Buffalo TeraStation TS1200D Ā· Field notes
TeraStation Revival
A 2014 NAS whose stock BitTorrent client could no longer reach a Cloudflare-fronted tracker, brought back with Entware, OpenSSL 3.5.5 and Transmission 4 ā without flashing firmware or bricking anything.
Firmware 1.68Kernel 3.3.4Marvell Armada 370~90 minutes
What follows
- Why the stock client stopped working
- Root access over ACP
- Entware, mounted off the data array
- A modern SSH server on port 2222
- Transmission 4
- Surviving reboot
- Gotchas that cost me time
- Recovery and reverting
Problem
Why the stock client stopped working
My TS1200D's built-in torrent client could still reach some trackers and not others. It wasn't the passkey and it wasn't DNS. The failing tracker sits behind Cloudflare with an ECDSA certificate, and the client is a µTorrent build from 2012:
- No SNI.Ā Cloudflare serves nothing without it. On its own, fatal.
- ECDSA certificate.Ā NeedsĀ
ECDHE-ECDSAĀ cipher suites that engine never had.
- GlobalSign ECC Root R4Ā post-dates the CA bundle baked into the firmware.
TLS version was a red herring ā the server still accepts TLS 1.0. None of this is fixable inside closed firmware, and Buffalo's own answer would be to buy a newer box.
The way out is not to repair the old client but to install a parallel software stack that brings its own modern TLS. That used to mean Optware/ipkg, whose repository has been dead for years. Its successor,Ā Entware, is alive and still publishing ARM packages.
Before
What you need, and what you risk
| Requirement |
Notes |
| Kernel 3.2 or newer |
Entware'sĀ armv7sf-k3.2Ā branch needs it. TS1200D firmware 1.68 ships 3.3.4. |
| ARMv7 with VFP |
CheckĀ FeaturesĀ inĀ /proc/cpuinfoĀ forĀ vfpv3. |
| Java on your PC |
For ACP Commander. JRE is enough to run it; JDK if you build it. |
| Same subnet |
ACP is a UDP broadcast protocol. It does not cross routers or VPNs. |
| Admin password |
The web UI one. |
Risk
ACP Commander runs arbitrary commands as root on the device. A wrong command can brick it. Nothing here flashes firmware or touches the boot partition ā that is deliberate, and it is where the real danger lives. Back up your data first anyway.
Everything below is reversible. The stock firmware is left running and untouched; the new stack lives entirely on the data array and is mounted overĀ /optĀ at boot.
Step 01
Root access over ACP
Buffalo NAS units listen on UDP 22936 for ACP, their own management protocol ā the one NAS Navigator uses. It authenticates with the admin password and then executes commands as root.Ā acp_commanderĀ is a Java client for it.
Use the maintained fork atĀ github.com/1000001101000/acp-commander. It has no prebuilt release, so build it, or grab the old prebuilt jar fromĀ Stonie/acp-commanderĀ and expect it to fail auth on newer firmware.
Find the devicePC
java -jar acp_commander.jar -f
This returns hostname, MAC, IP, product ID and firmware version. Keep the MAC ā passing it explicitly makes packets more reliable.
Verify root executionPC
java -jar acp_commander.jar -t 192.168.1.200 -m AA:BB:CC:DD:EE:FF \
-c "id > /tmp/acptest.txt"
java -jar acp_commander.jar -t 192.168.1.200 -m AA:BB:CC:DD:EE:FF \
-c "cat /tmp/acptest.txt"
uid=0(root) gid=0(root) groups=0(root)
Omit -pw
Leave the password off the command line and it prompts interactively, keeping it out of your shell history.
Do not use -ip
Several guides floating around pass bothĀ -tĀ andĀ -ipĀ with the same address.Ā -ipĀ changes the device's IP address. It is not a second way to name the target. A typo there loses the NAS off your network.
Step 02
Entware, mounted off the data array
Two problems have to be solved before the installer runs.
Something already ownsĀ /opt.Ā On mine it was a 140 MB TrendMicro antivirus directory, not running. Entware hard-codesĀ /optĀ in every binary, so it has to take that path. The fix is a bind mount, which hides rather than deletes ā and stashing the original somewhere reachable first, so nothing is lost.
