Re: Readynas duo V2 unable to access admin page

Retired_Member · ‎2020-07-27

Hi All

Noticed that I am unable to login to the admin page using RaidR or through the IP address. I used to get a message as it didnt have a secure certiticate but now I can't even bypass that.

I get the following message in Edge and Chrome...

Your connection isn't secure

This site uses an outdated security configuration that might expose your personal information when it's sent to this site (for example, passwords, messages, or credit cards).

NET::ERR_SSL_OBSOLETE_VERSION

If I click continue (unsafe) it returns me back to the page...

Is there anyway I can bypass this?

Thanks

Marc_V · ‎2020-07-28

@Retired_Member

Have you tried using Firefox? and setting it up with exception? or using an older version might work.

HTH

StephenB · ‎2020-07-28

@Marc_V wrote:

Have you tried using Firefox? and setting it up with exception? or using an older version might work.

There are a couple of ways to potentially resolve this.

One is that the apache web server in the NAS explicitly redirects to https. If that can be undone, then access would be retained (using http instead of https). I believe that in OS 4.2 this requires a change in virtual.conf, but I haven't tried it, or figured out if the change would be sticky. I also haven't looked at 4.1 (and since I don't have a v2 NAS I can't check OS 5) This would (IMO) be the best solution. Though the firmware itself is end-of-life, Netgear (or potentially someone else like @WhoCares_ ) could provide an add-on that would apply this change.

Another is to update apache so it uses a version of TLS that isn't being deprecated. This would be better of course, but it definitely is more work, and might require Netgear to back-port changes.

Using firefox might work at the moment, but it won't work longer term. All browser vendors are dropping support for TLS 1.1 - see for instance this: https://www.zdnet.com/article/browsers-to-block-access-to-https-sites-using-tls-1-0-and-1-1-starting... This includes removing the "click through" that is currently possible.

Installing an out-of-date browser to access the NAS would of course work, as long as you were careful to prevent it from being automatically updated. There is a way to disable checking for updates in the FireFox preferences. But you'd need to be careful not to use that browser to access the internet.

Sandshark · ‎2020-07-28

There is no way to enable admin HTTP access in the OS5.x GUI. Editing /etc/frontview/apache/Virtual.conf also doesn't do the whole job. It turns off the re-direct, but you then get an error 400 that HTTPS is required.

If anyone has any ideas where to look to get around this, I'll be happy to give it a try.

StephenB · ‎2020-07-29

@Sandshark wrote:

There is no way to enable admin HTTP access in the OS5.x GUI.

That is also true with OS 4.1 and OS 4.2.

So we really do need a solution for this.

Sandshark · ‎2020-07-29

The ultimate solution, obviously, it it's time to retire those old NASes. But I recognize that not everyone is in a position to do so and both personal and Netgear supply chain issues due to COVID-19 aren't making that any easier right now.

For Windows users, IE is still there, though Microsoft does their best to hide it from you. Since it's not being updated anymore, it should continue to be an option for as long as Microsoft leaves it in Windows 10.

Those with a 64-bit OS4.2.x machine always have the option of updating the OS to OS6, but those with other machines have no such option. I'm far from an expert on http(s), but I have a DuoV2 that's exclusively for experimentation and answering questions here, so I can give anything a try that can be fixed with a factory default. I just don't know where to look next and Google isn't being a lot of help. Everything I find about solving an error 400 assumes it is an error, not an intentional feature than now needs to be bypassed and everything about requiring HTTPS points to the rewrite engine, which I've disabled.

WhoCares_ · ‎2020-08-02

For those who are interested: https://github.com/rdynsxtrs/r5bin/tree/master/apache2

Updates the Apache web server on the ReadyNAS to v2.2.34
Enables TLSv1.2
Disables TLSv1 and TLSv1.1

Have fun

-Stefan

Sandshark · ‎2020-08-02

This is great, thanks for it @WhoCares_ . I suggest that you add in the ReadMe that it's for OS5.x on DuoV2 and NV+V2.

Any chance users of OS4.1.x or 4.2.x will also be the recipients of your generosity?

