Which DVR for getting shell access?

I'm researching the purchase of a DVR for a basic home surveillance set up. I'd like to find one that has 8 channels, IP cameras with nighttime LED's, POE ports so I don't have to mess with power adapters and cables, 1080 video would be nice, but I could probably live with less. Initially I'll probably have 3 or 4 cameras, but I'd like the extra channels in case I decide to expand later on.

I've found a few models out there that have all that but there's one thing I'm having difficulty figuring out. I'm a SysAdmin by trade with quite a few years of Linux experience. I'd really like to find a surveillance DVR setup that I can get root access via ssh into the thing. I don't mind opening it up and poking around a bit. Hopefully someone around these forums can give a tip on which DVR's can be tweaked to allow access into the OS.

So far the Lorex and Swann DVR's seem to fit my requirements but I can't tell if shell access is gonna be doable on them.

If you send me an PM with your email address, I can give you a list. For security reasons, I won't post publicly.

FYI, these also have security exploits because of the telnet access and poor security coding.

Mind posting what DVR/NVR model numbers you are looking into getting as well as if you can find some type of firmware update image for them? Also, be aware that there are many IP camera's that run the EXACT same ARM CPU's as the DVR's, using the same insecure HighEasy Linux distro/SDK, not only that they inherit some of the same instability issues as the Chinese DVR's sold. I'd be curious to look at the firmware and see if I can find a method to get into them.

Out of the 4 different brand DVR's I've tried, I was able to obtain root on all 4 using similar methods, one of them was just a pathetic oversight, it allowed updating by sending the correct commands to the DVR's remote command server to imitate an ftp_get of a file named update.tar.gz and then extract it to / and reboot the DVR automatically. All i had to do was make a file update.tar.gz with /etc/passwd in it and bingo, I had telnet access. I'd rather not specify what model/manufacturer it is, I have contacted them and have a fixed firmware update for it that they will be releasing, so I'm not going to reveal too much for the sake people with the DVR as I know people love messing with DVR's (4chan, etc).

Two that I've looked at are Swann SWHDK-882004 and Lorex LNR300 series. Both are 8 channel 1080P. The Swann kits comes with 4 cameras.

My intent is to set up video surveillance with 3 maybe 4 cameras to start, I want 1080p video and the cameras should have IR for night time. I want the DVR/NVR to be capable of handling 8 cameras for future camera additions. I do not want to be restricted to using ActiveX for viewing feeds either locally or remotely. I'm predominantly a Linux user and being locked into viewing only from ActiveX is kind of a deal breaker.

Ideally I want to be able to get into the Linux OS on the DVR/NVR and add scripts, set up cron jobs, do typical system admin work in the embedded OS.

If I could find a capture card that would handle 8 channels of 1080P video and is zoneminder compatible I'd just go the DIY route and build the system myself. But so far I haven't found a card that meets those specs.