SSH on Margrop Blog

Stop Fighting Over the Remote: Use DSM Scheduled Tasks to Lock a Kids' Video Folder Automatically

Sun, 05 Jul 2026 06:50:00 +0800

Short version

This is not an account lockout guide. The goal is narrower and cleaner: lock one kids’ video folder on a Synology DSM 7.2.1 NAS during selected hours, while leaving the account, password, homework folders, photo folders, and other shares alone. The script inserts one temporary deny ACL entry with synoacltool, removes that entry during open windows, backs up the ACL before each change, and verifies the result after each operation.

Stop Treating Passkeys as SSH Passwords: The Right Way to Use SSH Keys and Phone/Desktop Passkeys

Tue, 30 Jun 2026 09:30:00 +0800

Short version

SSH passwordless login and passkeys on phones, Macs, and Windows PCs both use the public-key idea, but they are not the same tool. SSH keys are for logging in to servers, Git remotes, jump boxes, and automation endpoints. Passkeys are for signing in to websites, apps, and account systems. They are like two modern key rings: one opens the machine-room door, the other opens your online account door. The cryptographic idea is related, but the locks are different.

The practical rule is simple: generate a separate SSH key on each client device, keep the private key only on that device or inside a hardware security key, and put only the public key on the server. Verify public-key login before disabling password login. Use passkeys through iPhone, Android, macOS 26, Windows 11, system password managers, or hardware security keys for website and app sign-in. Do not try to paste a phone passkey into authorized_keys. This post includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26, plus a manual automation path and an Agent-driven configuration path. The examples do not depend on any third-party service and do not contain real internal addresses, full computer names, private domains, or secrets.

Synology locked root behind three doors — I spent twenty minutes teaching it how to let me back in

Thu, 18 Jun 2026 16:30:00 +0800

TL;DR

Synology DSM, by design, ships with SSH disabled and root login prohibited — both sensible defaults. This guide walks you through “doing it the right way”:

Control Panel → Terminal & SNMP → Enable SSH (open the gate)

Log in as a normal user, then sudo -i to become root (borrow the landlord’s key first)

Edit /etc/ssh/sshd_config and set PermitRootLogin yes (tell the bouncer “root is family”)

synouser --setpw root xxx to set a root password, and append your public key to ~/.ssh/authorized_keys (hand back a key that can never be lost)

Total time: about twenty minutes. I’ll explain why every step exists using a “key and lock” metaphor, give you a 3-second vi crash course, list the error messages you’ll see, and answer the seven most common questions.

Moving Bedtime Out of the Living Room: Letting macOS launchd Disable Your Kids' Synology Accounts at 22:00 and Quietly Re-enable Them at 08:00

Sun, 14 Jun 2026 08:20:00 +0800

Short version

Synology DSM has a “disable this account” checkbox in the Control Panel, but it does not run on a schedule. With macOS’s built-in launchd and a 50-line bash script, you can flip the expired flag on two local accounts at 22:00 every night and flip it back at 08:00. The script does a before-query, a change, an after-query, and exit 1 the moment the after state does not match expectations. launchd writes stdout and stderr to dedicated log files. The interesting part is that the word “parent” quietly leaves the conversation: you no longer have to remind anyone to go to bed, the machine does it for you, on time, every day.

This post is not a comprehensive “family NAS management” guide. It is about one specific thing: turning a manual button click that depends on human memory into a system-level event that just happens on time.

If you only want the picture, the overview diagram in Section 2 is the whole article in one frame.

You Can SSH Out, but Not Back In: A Fail2Ban False Positive That Broke Reverse Access

Sat, 30 May 2026 15:45:00 +0800

Bottom line

The symptom looked simple: I could SSH from the local machine into a remote internal host, but the reverse SSH path failed when the remote host tried to connect back. sshd was listening, the route table looked fine, and the failure still happened.

The real root cause was not a broken SSH daemon. Fail2Ban had banned the VPN gateway address that represented the return path. From the local machine’s point of view, the incoming SSH session did not appear to come directly from the remote host. It appeared to come from the gateway, so the ban cut off the whole reverse path.

Stop Clicking Remote Desktop: Let AI Agents SSH into Windows Instead

Wed, 13 May 2026 08:10:00 +0800

The short version

An AI agent does not need Remote Desktop, VNC, or a proprietary remote-control tool to operate a Windows machine. For many workstations, lab machines, development PCs, and internal servers, the cleanest path is to enable the built-in OpenSSH Server on Windows and connect from Linux or macOS with a normal command: ssh <user>@<windows-host>.

