Cannot Login to Manage QNAP NAS TS-451

[chrisandhelen]

Hi guys,

First post here and a total newbie, so please go easy.

I've just bought a TS-228A and am really, really, really dissapointed with how difficult it has been to get this thing working. After 4 weeks still no luck!

All the symptoms listed in this thread are extremely similar to my current issues and observations.

I boot the unit and it comes on line, using Qfinder I log into the unit as Admin. After about 15-20mins it is no longer possible to access the unit via Qfinder. And I get the following error:

Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /cgi-bin/.

Reason: Error reading from remote server

Apache Server at 192.168.178.72 Port 8080

this occurs every single time i have used the unit.

I note that:
- it pings fine <5ms
- I can see the files using explorer and the mapped drive
- hard drives are often churning around, but this is hit and miss too!
- I have downloaded the malware app and run it - no issues detected or reported.
- I borrowed another NAS (Thecus N4310) and the system runs perfectly for days on end - indicating to me that this isn't a network issue.
- I think i have the latest firmware version 4.3.4.0569 (installed this last weekend - 06 May 2018)
- I have two 3TB WD red drives installed

I haven't done a reset (either 3sec or 10sec) - just keen to explore further options.

Cheers,
Chris

[esviagra]

I'm having this issue on my TS-451.

So the Malware Remover removed some malware and hopefully this resolves it. But a couple of concerns - how did this got in? What does the malware do - other than seemingly deny your ability to login / use the NAS?

[dolbyman]

without a lot more info from you ...a crystal ball would be all we got

any part of the nas exposed ?
photo station?
web services?

[CarbonPepper]

I'm having this issue on my TS-451.

So the Malware Remover removed some malware and hopefully this resolves it. But a couple of concerns - how did this got in? What does the malware do - other than seemingly deny your ability to login / use the NAS?

It probably removed some malware from a file on a share, which could harm a windows machine that connected to your NAS, but the NAS itself would not be affected.

The whole subject of malware on a Linux-based device is highly suspect.

[Mousetick]

It probably removed some malware from a file on a share, which could harm a windows machine that connected to your NAS, but the NAS itself would not be affected.

The whole subject of malware on a Linux-based device is highly suspect.

And your view on the subject of malware on a Linux-based device appears to be extremely narrow, or very outdated.

Certainly the Linux kernel itself has seldom, if ever, been compromised. When talking about Linux-based devices, consider the whole system of kernel, userspace programs, security mechanisms and configuration, as a potential target and host of malware.

With the proliferation of poorly secured, always-on, network-connected, embedded-Linux devices (NAS, router, IoT) in recent years, malicious software specifically targetting these types of devices has become more common. These programs can spy, steal or destroy data, participate in DDoS botnets, run spambots, etc. They are installed and run on the Linux device, not on "a windows machine that connected to your NAS". The latest famous and highly dangerous one was VPNfilter, which was discovered earlier this year - have you ever heard of it? It was so bad and so widespread that the US federal authorities (FBI) were involved and even advised users to reset their devices. Older versions of QNAP firmware were vulnerable and several users reported on this forum that they had been infected.

See also your response in this other thread: Protection from Malware, Virus and more

The malware was presumably on a client device. The NAS itself runs a version of linux. Linux malware is extremely rare and even then is only capable of causing harm if a system has also been left compromised by user error or poor admin strategy.

Please don't give people a false sense of safety by letting them believe that their NAS is secure and cannot be affected or harmed because it's Linux-based. That is not true and is not helpful. It would be more helpful to educate them on the need and methods to properly secure their devices, and not to rely on the default security, which is insufficient.

[CarbonPepper]

And your view on the subject of malware on a Linux-based device appears to be extremely narrow, or very outdated.

No, simply lacking in hyperbole and regurgitated propaganda from experts sponsored by anti-virus companies. Conversley yours is a bit paranoid / tin-foil hat. I'm sure we can meet in the middle somewhere.

I am not advocating a blasé approach, all people need to do is practice basic security and good housekeeping. All of the scenarios you cite are the result of a lack of those things.
It's easy, and sometimes fun to just repeat a third party perspective read somewhere on the internet. A lot of it is sponsored by companies that sell anti-virus products who are desperate to expand their market share. So I offer a little balance to the view. That's all. Anti-virus where it's not needed can be harmful.

This:

Certainly the Linux kernel itself has seldom, if ever, been compromised.

