The Innosilicon S11 SiaMaster has SSH capability, but access is password-protected, and Innosilicon has not publicly provided the default SSH password.
Fortunately, the S11 controller board provides a serial console, through uart, that can be used to access the miner's bootloader.
By interrupting the normal boot process and booting Linux (which is already installed on your S11) with a modified kernel command line, it is possible to obtain a temporary root shell. From this shell, the root password can be changed, allowing persistent SSH access to the miner.
FYI, I used Linux to connect to the S11. Its also possible to use other Operating Systems, you would just have to change 1 or 2 steps to make it work for you.
This guide walks through the process step by step.
Warning: This procedure modifies the miner's system configuration. Make sure you understand each step before proceeding. Having a backup of the original firmware and configuration is strongly recommended. Proceed at your own risk
You have three options for getting SSH root access on an Innosilicon S11:
- Manual Configuration (Covered in this guide): The standard process for gaining direct command-line control.
- Firmware v s11_20181026_024244 Build Date 26th of October 2018 02:42 AM
- I have confirmed this method to work for this version of the firmware.
- Firmware v s11_20190424_095412 Build Date 24th of April 2019 09:54 AM
- This method does not work on this version.
- Default Password Discovery: Waiting on the community to crack the default SSH credentials.
- Pre-patched Custom Firmware: I can share a custom build pre-configured with known SSH credentials if there is enough interest. Note: Running unofficial firmware always carries a risk of bricking the ASIC, so proceed with caution.
The Default SSH Password Hash
The default root SSH password is stored in /etc/shadow as a SHA-512 crypt password hash:
$6$LDl3NtVWLpmGp1$52ivJuFI39PLeUerTxouNpwZn/WsJNlxhvQyUwPjJdxnoo2f93D1d904xFefd91qVWWjrC2jnj7Xz5oMaWAep1
The hash follows the standard crypt format:
$6$<salt>$<hash>Breaking it down:
$6$— Indicates the SHA-512 crypt hashing algorithm.LDl3NtVWLpmGp1— The unique salt used when generating the password hash.- The remaining string — The resulting password hash.
Because the password itself is not stored in plaintext, the value in /etc/shadow cannot simply be read as the SSH password. The purpose of this guide is to use the S11's bootloader and serial console to gain temporary root access and set a new password that you control.
What You Will Need
- Innosilicon S11 SiaMaster
- CP2102 USB-to-TTL serial adapter - $10 (USB UART)
- PuTTY - Free Download
- Network connection to the S11
The serial adapter is used only for communicating with the S11's controller board.
1. Connect the CP2102 to the S11
Make sure your S11 is powered off and unplugged.
To gain access to the serial pins on the S11, remove the controller board by following these steps:
- Remove the back fan and the metal separator plate.
- Pull out all three hashboards just far enough to free the controller board.
Leave the power to all hashboards unplugged; they do not need to be powered on for this process.
| CP2102 | S11 |
|---|---|
| GND | GND |
| TXD | RXD |
| RXD | TXD |
The transmit and receive lines are crossed:
CP2102 TXD → S11 RXD
CP2102 RXD → S11 TXD
CP2102 GND → S11 GND
Once the connections are made, connect the CP2102 to your computer's usb port. To make it a little easier on myself, I used a usb extension.
Reconnect everything to your miner, ethernet cable, fans, hash boards and controller board. Leave the controller board out of the machine and make sure its on a non conductive, non static material. The controller board can not fit back into its slot in the s11 because of the cables we have connected to the serial pins.
Do not turn on the power yet.
2. Configure PuTTY
Open PuTTY and select:
Connection type: Serial
Serial line: /dev/ttyUSB0
Speed: 115200
On Linux, the CP2102 will commonly appear as:
/dev/ttyUSB0
On Windows, it will normally appear as a COM port such as:
COM4
Select the appropriate port for your computer.
Click Open and you will get a blank black window.
Pasting Commands into PuTTY
When entering the commands later in this guide, each command should be sent one at a time.
PuTTY has an option that allows text copied from outside PuTTY to be pasted into the terminal. On Linux, Shift+Insert can be used to paste text into the terminal.
Be careful when copying commands.
For example, Ctrl+C should be used to copy text rather than relying on the right mouse button, depending on how your PuTTY configuration is set up.
Also note that highlighting text in PuTTY can place that text into the clipboard.
3. Power On the S11
With PuTTY connected to the serial console, and window open, power on the S11.
You should see a large amount of boot information scrolling through the terminal.
Under normal circumstances, the S11 will eventually continue through its normal boot process and present a login prompt. If none of your hashboards are connected, then you may not see the login prompt.
The root credentials used by the factory firmware are not provided through the normal user interface, so the serial console provides another way to gain access to the underlying Linux system.
4. Interrupt the Normal Boot Process
This is the important part.
