HOMECTL(1) homectl HOMECTL(1) homectl systemd-homed-firstboot.service - homectl [...] {} [...] homectl . systemd-homed.service(8) . systemd-homed.service . systemd-homed.service . . : o (loopback) LUKS2 /home/*.home. LUKS2. LUKS2. . . o LUKS2 USB. USB . o "fscrypt" ( "ext4") /home/*.homedir. LUKS2 . . o "btrfs" /home/*.homedir. (quota). o /home/*.homedir. LUKS2 "fscrypt" "btrfs". o (CIFS) . systemd-homed.service homectl "" useradd(8) . ( UID 1000) (""). / systemd-homed.service /etc/passwd glibc NSS . getent(1). systemd-homed.service . JSON userdbctl(1). systemd-homed.service : "" (active) " " (inactive) . ( ). . . . . ( systemd-homed.service ): --identity= JSON . "-" . JSON JSON[1]. create update ( ) JSON ( ). 245. --json= -j JSON inspect ( ). "pretty" "short" "off". "pretty" JSON . "short" . "off" () JSON . -j "pretty" "short" . 245. --export-format= -E -EE inspect JSON ( ) JSON . "stripped" . "minimal" . "full" JSON ( ). . : homectl inspect -EE | ssh root@othersystem homectl create -i- . -E -j --export-format=stripped -EE -j --export-format=minimal. "stripped" . "minimal" . 245. --offline (blob) . . 256. --key-name= add-signing-key . ".public". . . 258. --seize= . create register JSON (local.public) . true ( ) false ( ). true create false register. 258. --prompt-new-user firstboot . 256. --prompt-shell= . firstboot --prompt-new-user. true. 259. --prompt-groups= . firstboot --prompt-new-user. true. 259. --chrome= . firstboot --prompt-new-user "chrome" false. 259. --mute-console= . true firstboot --prompt-new-user . false. 259. --match=this|other|any|auto -A -N -T --match= "this" "other" "any" "auto". . . "this" ( ) "other" ( ) "any" ( ). "auto" : . . . . JSON[1] . -A --match=any -T --match=this -N --match=other. "luks" "cifs" : # homectl update lennart -T --storage=luks -N --storage=cifs 258. -H --host= . "@" . ssh ":" "/" . SSH . machinectl -H . IPv6 . -M --machine= . "@" . ".host" ( : "--user --machine=lennart@.host"). "@" (root). "@" ( ) ".host". --no-pager (pager). --no-legend . --no-ask-password . -h --help . --version . / systemd-homed.service. create update : --real-name= -c . GECOS UNIX NSS . 245. --realm= . . DNS . . . . 245. --alias=[,...] . . . . 258. --email-address=_ . $EMAIL . 245. --location= . . : --location="Berlin, Germany" --location="Basement, Room 3a" 245. --icon-name= [2]. 245. --home-dir= -d . . --image-path= . /home/$USER. 245. --uid=_UID (UID) . . systemd-homed . . 60001...60513 . . . ( (binding) ) . systemd-homed (GID) (UID). . 245. --member-of= -G . : --member-of=wheel . systemd-homed UID/GID. groupadd(8). . . . 245. --capability-bounding-set= --capability-ambient-set= ( CAP_WAKE_ALARM CAP_BLOCK_SUSPEND ...) . capabilities(7) . . "~" : . 254. --access-mode= . . . : --access-mode=0700 245. --umask= ( ) ("umask"). umask . 245. --skel= . (skeleton) . . /etc/skel/ . 245. --shell= . . /bin/bash . 245. --setenv=[=] . . "=" . --email= --timezone= --language=. 245. --timezone=_ . $TZ . : --timezone=Europe/Amsterdam "TZ=:Europe/Amsterdam". ( ":" tzset(3).) 245. --language= . $LANG $LANGUAGE --language=de_DE.UTF-8. . 245. --default-area= "" . . $HOME ~/Areas/ . pam_systemd_home(8). . . 258. --ssh-authorized-keys= SSH "@" . SSH SSH . SSH . 245. --pkcs11-token-uri= PKCS#11 RFC 7512 ( YubiKey PIV ) . X.509 . X.509 . PKCS#11 . . PKCS#11 "list" "auto". "list" PKCS#11 . "auto" PKCS#11 ( ). PKCS#11 . PKCS#11/PIV FIDO2 "hmac-secret" ( : YubiKey 5) --fido2-device= . FIDO2 . PKCS#11/PIV FIDO2. PKCS#11/PIV ( / ) FIDO2 . 245. --fido2-credential-algorithm= COSE . "es256". "es256" "rs256" "eddsa". "es256" ECDSA NIST P-256 SHA-256. "rs256" RSA 2048 PKCS#1.5 SHA-256. "eddsa" EDDSA Curve25519 SHA-512. . 251. --fido2-device= Linux "hidraw" ( /dev/hidraw1) FIDO2 "hmac-secret" . FIDO2 HMAC . . FIDO2 . FIDO2 "hidraw" "list" "auto". "list" FIDO2 . "auto" FIDO2 . FIDO2 . FIDO2 "hmac-secret". ( YubiKey 5). . FIDO2 ( homectl update $USER --fido2-device=""). FIDO2 PKCS#11/PIV ( --fido2-device= --pkcs11-token-uri=) . 