I've picked up a Kimax U35NF. Which from what I can tell is very similar to the U35WF and U25AWF-H1. I've followed the guide and ran into the same issue with the device. And here's what I've learned.
The reason why this happens is that the OEM GUI flash method preserves the unix user configuration in the /etc/passwd
and /etc/shadow
files from the Kimax firmware and copies them over to OpenWrt.
/etc/passwd:
admin:x:0:0:root:/root:/bin/false
guest:x:0:0:root:/root:/bin/false
#root:x:0:0:root:/root:/bin/false
daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/media:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false
dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
mosquitto:x:200:200:mosquitto:/var/run/mosquitto:/bin/false
transmission:x:224:224:transmission:/var/run/transmission:/bin/false
/etc/shadow:
admin:$1$Z5FsiL75$i03Ki.liQdww.hVguzGTk/:17389:0:99999:7:::
guest:$1$GomkE06v$9RAvXRJ08AlYgbM43Ymb1.:17401:0:0:99999:7:::
daemon:*:0:0:99999:7:::
#ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
mosquitto:x:0:0:99999:7:::
transmission:x:0:0:99999:7:::
The problem with these configurations is that the "root" account is disabled for login and the password for the other admin (which is: kimax) and guest (which is: guest) will not help because these accounts have no shell (/bin/false). So the old configuration has to be wiped in order to get to the device.
Luckily, there is a easy way to do this without opening the device:
https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset#factory_reset
1. Power on the device and wait for the status led to stop flashing (or go in Failsafe Mode above).
2. Press and keep pushed the Reset button for 10 seconds.
3. Release the Reset button
Then let it reboot and once the LEDs stop flashing, you can enter it via
ssh root@192.168.1.1
and go from there.
Now, I did make the mistake of flashing the wrong image at first. I loaded the U35WF Image instead of the U25AWF-H1 and as a result the reset button wasn't working (I was getting the same "wrong password" error like you). So I had to wire-up the uart (as shown in Blueendless Kimax BS-U35-WF I can confirm that it works! ) and then I was able to flash my my U35NF with the U25AWF-H1 image on through the bootloader menu.
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP. <---
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
Final thought: This would have been much easier if I had flashed the right image from the beginning. So I guess for anybody who is wondering which image to take: Please take a close look of the SoC and the WIFI/Connect LED color. If you have a MT7620A (v2 board?) and the Wifi-LED is red then I would go with U25AWF-H1. If you have a MT7620N (v3 board?) and the Wifi LED is blue then the U35WF is probably the right board.
I think the HDD LED seems to be blue in both cases? (can somebody confirm that?)