With the PuTTY window selected, restart or power-cycle the S11.
As the miner begins booting, repeatedly press a keyboard key in the PuTTY window.
The goal is to interrupt the normal boot process and stop at the U-Boot command prompt.
If successful, you should see:
Zynq>
This is the U-Boot prompt.
At this point, we can manually load the FPGA, kernel, device tree, and root filesystem and modify the Linux boot arguments.
5. Boot Linux With a Root Shell
At the
Zynq> prompt, enter the following commands.Enter each command separately and wait for it to finish before entering the next one.
Command 1
setenv image_flag 0
Command 2
nand read 0x400000 0x580000 0x400000
Command 3
fpga loadb 0 0x400000 0x400000
Command 4
nand read 0x2000000 0x480000 0x80000
Command 5
nand read 0x2080000 0xd80000 0x500000
Command 6
setenv bootargs 'console=ttyPS0,115200 noinitrd root=ubi0:rootfs ro ubi.mtd=8 earlyprintk rootfstype=ubifs rootwait init=/bin/sh'
Command 7
bootm 0x2080000 - 0x2000000
The system should now boot Linux using the modified boot arguments.
6. Confirm Root Shell Access
If everything worked, Linux should eventually stop at a shell prompt:
/#
The /# prompt indicates that you have a root shell.
Type in
cd /
ls -la
You should be able to see a large amount of folders and files.
At this point you have temporary root access to the S11's Linux operating system.
However, this access will disappear when the miner is rebooted.
To make SSH access persistent, we need to set a root password.
7. Remount the Root Filesystem Read/Write
The root filesystem was intentionally booted read-only.
First, in the shell prompt, remount it as read/write:
mount -o remount,rw /
8. Set a New Root Password
Run:
passwd
Linux will ask you to enter a new password. Enter the password you want to use for SSH.
For example, you could use:
admin
Use a strong password on any miner that is accessible from an untrusted network.
9. Remove the Root Password Expiration Date
The S11 firmware's /etc/shadow entry contains a password-aging value.
The following command removes the password date field from the root entry:
sed -i 's|^root:\([^:]*\):[0-9]*:|root:\1::|' /etc/shadow
This prevents the password from being treated as expired based on the existing date value.
10. Return the Root Filesystem to Read-Only
Once the changes are complete, remount the filesystem read-only:
mount -o remount,ro /
You can now power-cycle the miner.
The usb adapter will not be needed for the rest of the tutorial. You should keep it connected just incase you need to resend the commands.
11. Find the S11's IP Address
After powering the S11 back on, allow it a couple of minutes to complete its normal startup process.
Make sure that your computer and your s11 are on the same network.
You can use a network scanner such as Angry IP Scanner to locate the miner.
Once you find the IP address, enter it into your web browser.
For example:
http://10.0.0.15/
If the normal Innosilicon web dashboard interface appears, you have identified the correct IP address.
12. Connect to the S11 Using SSH
Open a terminal on your computer and run:
ssh root@10.0.0.15
Replace 10.0.0.15 with the actual IP address of your S11.
You should be prompted for the root password you created earlier.
After successfully authenticating, you should receive a root shell similar to:
#
Type in
cd /
ls -la
You should be able to see a large amount of folders and files.
You now have persistent root access to the S11 through SSH.
13. Optional: Configure Passwordless SSH
If you are going to administer the S11 frequently, you can configure SSH public-key authentication.
This is especially useful if you want scripts or automation software to connect to the miner without prompting for a password every time.
Generate an SSH Key
On your computer, run:
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_s11 -N ""
If the specified key already exists, SSH will ask whether you want to overwrite it.
Do not overwrite an existing key unless you intend to replace it.
Open a Second Terminal
Keep the first terminal open.
In the second terminal, connect to the S11:
ssh root@10.0.0.15
After logging in, remount the filesystem as read/write:
mount -o remount,rw /
Leave this second terminal open.
Copy the SSH Key to the S11
Return to the first terminal and run:
ssh-copy-id -i ~/.ssh/id_s11.pub root@10.0.0.15
Enter the root password when prompted.
This copies your public SSH key to the S11's authorized keys file.
Return the Filesystem to Read-Only
Go back to the second terminal connected to the S11 and run:
mount -o remount,ro /
14. Test Passwordless SSH
Return to the first terminal.
Run:
ssh root@10.0.0.15
If everything was configured correctly, SSH should connect without asking for the root password.
You should receive a root shell:
#
You have now successfully configured passwordless SSH access to your Innosilicon S11 SiaMaster.
Conclusion
Using the S11's serial console and U-Boot environment, you can interrupt the normal boot process and launch the installed Linux system with a shell as root.
This provides a much more convenient way to work with the S11 than relying exclusively on the web interface or serial console.