Ever, in 27 years. The risk is non-zero, but it's like we're talking about superman here, and whether or not he should wear a bullet-proof vest
Fit anti-virus if you want. But I find it highly unlikely that a QNAP malware, compromised the QNAP such that a share deleted data. I don't believe that for a second. This was most likely a compromised client with access to a mapped drive, and maybe the windows user has admin access (because most of them want it). Maybe.


A key point here is that, anti-virus products can themselves give a false sense of security. I've seen many a company that is very lax with client PC protection "Because we have it on the server"

[Mousetick]

It's easy, and sometimes fun to just repeat a third party perspective read somewhere on the internet. A lot of it is sponsored by companies that sell anti-virus products who are desperate to expand their market share. So I offer a little balance to the view. That's all. Anti-virus where it's not needed can be harmful.

I completely agree with you on this point. I too believe that anti-virus and other 'protection' software often cause more troubles than they prevent. I don't use any myself.

What I'm disputing is your belief that malware basically cannot exist on a QNAP device because it's Linux-based, and your telling other users that their QNAP device cannot be affected. This can give a false sense of safety and encourages the kind of lax security and housekeeping practices that you rightly deplore.

But I find it highly unlikely that a QNAP malware, compromised the QNAP such that a share deleted data. I don't believe that for a second. This was most likely a compromised client with access to a mapped drive, and maybe the windows user has admin access (because most of them want it). Maybe.

In this thread, you can read about users who ran a tool provided by QNAP, called Malware Remover. This tool scans the NAS for known malware infections and attempts to remove them. It is a cleaning tool after the fact, not an anti-virus, not a prevention tool. It is the equivalent to Microsoft's Malicious Software Removal Tool for Windows, perhaps you've seen it before. It specifically detects and cleans malware targeted at, and running on, the QNAP NAS. If malware on QNAP didn't exist, why do you think QNAP would develop such a tool and distribute it through its App Center? And yet you dismiss users' reports with a blanket "The whole subject of malware on a Linux-based device is highly suspect".

[johnnelson]

I am having a similar issue but different.... I created my account on the NAS as an administrator and disabled the Admin account months ago. Now it appears my account is no longer an administrator (no idea why) so I have no Control Panel or App Center. I can log in but most of my NAS desktop icons are gone including Control panel. Also the 3 second reset does not work, I assume it's disabled because nothing happens when I press and hold for 3-6 seconds. I have TONS of movies, pictures and music and it's looking like I'm going to have to dump it all onto external drives to save my data. Support is not helping much, their telling me to do things like go into Control Panel and reenable the reset button,,,, BUT I HAVE NO CONTROL PANEL!! ARGH>>>

[storageman]

I am having a similar issue but different.... I created my account on the NAS as an administrator and disabled the Admin account months ago. Now it appears my account is no longer an administrator (no idea why) so I have no Control Panel or App Center. I can log in but most of my NAS desktop icons are gone including Control panel. Also the 3 second reset does not work, I assume it's disabled because nothing happens when I press and hold for 3-6 seconds. I have TONS of movies, pictures and music and it's looking like I'm going to have to dump it all onto external drives to save my data. Support is not helping much, their telling me to do things like go into Control Panel and reenable the reset button,,,, BUT I HAVE NO CONTROL PANEL!! ARGH>>>

Follow this
https://helpdesk.qnap.com/index.php?/Kn ... ot-working

[albertoto67]

I have the same issue with QNAP TS-439 Pro-II.
I did not believe, but your advice really helped.
Thanks

[JoeOlly1]

I seem to have the same issue. Although is not on the same unit (TS-231P), it is the same problem. In trying to login from Windows 10 Pro, using browsers IExplore, Chrome or Firefox, it fails with, "The connection has timed out" error. Here is the weird thing, I may login from an older computer. It should be noted that I can manipulate via the cloud ((myQNAPcloud) just not directly unless an older computer. Has anyone tried login from another older computer or browser? I hope this can spark something on someone and help those of us.

[scycscyc]

Hi!

I'm experiencing the same issue with my TS-251+.

What a piece of tosh!

I can't quickly install anything because the nas locks me out in next to no time.

I can ssh into it after a certain time window before it blocks me from creating new ssh connections.

How can I check from the terminal if I have been infected? How to run any command line fix?

I'm really tired of this piece of sheet.

cheers,
S