Table of Contents

1 Hardware

The Netgear ReadyNAS 3138 is a 1U rack-mounted NAS server with 4 3.5'' SATA drive slots. I have recently purchased such a device in order to use it as a small home fileserver and decided to play with it a small bit before placing it in production use on the network. The manufacturer part number on the sticker that I got was RN31843E which indicates, that the NAS was originally sold with 4 x 3TB disks inside (https://www.cdw.com/product/NETGEAR-ReadyNAS-Rackmount-4x3TB-Enterprise-Drives-RN31843E/3921155). I got it empty however so it's just a plain RN3138.

All of the currently available information about the device has been moved to wikidevi.

2.1 Booting an alternative operating system

The knowledge and access we gained on the serial console allows us to boot an alternative operating system on the NAS. We will use Alpine Linux x8664 as a proof of concept as it's one of the smallest Linux distributions out there (the internal USB drive is only 256 MB).

First we need to change the SYSLINUX configuration as the prompt is currently disabled unless we press one of the designated keys (Shift, Alt, Caps Lock or Scroll Lock). As the NAS has no keyboard we need the prompt to appear every time. We need to boot the NAS without any disks attached so that we end up in the "Emergency Mode" boot where the internal USB device is mounted on /media/boot. Then, we remount it read-write and edit the syslinux.cfg file: 

# mount /media/boot/ -o rw,remount
# head /media/boot/syslinux.cfg serial 0 115200 0
timeout 30
prompt 0

default Normal

label Normal
kernel kernel
append initrd=initrd.gz reason=normal

# vi /media/boot/syslinux.cfg # head /media/boot/syslinux.cfg serial 0 115200 0
timeout 30
prompt 1

default Normal

label Normal
kernel kernel
append initrd=initrd.gz reason=normal

#

By changing the default 'prompt 0' to 'prompt 1' the SYSLINUX prompt should appear after rebooting: 

# reboot
init: received signal 15, goodbye
# [10600.304144] reboot: Restarting system

Version 2.16.1243. Copyright (C) 2013 American Megatrends, Inc.                 BIOS Date: 03/05/2015 11:38:52 Ver: ReadyNAS 3130 V0.9                          Press <DEL> or <ESC> to enter setup.        
SYSLINUX 6.03 EDD 20150820 Copyright (C) 1994-2014 H. Peter Anvin et al         boot: Loading kernel... ok                                                            Loading initrd.gz...ok                                                          [    3.976663] ismt_smbus 0000:00:13.0: completion wait timed out
[    4.982651] ismt_smbus 0000:00:13.0: completion wait timed out               [    5.988648] ismt_smbus 0000:00:13.0: completion wait timed out               [    6.994635] ismt_smbus 0000:00:13.0: completion wait timed out               Starting the boot process...
Detected system type: RN3130
Loading kernel modules...done
Boot mode: Normal
Searching for disks (1)...

As we haven't sent any characters through the serial console there will be a timeout after 3 seconds and SYSLINUX will boot the default entry landing us back in "Emergency Mode". Now we will put Alpine Linux on the internal USB device and make an entry to boot it. First, we need to download a bootable Alpine Linux ISO for the x8664 CPU architecture: 

➜  ~ wget https://dl-cdn.alpinelinux.org/alpine/v3.14/releases/x86_64/alpine-standard-3.14.1-x86_64.iso
➜  ~ sudo mount alpine-standard-3.14.1-x86_64.iso mnt/tmp/ -o loop
➜  ~ ls -l mnt/tmp/boot razem 124595
-r--r--r-- 1 root root    224952 Aug  5 14:28 config-lts
dr-xr-xr-x 1 root root      2048 Aug  5 14:28 dtbs-lts
dr-xr-xr-x 1 root root      2048 Aug  5 14:28 grub
-r--r--r-- 1 root root  13293681 Aug  5 14:28 initramfs-lts
-r--r--r-- 1 root root 102707200 Aug  5 14:28 modloop-lts
dr-xr-xr-x 1 root root      2048 Aug  5 14:28 syslinux
-r--r--r-- 1 root root   4145824 Aug  5 14:28 System.map-lts
-r--r--r-- 1 root root   7205952 Aug  5 14:28 vmlinuz-lts
➜  ~

Now, in order to transfer the files needed we want to start an SSH server on the NAS: 

# mount /media/boot/ -o rw,remount
# dropbear -RF...
Read more »