synology-nas-cli

Audit a Synology NAS against the C3RB3R / .L0CK3D ransomware campaign with one command, fix what it finds with a second, and keep running DSM from the terminal afterwards.

English · 繁體中文 · 简体中文 · 日本語 · 한국어 · Deutsch · Español · Français

Canonical repository, releases and issues: https://gitlab.com/aa22396584/synology-nas-cli

nas is a zero-dependency Python CLI (standard library only, Python 3.8+, so it also runs on DSM itself) and stdio MCP server for the Synology DSM 7 Web API: status, health, logs, packages, volumes, Tailscale, DSM upgrades, scheduled health alerts pushed to a webhook, and an incident audit and remediation tool built during the October 2026 C3RB3R / .L0CK3D campaign against internet-exposed Synology NAS boxes (Synology-SA-24:20, SA-26:13, SA-26:14).

Not affiliated with Synology Inc. "Synology", "DSM" and "QuickConnect" are trademarks of Synology Inc.

• Hand it to your agent
• What it checks and fixes
• Install
• Pick your setup
• Configuration
• Credentials
• Backends
• Incident quick start
• nas incident fix
• MCP server and agent skills
• Alerts and webhooks
• Command reference summary
• What changes the NAS
• Tests

Hand it to your agent

Paste either prompt into Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Grok Bot, or any tool-using AI agent (Grok Bot setup, skills and alert routine: docs/GROK-BOT.md):

English prompt:

Use https://github.com/akari-sora/synology-nas-cli to audit and fix my Synology NAS at https://192.0.2.10:5001. Follow docs/AGENT-RUNBOOK.md.

繁體中文提示詞：

使用 https://github.com/akari-sora/synology-nas-cli 檢查並修復我的 Synology NAS（位址：https://192.0.2.10:5001），照著 docs/AGENT-RUNBOOK.md 的步驟執行。

What the agent does, step by step

1. Install: Clones the repository (or installs the package) and verifies ./bin/nas --version.
2. nas setup: Runs nas setup --json --no-input ... to write ~/.config/synology-nas-cli/config.json (mode 0600), signs in once to verify credentials, and pins DSM's TLS certificate SHA-256 fingerprint on first use.
3. nas doctor: Runs nas doctor --json to verify configuration, credentials, origin reachability, TLS pin, login, DSM version against SA-26:13, 2-step verification status, administrator capabilities, and clock skew.
4. nas incident: Runs nas incident --json (and optionally --probe --scan) for a read-only audit of DSM version, vulnerable packages, firewall, QuickConnect, UPnP router rules, public ports, external and failed sign-ins, AutoBlock, SMB1, built-in admin, snapshot schedules, the unsupported-model WORM lock trap, ransom notes, and CVE-2024-10441 exploit attempts.
5. Plan: Runs nas incident fix --dry-run --json --ransom-scan and shows every planned change (before -> after), the exact DSM Web API calls, and the corresponding DSM web UI path.
6. nas incident fix --yes: Applies the approved plan in order (snapshot_worm → snapshots → packages → smb_min_protocol → quickconnect → router_port_forwarding → autoblock → admin_account → firewall, plus optional --rotate-password and --upgrade), reads every setting back to verify, and re-runs the audit.
7. Optional --deep and alert-deploy: Runs nas incident --deep --json (one read-only root collector via Task Scheduler checking root-only logs, crontabs, /bin binaries, accounts, SSH keys, and /proc) and nas alert-deploy --json --test (10-minute health and security monitoring pushed to a webhook).

What you provide along the way

1. NAS address and account (once):
   • DSM URL (for example https://192.0.2.10:5001, plus a VPN/Tailscale URL if used).
   • An administrator username and where its password comes from (op://VAULT/ITEM/password, a password command, or the OS keychain).
   • Your LAN/VPN subnet CIDR(s) to keep allowed in the firewall (for example 192.0.2.0/24).
   • An optional shared folder path for temporary staging (for example /docker/.nas-cli-deploy, used by --deep and alert-deploy).
2. A 6-digit 2FA code (once, if 2-step verification is on):
   • When nas setup exits 3 with "field": "otp", provide the current 6-digit code; --trust-device stores DSM's trusted-device token (0600) so subsequent commands do not need a code.
3. Plan confirmation:
   • Review the dry-run plan before nas incident fix --yes runs (and choose whether to include --rotate-password or --upgrade).

Full agent specification: docs/AGENT-RUNBOOK.md.

flowchart LR
    A["nas incident<br/>read-only audit"] --> B["nas incident fix --dry-run<br/>plan: before → after"]
    B --> C["nas incident fix --yes<br/>apply, read back, audit again"]
    C --> D["nas alert-deploy<br/>check every 10 min → webhook"]
    A -.->|files being encrypted| E["nas incident contain<br/>freeze the encryptor"]
    E --> F["nas incident rescue<br/>memory capture → key search"]

What it checks and fixes

nas incident is read-only. Each item prints PASS, WARN, FAIL or SKIP with a one-line hint (--json outputs structured JSON; schema in schemas/incident.schema.json). Exit status is 1 when any item is FAIL.