246. --fido2-with-client-pin=_ FIDO2 PIN ( "clientPin" FIDO2). "yes". (: "clientPin" .) 249. --fido2-with-user-presence=_ FIDO2 ( "up" FIDO2) . "yes". (: "up" .) 249. --fido2-with-user-verification=_ FIDO2 ( "uv" FIDO2). "no". (: "uv" .) 249. --recovery-key=_ . . . . . 247. BLOB --blob= -b --blob=_= -b _= . blob . . blob . blob ( blob ). blob. . Blob [3] blob. 256. --avatar= --login-background= . blob . blob. --blob=_= Blob [3]. 256. --locked=_ . . () ( ). 245. --not-before=_ --not-after=_ systemd.time(7) . 245. --rate-limit-interval= --rate-limit-burst= . . 10 . 245. --password-hint= . . : --password-hint=" ". 245. --enforce-password-policy=_ -P . . . -P --enforce-password-policy=no. 245. --password-change-now=_ . . 245. --password-change-min= --password-change-max= --password-change-warn= --password-change-inactive= ( systemd.time(7)) . --password-change-min= . . --password-change-max= . . --password-change-warn= --password-change-max= . --password-change-inactive= . PKCS#11. 245. --disk-size= ( K M G ... 1024) "min" "max" . ( "%") . "min" "max" . LUKS2 loopback . (quota) . 85% LUKS2 . 245. --nice= ("nice level") . -20 ( ) 19 ( ). 245. --rlimit==[:] getrlimit(2) . ( "LIMIT_NOFILE") . . . . 245. --tasks-max= . ( ) . su(1) . --rlimit=LIMIT_NPROC= UID . TasksMax= systemd user-$UID.slice. systemd.resource-control(5) . 245. --memory-high= --memory-max= ( K M G ... 1024). . MemoryHigh= MemoryMax= systemd user-$UID.slice. systemd.resource-control(5) . 245. --cpu-weight= --io-weight= / (IO) . 1...10000. CPUWeight= IOWeight= systemd user-$UID.slice. systemd.resource-control(5) . 245. --tmp-limit= --tmp-limit=_ --dev-shm-limit= --dev-shm-limit=_ /tmp/ /dev/shm/ . ( K M G T 1024) . . "tmpfs" . ( 80%.) 258. --storage= . "luks" "fscrypt" "directory" "subvolume" "cifs". . homed.conf(5) . 245. --image-path= . . LUKS2 loopback ( /home/ ). /home/$USER.home LUKS /home/$USER.homedir . "cifs". LUKS2 ( USB) . LUKS2. . 245. --drop-caches=_ . fscrypt ( ) . . fscrypt . . 250. LUKS --fs-type= LUKS2 LUKS2 . "btrfs" "ext4" "xfs". homed.conf(5) . "xfs" . 245. --luks-discard=_ LUKS2 "" (discard) . LUKS2 LUKS2 loopback LUKS2 loopback "" (sparse). / . / . LUKS2 ( loopback) . 245. --luks-offline-discard=_ --luks-discard= (trimming) . --luks-discard= --luks-offline-discard= / . . 246. --luks-extra-mount-options= LUKS. . "compress=zstd:1,noacl,user_subvol_rm_allowed". 250. --luks-cipher= --luks-cipher-mode= --luks-volume-key-size= --luks-pbkdf-type= --luks-pbkdf-hash-algorithm= --luks-pbkdf-force-iterations= --luks-pbkdf-time-cost= --luks-pbkdf-memory-cost= --luks-pbkdf-parallel-threads= --luks-sector-size= LUKS2. cryptsetup(8) . homectl /proc/crypto cryptsetup(8) . 245. --auto-resize-mode= / . "off" "grow" "shrink-and-grow". LUKS2 btrfs ( / ). "shrink-and-grow" LUKS2/btrfs "off". "off" / . "grow" --disk-size= . . "shrink-and-grow" . . / . 250. --rebalance-weight= . LUKS2 ( LUKS2 loopback ). . 1 10000 "off". 100 . : 200 100. 20. "off" . ( homectl resize) . --rebalance-weight= . 250. --nosuid=BOOL, --nodev=BOOL, --noexec=BOOL "nosuid" "nodev" "noexec" . "nodev" "nosuid" "noexec" . mount(8). 245. CIFS --cifs-domain=DOMAIN, --cifs-user-name=USER, --cifs-service=SERVICE, --cifs-extra-mount-options=OPTIONS (CIFS) ("") . "cifs". "//host/share/directory/...". . --cifs-extra-mount-options= mount.cifs(8) . 245. --stop-delay=SECS . logind.conf(5) ( 0 LUKS2 ). . 245. --kill-processes=BOOL . logind.conf(5). 245. --auto-login=BOOL . . (off). . 245. --session-launcher=LAUNCHER . .desktop ( "gnome" "plasma"). . 256. --session-type=TYPE . ( "x11" "wayland"). . 256. : list ( ) systemd-homed . . (: /etc/passwd). 245. activate USER [USER...] . ( /home/$USER). ( deactivate) . . LUKS2 : loopback LUKS2 / . 245. deactivate USER [USER...] activate. 245. inspect USER [USER...] ( ). --json= JSON. 245. authenticate USER [USER...] . . 