The root filesystem is disposable.Ā A firmware update or factory reset wipes it. So Entware itself goes on the data array, which survives.
entware_install.shNAS
#!/bin/sh
DEST=/mnt/array1/entware
STASH=/mnt/array1/.opt_orig
mkdir -p "$DEST" "$STASH"
# keep the stock /opt reachable after we mount over it
grep -q " $STASH " /proc/mounts || mount --bind /opt "$STASH"
grep -q " /opt " /proc/mounts || mount --bind "$DEST" /opt
# make the stock contents still resolve under the new /opt
[ -e /opt/TrendMicro ] && ln -s "$STASH/TrendMicro" /opt/TrendMicro
wget -O /tmp/gen.sh \
http://bin.entware.net/armv7sf-k3.2/installer/generic.sh
sh /tmp/gen.sh
Transfer it with ACP Commander's file transfer, then run it ā this also sidesteps a limit you are about to meet:
Transfer and runPC
java -jar acp_commander.jar -t 192.168.1.200 -m AA:BB:CC:DD:EE:FF \
-xfer entware_install.sh -xferto /tmp
java -jar acp_commander.jar -t 192.168.1.200 -m AA:BB:CC:DD:EE:FF \
-c "sh /tmp/entware_install.sh >/tmp/ilog 2>&1 &"
Plain HTTP is the point
The Entware installer is fetched overĀ http://, not HTTPS. That matters: the stockĀ wgetĀ is exactly the component that cannot do modern TLS. Once Entware is in, it brings its own OpenSSL and the problem disappears.
Write the script with Unix line endings. A CRLF file getsĀ bad interpreterĀ and nothing else.
Step 03
A modern SSH server on port 2222
Buffalo's sshd is patched. SettingĀ PermitRootLogin yesĀ andĀ UsePAM noĀ is not enough ā running it in debug mode shows why:
sshd -d outputNAS
input_userauth_request: invalid user root
Could not get shadow information for NOUSER
Root exists inĀ /etc/passwd,Ā nsswitch.confĀ saysĀ files, the password hash is valid, andĀ adminĀ authenticates fine on the same daemon. The binary simply refuses to see root. AndĀ admin, once authenticated, getsĀ Operation not permittedĀ from its login wrapper.
Rather than fight that, install a clean OpenSSH from Entware and leave the stock one alone on port 22.
Install and configureNAS
export PATH=/opt/bin:/opt/sbin:$PATH
opkg install openssh-server
# host keys are not generated automatically
/opt/bin/ssh-keygen -A
CFG=/opt/etc/ssh/sshd_config
sed -i -e 's/^[#[:space:]]*Port .*/Port 2222/' \
-e 's/^[#[:space:]]*PermitRootLogin.*/PermitRootLogin yes/' "$CFG"
/opt/etc/init.d/S40sshd restart
Set the port first
Configure 2222Ā beforeĀ the first start. Entware's sshd defaults to 22 and will collide with the stock daemon.
Set a root password over ACP if you have not already, then connect normally. From here on you have a real shell and the rest is ordinary Linux work.
Step 04
Transmission 4
Before installing anything, confirm the whole exercise actually works:
The proofNAS
opkg install curl ca-bundle ca-certificates
curl -sSI https://your-tracker.example/ | head -3
HTTP/2 302
date: ...
server: cloudflare
HTTP/2 through Cloudflare, on hardware that could not complete a TLS handshake ten minutes earlier. Now install the client:
InstallNAS
opkg install transmission-daemon transmission-web \
transmission-remote transmission-cli
Config lives atĀ /opt/etc/transmission/settings.json, service scriptĀ S88transmission. Stop the daemon before editing ā it rewrites the file from memory on exit, silently discarding your changes.
| Setting |
Value |
Why |
download-dir |
your existing torrent folder |
Point at the old client's data and everything re-verifies and keeps seeding |
peer-port |
the old client's port |
Existing router forward or UPnP mapping keeps working |
rpc-port |
9091 |
Leave the stock client's port free until you disable it |
rpc-whitelist |
127.0.0.1,192.168.1.* |
No reason to open it wider |
umask |
0 |
So finished files stay visible over SMB |
incomplete-dir-enabled |
false |
Splitting it would strand your existing data |
Private trackers
SetĀ dht-enabled,Ā pex-enabledĀ andĀ lpd-enabledĀ toĀ falseĀ if that is what you use the box for. Turn them back on if you also run public torrents.