There are only three things to get right. First, install and enable OpenSSH Server on Windows 10 or Windows 11. Second, generate an SSH key on Linux or macOS and place the public key on Windows. Third, if the target account belongs to the Windows Administrators group, put the public key in C:\ProgramData\ssh\administrators_authorized_keys and lock down the ACL with icacls. After that, an AI agent can run PowerShell, copy scripts, collect logs, install tools, and perform repeatable maintenance through the same SSH workflow it already uses for Linux.

All hostnames, addresses, usernames, screenshots, and commands in this article use generic placeholders. No real internal addresses, usernames, machine names, tokens, keys, or private paths are included. Replace placeholders such as <user>, <windows-host>, and <windows-ip> with values from your own environment.

Integrating Synology Operations as an OpenClaw / HermesAgent Skill: From One Sentence to Auditable NAS Automation

Tue, 05 May 2026 12:20:00 +0800

I have already written two Synology CLI references on this blog:

Those posts answer the question: “What commands can a human run on a Synology NAS?” This article answers a different question: if I already use OpenClaw / HermesAgent, how can I turn those commands into an operations Skill so that I can ask the agent, in one sentence, to inspect the NAS, summarize evidence, prepare a maintenance plan, and execute approved commands only when the risk is acceptable?

The short answer is: yes, but the Skill must not become an unrestricted root shell. The right design is:

Make Synology SSH access controlled, testable, and revocable.
Put common Synology CLI operations into a Skill, together with command categories, risk levels, and output rules.
Allow read-only diagnostics by default.
Require explicit approval for service restarts, permission changes, user changes, network changes, deletion, and storage operations.
Preserve commands, output, and reasoning so each operation remains auditable.

If you only want the big picture, the diagram below summarizes the whole article.

[Transfer] Synology NAS CLI Administration Guide

Thu, 30 Apr 2026 18:20:04 +0800

This guide contains command tools that allow your applications to make use of the resources on Synology DiskStation and also includes a list of Synology Error Numbers for reference.

[Translation] Synology SSH Commands Cheatsheet

Thu, 30 Apr 2026 10:00:00 +0800

Warning: Running these SSH commands may damage your system/hard drive. Do not execute them if you don’t understand what they do!

The past and present life of SSH key algorithm Ed25519 and RSA, and how to use it today

Mon, 02 Mar 2026 09:00:00 +0800

Many people’s first contact with SSH starts with a line of commands: There is nothing wrong with this command, but there is an often overlooked issue behind it: Are we talking about “RSA key type” or ssh-rsa “signature algorithm”? These two concepts are used interchangeably in many old tutorials, leading many people to think that they are “still using old and unsafe solutions” and at the same time don’t know how to migrate, and even repeatedly step into pitfalls between new systems and old devices.

How to Install HACS in Home Assistant

Fri, 19 Feb 2021 10:53:04 +0800

If Using a Virtual Machine Environment (Home Assistant OS)

Go to the Supervisor panel
Install an SSH add-on (enable advanced mode in your user profile first)
Configure the selected SSH add-on
Start the SSH add-on
Connect to the SSH add-on
Run the HACS installation script

wget -q -O - https://hacs.xyz/install | bash -

Latest Synology 6.17: How to Gain Root Access, Set Root Password and Enable SSH Passwordless Login

Wed, 10 Feb 2021 20:40:26 +0800

1. Enable SSH Function

In 控制面板->终端机和SNMP, enable the SSH function

2. Log in to Synology via SSH Using the Default System User

My default user is admin, so I enter the following command. Modify admin and IP地址 to match your own settings.

ssh admin@192.168.1.5

How to Configure a Freshly Installed Ubuntu 20.04 Server VM on PVE

Sat, 30 Jan 2021 15:33:44 +0800

Download the Installation ISO

Aliyun Ubuntu 20.04 live server download Aliyun Ubuntu 18.04 live server download

Installing Frp Client on CentOS with SSH Access

Sat, 23 Jan 2021 17:22:58 +0800

Download and Extract Frp

Latest Frp download address: https://github.com/fatedier/frp/releases/

mkdir ~/frp
cd ~/frp
wget https://github.com/fatedier/frp/releases/download/v0.35.0/frp_0.35.0_linux_amd64.tar.gz
tar -xvzf frp_0.35.0_linux_amd64.tar.gz

Initialization script after Proxmox VE installation

Fri, 22 Jan 2021 16:42:46 +0800

In order to facilitate the installation of PVE, I compiled the relevant commands myself. Please modify them according to your own environment.