WhoCares_ · ‎2020-08-02

Since the note about OS5 is in the upper level Readme already I didn’t think it necessary to add it to the other one as well but will do when I’m back at a device with more pleasant input methods than a glass screen 😂

As for 4.1 and 4.2: I might be able to provide updates for those as well but in both cases I’d have to revive the respective dev environments which especially for 4.1 might be a problem. Also there’s a chance that because of their base os being older it might not be possible to build the SSL library required for TLDv1.2. We‘ll see.

StephenB · ‎2020-08-02

@WhoCares_ wrote:

For those who are interested: https://github.com/rdynsxtrs/r5bin/tree/master/apache2

Updates the Apache web server on the ReadyNAS to v2.2.34

Enables TLSv1.2

Disables TLSv1 and TLSv1.1

Have fun

-Stefan

Thanks!

Please keep us updated on OS 4.1 and OS 4.2.

Sandshark · ‎2020-08-02

Some people "back into" such things via a search, so it's always a good idea to include as much info in the ReadMe as possible.

I tried installing this on my DuoV2 as an add-on and as a firmware update and get an "Unrecognized server error" in Chrome and Edge. IE doesn't even try to upload it. I've seen that error on other NASes where it could be ignored, so I rebooted anyway. But taking a look at httpd.conf, it definately did nothing.

I'm putting off the manual installation via SSH so I can test the .bin if it is updated.

WhoCares_ · ‎2020-08-02

Old bug of OS5: uploading apps only works with Firefox.

-Stefan

Sandshark · ‎2020-08-03

OK, so using Firefox on a Linux VM worked -- sort of. It recognized the add-on was a good one and did the upload. But instead of telling me I had to re-boot and allowing me to do that (as the EnableRootSSH add-on does), the GUI locked up. It made it look like I could re-boot, but nothing actually happened and a page refresh gave a no connection error. I initially re-booted via SSH shutdown -r now, but I did a factory default and tried again, this time cycling power since not everyone will have SSH access. Both methods worked. The httpd.conf changes were made and Chrome reports ther GUI is using TLS1.2.

If somebody figures out a fix for using something other than Firefox, please chime in. I know I did something different when I initially set this NAS up and installed EnableRootSSH_1.0-arm, but don't remember what it was. Maybe what I did then (though it's only just over a year ago) just doesn't work anymore.

WhoCares_ · ‎2020-08-03

Would be interesting to learn what your NAS did during and after the installation of the add-on. The thing is that a reboot shouldn't be necessary and that's why you're not informed. However, there should be a message telling you that the add-on was successfully installed. That said, the timing is a bit tricky there because the message queue is polled only so often and if the add-on restarts the web server before it pulled the message chances are the message is lost forever.

Anyway, the important thing is that a reboot shouldn't be necessary. You may have to refresh the browser window but that should be all. Would be cool if you could test with a factory reset NAS for that's the one thing I can't without losing my dev environment which lives on the NAS 😉

-Stefan

Sandshark · ‎2020-08-03

The message was that it did not install correctly, and a refresh is what showed the web server was locked up (at least, I think that's what caused the loss of GUI communications). I didn't try restarting just apache via SSH. Having repeated this after a factory default, I'm sure nothing I did beforehand had anything to do with it. I did also try accessing the GUI from an entirely different computer, and it also would not connect, so it wasn't a sudden switch of T:LS protocol confusing the browser. RAIDar still showed the NAS alive and happy.

Sandshark · ‎2020-08-03

My DuoV2 is strickly a sandbox, so let me know when you need another version tested and I'll default again. You could, of course, just have a separate drive with a different volume for sandbox testing with the NAS you have.

treboR2Robert · ‎2020-11-29

Hi first off THANK YOU for the addon

I had the same experiance installing it though.

I used internet explorer which actually worked for installing addons.

The addon seemed to install ok and I actually got an email saying the addon was succesfully installed, but the web interface popped up saying the addon WAS NOT successfully installed

So I clicked ok and then tried to restart the unit but i got a message saying the restart request wasn't sent or something ? Tried shutdown and got the same response.

So i pushed the power button on the front of the actual unit and the screen came on which said installing addon

I waited a while and eventually just pressed the power button again and the installing addon message was still there but i pushed it again and it said push 1 more time to shut down. So i done that and It shutdown just fine.

I turned it back on again and tried accessing the web interface in firefox and this time did not get the message about TLS 1.0. I checked the page stats and sure enough it says its using TLS 1.2

So yeah it all seemed to install but just had a funny few mins afterwards.

