认是在 Windows 下的 WSL 执行，需要安装并登录智能存储 Windows 版应用后才可顺利执行。 | |
| # apt insatll jq | |
| # 【唯一需要你填的】局域网内小米智能存储的 IP（如 NAS_IP="192.168.216.19"） | |
| NAS_IP="" | |
| if [ -z "$NAS_IP" ]; then | |
| echo "错误：请设置小米智能存储的内网 IP 后再试。" >&2 | |
| exit 1 | |
| fi | |
| # 操作复制 windows 下证书到 wsl，如果不是 wsl，则需要自己复制，并替换路径 | |
| LOCALAPPDATA=$(wslpath "$(cmd.exe /c echo %LOCALAPPDATA% 2>/dev/null | tr -d '\r')") | |
| CERT_HOME=$LOCALAPPDATA/minasCert | |
| echo CERT_HOME: $CERT_HOME | |
| if [ ! -d "$CERT_HOME" ];then | |
| echo "错误: minasCert 目录不存在，请先登录小米智能存储客户端后再试" | |
| exit 1 | |
| fi | |
| CN=$(echo | openssl s_client -connect $NAS_IP:443 -servername x 2>/dev/null | openssl x509 -noout -subject | sed 's/.*CN = \([^,]*\).*/\1/') | |
| echo CERT_CN: $CN | |
| if [ -z "$CN" ];then | |
| echo "ERROR: CN提取失败" | |
| exit 1 | |
| fi | |
| CERT_ARGS=( | |
| --cacert $CERT_HOME/ca_chain.pem | |
| --cert $CERT_HOME/$(ls $CERT_HOME|grep _cert) | |
| --key $CERT_HOME/$(ls $CERT_HOME|grep _private_key) | |
| ) | |
| curl -s ${CERT_ARGS[@]} --resolve "$CN:443:$NAS_IP" -X POST -H "Content-Type: application/json" -d '{}' "https://$CN/cgi-bin/luci/filemgr/get_pool_info" | jq -r '.data.webDAV | "\(.username):\(.password)"' > /tmp/.wdav_creds | |
| CREDS=$(cat /tmp/.wdav_creds) | |
| UNAME=$(cat /tmp/.wdav_creds | sed 's/\(.*\)\:.*/\1/') | |
| if [ -z "$CREDS" ]; then | |
| echo "ERROR: Failed to retrieve WebDAV credentials" >&2 | |
| exit 1 | |
| fi | |
| echo Fetch WebDAV account done, UNAME: $UNAME | |
| # 任意执行-启用 ssh | |
| ssh-keygen -q -t ed25519 -N '' -f ~/.ssh/id_ed25519 -C "" <<< y > /dev/null | |
| PUB_KEY=$(sed 's/[[:space:]]*$//' ~/.ssh/id_ed25519.pub) | |
| cat > /tmp/enable-ssh.sh << EOF | |
| #!/bin/sh | |
| [ ! -f /etc/passwd.bak ] && cp /etc/passwd /etc/passwd.bak | |
| mkdir -p /home/rootx/.ssh | |
| ln -s /firmware/models models | |
| sed -i 's|:/root:|:/home/rootx:|' /etc/passwd | |
| echo "$PUB_KEY" > /home/rootx/.ssh/authorized_keys | |
| chmod 600 /home/rootx/.ssh | |
| chmod 600 /home/rootx/.ssh/authorized_keys | |
| echo 'DROPBEAR_EXTRA_ARGS=" -s"' > /etc/default/dropbear | |
| usermod -s /bin/sh root | |
| systemctl enable dropbear.socket | |
| systemctl start dropbear.socket | |
| mitee_tool rpmb set ssh_en true | |
| touch /nas/pool0/$UNAME/data/SUCCESS | |
| chown $UNAME:$UNAME /nas/pool0/$UNAME/data/SUCCESS | |
| rm /nas/pool0/$UNAME/data/enable-ssh.sh | |
| EOF | |
| sed -i 's/\r$//' /tmp/enable-ssh.sh | |
| curl -s -u "$CREDS" ${CERT_ARGS[@]} --resolve "$CN:5000:$NAS_IP" -T /tmp/enable-ssh.sh \ | |
| "https://$CN:5000/pool0/data/enable-ssh.sh" -w "PUT: %{http_code}\n" -o /dev/null | |
| P="/pool0/video/__X2%22%3Bsh%20%24%28printf%20%27%5C57nas%5C57pool0%5C57$UNAME%5C57data%5C57enable-ssh.sh%27%29%3B%22__.ts" | |
| curl -s -g -u "$CREDS" ${CERT_ARGS[@]} --resolve "$CN:5000:$NAS_IP" "https://$CN:5000$P" -o /dev/null | |
| sleep 3 | |
| # 完成测试，或者打开 app 根目录下有 SUCCESS 即成功！ | |
| output=$(ssh -o StrictHostKeyChecking=accept-new root@"$NAS_IP" id 2>/dev/null) | |
| if [ $? -ne 0 ]; then | |
| echo "SSH 执行失败" >&2 | |
| exit 1 | |
| else | |
| echo $output | |
| echo 成功！请注意备份私钥（~/.ssh/id_ed25519），避免私钥丢失连不上 nas！ | |
| fi | |
| # ssh 连上以后，可以改一下 root 密码，默认 root 无密码 | |
| # 这个 root 拿到后可能用处有限，太多只读了（ | |
| # 为了 ssh key 所以修改了 root home，可能后续更新会有不一致风险，自己注意，不需要 ssh key 的话可以把 home 改回 /root |
点赞
收藏
点踩
分享评论
?
参与讨论