245. create USER, create --identity=PATH [USER] . /. 245. adopt PATH [PATH...] ( *.home *.homedir) . 258. register FILE [FILE...] JSON. . CIFS (): # smbpasswd -a lennart "lennart": $ homectl update lennart --ssh-authorized-keys=... -N --storage=cifs --cifs-service="//$HOSTNAME/lennart" $ homectl get-signing-key | ssh targetsystem homectl add-signing-key --key-name="$HOSTNAME".public $ homectl inspect -E lennart | ssh targetsystem homectl register - $ ssh lennart@targetsystem Samba CIFS . CIFS . 258. unregister USER... . " " (unfixated) . 258. remove USER / . 245. update USER, update --identity=PATH [USER] --identity=. : . 245. passwd USER . 245. resize USER BYTES . LUKS2 loopback . ext4 xfs . btrfs . G M "min" "max". 245. lock USER ( LUKS2). (). (suspend) . 245. unlock USER (lock) . 245. lock-all . 245. deactivate-all . 247. with USER COMMAND... . . 245. rebalance () . 250. firstboot . systemd-homed-firstboot. 256. list-signing-keys local.public . 258. get-signing-key [NAME...] PEM local.public. 258. add-signing-key [FILE...] PEM . : homectl get-signing-key | ssh myotherhost homectl add-signing-key --key-name="$HOSTNAME".public 258. remove-signing-key NAME... . 258. homectl firstboot (credentials) systemd.exec(5) . home.create.* "home.create." . 256. systemd.firstboot= homectl firstboot systemd-firstboot(1). 256. 0 . with homectl . $SYSTEMD_LOG_LEVEL ( ). . ( ) emerg alert crit err warning notice info debug 0 7. syslog(3) . console syslog kmsg journal (: SYSTEMD_LOG_LEVEL=debug,console:info debug info). . $SYSTEMD_LOG_COLOR . tty . journalctl(1) . $SYSTEMD_LOG_TIME . . journalctl(1) . $SYSTEMD_LOG_LOCATION . . . . $SYSTEMD_LOG_TID . (TID). . . $SYSTEMD_LOG_TARGET . : console ( ) console-prefixed ( "" syslog(3) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg ) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg . . "true". systemd kmsg. $SYSTEMD_PAGER $PAGER --no-pager. $SYSTEMD_PAGER $PAGER. $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager. : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C. less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd. less(1) . $SYSTEMD_LESSCHARSET less ( "utf-8" UTF-8). $LESSCHARSET less systemd. $SYSTEMD_PAGERSECURE (pager) less(1) "" . sudo(8) pkexec(1) . . " " ( ). " " --no-pager PAGER=cat . . (true) " " . " " LESSSECURE=1 . less(1) " ". false (pager). SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd " " . " " geteuid(2) sd_pid_get_owner_uid(3) sudo(8) ($SUDO_UID [5]). SYSTEMD_PAGERSECURE=1 " " . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS (boolean) . ( ) systemd . $COLORTERM "truecolor" "24bit" 24 256 $NO_COLOR $TERM . true $NO_COLOR. false . "16" "256" "24bit" ANSI 16 256 24 . "auto-16" "auto-256" "auto-24bit" $TERM . $SYSTEMD_URLIFY . . systemd $TERM . 1. "waldo" "wheel" 500 . homectl create waldo --real-name="Waldo McWaldo" -G wheel --disk-size=500M 2. "wally" USB 500 . homectl create wally --real-name="Wally McWally" --image-path=/dev/disk/by-id/usb-SanDisk_Ultra_Fit_476fff954b2b5c44-0:0 --tasks-max=500 3. (nice level) "odlaw" +5 $SOME "THING" . homectl update odlaw --nice=5 --setenv=SOME=THING 4. YubiKey PKCS#11/PIV: # Yubikey (!) ykman piv reset # / 'pubkey.pem'. ykman piv generate-key -a RSA2048 9d pubkey.pem # . ykman piv generate-certificate --subject "Knobelei" 9d pubkey.pem # rm pubkey.pem # 'lafcadio'. homectl update lafcadio --pkcs11-token-uri=auto 5. FIDO2: # FIDO2 'nihilbaxter'. homectl update nihilbaxter --fido2-device=auto 6. : # 'emily'. homectl update emily --recovery-key=yes systemd(1) systemd-homed.service(8) homed.conf(5) userdbctl(1) useradd(8) cryptsetup(8) 1. JSON https://systemd.io/USER_RECORD 2. https://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html 3. https://systemd.io/USER_RECORD_BLOB_DIRS 4. / https://systemd.io/USER_NAMES 5. $SUDO_UID . 3 . . : . systemd 260.1 HOMECTL(1)