How I got back into my own Naked Labs mirror

The login: a manufacturer debug setting left in production

I spent a chunk of this project trying the obvious defaults against the mirror’s open SSH port. Vendor defaults, Yocto defaults, the usual brand and hostname-derived guesses, the Prism Labs variants (Naked Labs was renamed Prism Labs after the shutdown). Dozens of them, across two sessions. None worked.

The reason none worked is that there is nothing to guess. The root password really is empty. This looks like the manufacturer’s debug configuration, the kind of thing an engineer leaves set on the bench, that simply shipped in the production image and was never tightened.

The twist is why I kept missing it. OpenSSH ships with PermitEmptyPasswords no, and Naked Labs left that default in place, so the SSH server flatly refuses an empty password. But the local console login (the tty1 prompt you get on a physically attached keyboard) authenticates through a separate PAM path, and that one does accept the empty password. Same account, same empty password, two different front doors with two different policies.

Hardware you need

Total cost, if you don’t already own this stuff, is under $40.

If you don’t have an external monitor capable of DisplayPort, a cheap “portable monitor” off Amazon ($50 to $70, the laptop-companion kind with DisplayPort and HDMI inputs) works fine.

What you don’t need, despite various Reddit suggestions, is an M.2 SSD enclosure. That was my original plan, and I even bought one (a $25 ORICO-style combo). It is not necessary unless this method fails for you. For the record, the mirror’s M.2 SSD is SATA, not NVMe (model Intel SSD E5400s). If you do buy an enclosure for any reason, get one explicitly labelled “M.2 SATA” or “NVMe + SATA combo.” Pure-NVMe enclosures will not detect the drive.

Opening the case

This is already documented well by whoamarcos in the dormant r/3DScanning teardown thread from a few years ago. Briefly:

1. Power off and unplug the mirror. Wait a minute for the capacitors to drain.
2. Peel the round “Naked” sticker at the top of the back panel. There’s a Phillips screw under it. Remove that screw.
3. The back panel is otherwise held by four spring clips along each side. Insert your pry tool at the bottom-most divot on one side, work it about half an inch deep until you feel the rubber seal release, then another quarter inch until the clip pops. Move up to the next divot. Work both sides progressively, not one side fully.
4. Lift the back clamshell off and set it aside. You don’t need to disconnect any cables. The back is just a passive cover.

If you’re nervous about prying the case, the worst-case outcome is a broken plastic clip, which is cosmetic. The internal electronics are not at risk from this step.

Finding the ports

Once the back is off, you’re looking at a roughly Mini-ITX-shaped motherboard (an H110-SF100 industrial board, Intel H110 chipset, Skylake/Kaby Lake era Celeron). Two ports matter:

• DisplayPort. There is one DisplayPort connector on the rear I/O area of the motherboard. On my unit it had a cable plugged into it, routed internally. You can either follow that cable to see what it reaches (it goes to a service header, not to any display the user sees) and unplug it, or use a different DP port if your unit has multiple. Connect your external monitor to that port.
• USB-C (bottom of case). The bottom of the mirror has an external USB-C port. It’s data-capable and wired directly to the motherboard. I confirmed this by noting that the scale charges through it. Plug your USB-A-to-USB-C adapter in there, then your keyboard.

Internal USB-A ports also exist on the motherboard and would work, but they’re competing with internal devices (the LED ring, the cameras). The bottom USB-C is the cleanest path.

Don’t unplug any of the existing internal cables. Three of them connect to the Intel RealSense cameras (USB 3.0), one goes to the LED ring, one to internal status sensors. Touching them risks bent pins or a failed boot self-test.

Booting and logging in

1. Power on the monitor and select its DisplayPort input.
2. Plug the mirror’s power back in (or hit the power button, depending on your unit).
3. Watch the monitor. After about 5 seconds you’ll see a lot of [ OK ] lines streaming past. That’s systemd bringing up Yocto Linux. After about 30 seconds it stops at a SquirrelFit login: prompt.
4. Type root and press Enter.
5. At Password: just press Enter, leaving it empty.
6. You land in a root shell. The prompt looks something like:

That’s it. You’re in.

Planting an SSH key so you never need the monitor again

The monitor-plus-USB-keyboard approach gets you in once. To get persistent network access to your own device without keeping the case open, plant your Mac or Linux box’s SSH public key. Three things to know first:

1. The rootfs is mounted read-only by default. You need to remount it read-write to add a file: mount -o remount,rw /
2. root’s home is /home/root, not /root. /root literally does not exist on the filesystem. If you put your authorized_keys file in /root/.ssh/, sshd will silently ignore it, because that is not where the user’s home points. This caught me and cost half an hour of head-scratching. Confirm with echo $HOME, which prints /home/root (itself a symlink to /data/root).
3. WiFi must be configured for SSH to reach the device. The static IP I set (<mirror-ip>) only resolves once the wireless interface is associated to the access point. The mirror remembers WiFi profiles in /data/etc/NetworkManager/system-connections/, and the iPhone debug app’s WiFi sheet can configure new ones over BLE.

Sequence from the mirror’s console:

What goes wrong (the gotchas in chronological order)

These are the dead ends I hit in real time. If you attempt this on your own mirror, hitting one of them shouldn’t ruin your evening.

• “My SSD enclosure doesn’t see the Naked drive.” The mirror’s SSD is M.2 SATA, not NVMe. Confirm by looking at the connector edge: B+M keying (two notches) is SATA, M keying (one notch on the right) is NVMe. Don’t buy an NVMe-only enclosure.
• “My USB keyboard isn’t typing anything.” Test with caps-lock first. Does the keyboard LED toggle when you press caps lock? If yes, USB is alive on that port and you just don’t see output yet. If no, try a different USB port (one of the internal USB-A ones on the motherboard) or a different keyboard.
• “The monitor shows nothing at all.” Boot is fast, about 20 to 30 seconds to the login prompt. If you blink you can miss the kernel log. Wait a full minute before concluding the DP port is dead. If you really see nothing, try the other DisplayPort on the motherboard if your unit has more than one.
• “mkdir fails with ‘Read-only file system’.” You haven’t remounted / read-write yet. Run mount -o remount,rw / first.
• “SSH still rejects my key after I put it in /root/.ssh/.” Wrong path. Move it to /home/root/.ssh/ and verify with echo $HOME. root’s home is /home/root, which symlinks to /data/root.
• “curl gets ‘no route to host’ or ‘connection refused’ when fetching the pubkey.” Two separate causes: routing or firewall. On your Mac, ping the mirror’s IP first to confirm reachability. Then lsof -i :8765 to confirm the HTTP server is listening. macOS shows a permission dialog the first time Python opens an inbound port. Accept it.
• “BusyBox head -5 doesn’t work.” Yocto uses BusyBox 1.27, which doesn’t accept GNU shortcuts. Use head -n 5. Many other GNU flags will surprise you: tar --exclude= doesn’t work, ss isn’t installed, and so on. Adjust as you go.

Reversibility

Everything above is non-destructive. If you want to undo it:

• The case clips back together. Replace the screw, re-stick the Naked sticker.
• The SSH pubkey can be removed with rm /home/root/.ssh/authorized_keys (you’d need to be in the shell, of course).
• The rootfs remount goes back to read-only on reboot.

The mirror doesn’t notice that any of this happened. It boots, runs the same coordinator service, makes the same (now unanswered) cloud API calls, and reports the same coordinatorStatus: ONLINE to its own internal state file. Nothing is bricked, nothing is changed, you just have a shell on your own device now.