NAS access woes

After turning on the NAS for the first time in the new place, I thought plugging it in and turning it on was the extent of the setup. But alas, this turned into an evening project.

First, I had to configure my router's port it was plugged into to use a specific IP address I had stupidly configured on the NAS before the move. If you want to use static IP addresses, set them in the router, and never on the device itself! If I hadn't matched the static IP from the NAS, I couldn't reach the NAS from any other device on the network.

So with that out of the way, I had access to the NAS. Or so I thought. I could reach the login screen, but couldn't get past the OTP section when trying to sign into my account. My username and password were fine, I didn't change them. So there was an issue with the OTP token. Great.

Luckily I had two other accounts on the device: backup for running automatic backups with read-only access to the file system and limited permissions for services, and a legacy docker account for running Docker services. Both didn't have OTP configured, so I had a way in and could see that the NAS was operating fine.

Unfortunately (or fortunately, depending on how you look at it), neither have administator rights so they ended up not being very helpful at all. But I did have access to where the OTP tokens are generated! You see, OTP tokens are entirely time-based and can be generated offline. As long as both devices agree on the current time, you can get a valid token.

So, I suspected there was a bit of time drift causing the generated OTP tokens to be invalid against the (now slightly different) time on the NAS. Thankfully there was a way I could get the current time on the NAS from the Date header returned in the HTTP response of the login screen:

 1curl -sI http://<NAS IP ADDRESS> | grep -i ^date

So I changed the time on my computer, made sure it matched the exact date and time on the NAS, waited for a new OTP code to be generated, and I was in!

The underlying issue turned out to be in a different, unrelated setting on the router that allowed incoming connections, but denied outgoing requests to the internet. This meant the NAS couldn't get the "real" time from the configured NTP server, defaulting back to UTC (minus about 2 minutes).

To prevent this from happening again, I made sure to turn DHCP back on for both network interfaces so that my router was the arbiter of IP addresses once again. I also removed the rule on my router that denied the outgoing requests from the NAS to the internet, reconfigured NTP on the NAS, and verified the time was now correct.

I guess this just goes to show that a bit of general know-how about how things work can help out in unexpected ways!