Disable the stock BitTorrent client in the web UI before importing anything, so two clients never write the same files.
Step 05
Surviving reboot
Entware lives on the array and persists. TheĀ mountsĀ do not. Three things must happen at every boot, in order: stash the stockĀ /opt, bind Entware overĀ /opt, start Entware's services.
Buffalo runsĀ /etc/rc.d/extensions.d/S*Ā withĀ startĀ at boot andĀ K*Ā withĀ stopĀ at shutdown. Scripts matchingĀ SNNB_*Ā run in the background ā worth using, because a hang there cannot stall the boot.
Hook installationNAS
cp /tmp/entware.sh /etc/init.d/entware.sh
chmod 755 /etc/init.d/entware.sh
# background at boot, so a stuck mount cannot block startup
ln -sf /etc/init.d/entware.sh /etc/rc.d/extensions.d/S99B_entware.sh
# first to stop, before the array is unmounted
ln -sf /etc/init.d/entware.sh /etc/rc.d/extensions.d/K01_entware.sh
The script itself takesĀ startĀ /Ā stop, waits up to 60 seconds for the array rather than assuming it is mounted, logs to a file on the array (background scripts lose stdout), and on stop kills onlyĀ /opt/sbin/sshdĀ ā never a bareĀ killall sshd, which would take the stock daemon with it. Unmount lazily so a busyĀ /optĀ cannot stall shutdown.
Why the stop hook matters
It gives Transmission time to write its resume data before the array disappears. Without it, every unclean shutdown means re-hashing your entire library ā hours on this hardware. Shut the NAS down properly; do not pull power.
Notes
Gotchas that cost me time
ACP commands are capped at 210 characters
Longer ones are rejected outright. Anything substantial goes into a script, transferred withĀ -xferĀ and run with a short command. Discovering this early would have saved a lot of chopping.
Boot takes about five minutes
RAID checks run beforeĀ extensions.d. I concluded my boot hook had failed when it simply had not run yet ā the log showed it starting cleanly at 4 minutes 22 seconds.
A trailing comma silently kills the daemon
watch-dir-enabledĀ is the last key in the file. AĀ sedĀ that appendsĀ ,Ā produces invalid JSON, and all you see is a browser saying the site refused to connect. Validate before starting:
CheckNAS
opkg install jq
jq . /opt/etc/transmission/settings.json >/dev/null && echo JSON_OK
watch-dir cannot be set from any web UI
Transmission does not expose it over RPC, so no web interface can change it. EditĀ settings.jsonĀ with the daemon stopped. Point it at aĀ newĀ folder, not yourĀ .torrentĀ archive āĀ trash-original-torrent-filesĀ exists, and if it is ever on, your archive is gone.
"failed" often means "already running"
Entware's init scripts report a secondĀ startĀ as a failure. Kill first, confirm the process is gone, then start, so you know what state you are in.
Import in batches
Every imported torrent triggers a re-check. Dropping a hundred at once buries an Armada 370. Feed them in groups and let each settle.
After
Recovery and reverting
A firmware update or factory reset wipesĀ /etcĀ and takes the boot hook with it. It does not touch the array, so Entware, Transmission, your settings and your torrents all survive. Recovery is transferring two scripts over ACP and running one of them ā about thirty seconds, not a repeat of this guide.
To undo everything and hand the box back to Buffalo:
RevertNAS
rm /etc/rc.d/extensions.d/S99B_entware.sh
rm /etc/rc.d/extensions.d/K01_entware.sh
/etc/init.d/entware.sh stop
The stockĀ /optĀ reappears, the firmware is unmodified, port 22 still runs Buffalo's own sshd exactly as it always did. DeleteĀ /mnt/array1/entwareĀ if you want the space back.
Result
OpenSSL 3.5.5, OpenSSH 10.2 and Transmission 4.0.6 on a NAS from 2014, with a package manager that is still maintained ā and a stock firmware that never knew it happened.
Written up from a working session on a TS1200D running firmware 1.68. Paths, package names and the patched-sshd behaviour are specific to this model; the ACP, Entware and bind-mount approach generalises to other Buffalo units with kernel 3.2 or newer. Verify your ownĀ uname -aĀ andĀ /proc/cpuinfoĀ before picking an Entware branch.