Thanks again

dthrevan1 · ‎2021-04-25

@treboR2Robert wrote:
The addon seemed to install ok and I actually got an email saying the addon was succesfully installed, but the web interface popped up saying the addon WAS NOT successfully installed

So I clicked ok and then tried to restart the unit but i got a message saying the restart request wasn't sent or something ? Tried shutdown and got the same response.

So i pushed the power button on the front of the actual unit and the screen came on which said installing addon

I waited a while and eventually just pressed the power button again and the installing addon message was still there but i pushed it again and it said push 1 more time to shut down. So i done that and It shutdown just fine.

I had to revisit installing this add-on and you are correct the addon does give a error message saying it didn't install correctly, however in the log file it still installs fine.

The issue where you had to force a shutdown with the power button is because after the add-on installs it disables the apache service..

To resolve this just simply SSH to your NAS and type apache-ssl -f /etc/frontview/apache/httpd.conf

mitchathame · ‎2023-12-01

Just by accident i found the following while trying to creat a Unix Live disk from an old PCplus 276 software disk.

Accessing the disk brought up its own version of IEexplorer and using this version i was able to connect to the frontview page. as normal.

I dont know if this can give someone more technical an insight into how to set this up or how this can help others , but if anyone wants more details ill try an anwer any questions.

StephenB · ‎2023-12-01

@mitchathame wrote:

Accessing the disk brought up its own version of IEexplorer and using this version i was able to connect to the frontview page. as normal.

Not sure why you added this to a 2-year thread.

I am thinking you likely were running into the "ERR-SSL-VERSION-OR-CIPHER-MISMATCH" error. There are other workarounds - it'd be useful to know what firmware you are running if you want more info on this.

mitchathame · ‎2023-12-03

Hi details are

Readynas V1 V2?

Model: ReadyNAS Duo
Serial: 2102927W00DBB
Firmware: RAIDiator 4.1.16 [1.00a043]
Memory: 256 MB [2.5-3-3-7]
MAC address: 00:24:B2:03:11:10
IPv4 address:: 192.168.2.172
Volume C: Online, RAID Level 0 , Single disk, 78% of 1845 GB used
Volume 😧 Online, RAID Level 0 , Single disk, 0% of 921 GB used

I posted my comment because not being a Unix buff I was just wanting a quick and easy way off opening front view on my computer. I have copied the iexplorer.exe file from the PCPLUS disk and have used it on other computers in my network to successfully login to frontview.
I just run iexplorer.exe it says cant fid PCplus file, Click Ok, enter readynas address/admin it comes back with protocol failure and allows you to change settings . Change settings to tick TLS 1.0 Then it all works OK.
The next time I run the iexplorer file it allows me to connect straight away.

I just thought this may be a welcome work around for others non Unix masters to know about

If there is an easy non unix expert way to allow me to log on im more than willing to try but ive not managed to find it.

Ah the best

StephenB · ‎2023-12-03

@mitchathame wrote:

Readynas V1 V2?

Firmware: RAIDiator 4.1.16 [1.00a043]

This is a V1.

A V2 runs 5.3.x firmware (not 4.1.x). Plus it says Duo v2 on the front panel. Your's just says Duo.

There is an add-on that fully solves this problem for the V2. But unfortunately not for the V1 you have.

@mitchathame wrote:

I posted my comment because not being a Unix buff I was just wanting a quick and easy way off opening front view on my computer.

Installing obsolete browsers creates other risks (particularly if you accidently use them to access other sites on the internet).

Other (IMO better) options you have are to

(a) run Edge in IE mode to access frontview

https://support.microsoft.com/en-us/microsoft-edge/internet-explorer-mode-in-microsoft-edge-6604162f...

(b) use current FireFox with a small configuration change. Set security.tls.version.min to 1 (browse to about:config and search for the setting).

(c) use the workaround for 4.1.x systems in post 5 of this thread:

https://community.netgear.com/t5/New-ReadyNAS-Users-General/Workaround-for-ERR-SSL-VERSION-OR-CIPHER...

The directions for (c) do not require any knowledge of Linux. After the patch is made, then you will be able to access frontview using http (not https) from any browser.