systemd-homed has been introduced for managing portable home directories.

Lennart Poettering presented (PDF) at the All Systems Go 2019 conference, a new component of the system manager systemd — systemd-homed, aimed at ensuring the portability of user home directories and their separation from system settings. The main idea of the project is to create self-contained environments for user data that can be moved between different systems without worrying about the synchronization of identifiers and privacy.

The home directory environment is provided in the form of a mountable image file, with data encrypted. User credential parameters are tied to the home directory rather than system settings — instead of /etc/passwd and /etc/shadow, it uses profile in JSON format, stored in the directory ~/ .identity. The profile contains the necessary parameters for user operation, including information about the name, password hash, encryption keys, quotas, and provided resources. The profile can be signed digitally, stored on an external Yubikey token.

The parameters may also include additional information, such as SSH keys, biometric authentication data, images, email, address, time zone, language, limits on the number of processes and memory, additional mount flags (nodev, noexec, nosuid), information about the IMAP/SMTP servers used by the user, parental control activation information, backup parameters, etc. An API is provided for requesting and parsing parameters. Varlink.

The assignment and handling of UID/GID is done dynamically in each local system to which the home directory connects. With the proposed system, a user can keep their home directory with them, for example on a Flash drive, and obtain a working environment on any computer without explicitly creating an account on it (the presence of a file with the home directory image leads to user synthesis).

For data encryption, the LUKS2 subsystem is recommended, but systemd-homed also allows the use of other backends, such as unencrypted directories, Btrfs, Fscrypt, and CIFS network partitions. The homectl utility is proposed for managing portable home directories, which allows you to create and activate home directory images, resize them, and set passwords.

At the system level, operation is ensured by the following components:

• systemd-homed.service — manages the home directory and embeds JSON records directly into home directory images;
• pam_systemd — processes parameters from the JSON profile at user login and applies them in the context of the activated session (handles authentication, sets environment variables, etc.);
• systemd-logind.service — processes parameters from the JSON profile at user login, applies various resource management settings, and sets limits;
• nss-systemd — NSS module for glibc, synthesizes classic NSS records based on the JSON profile, providing backward compatibility with the UNIX API for user handling (/etc/password);
• PID 1 — dynamically creates users (synthesizes based on the use of the DynamicUser directive in units) and makes them visible to the rest of the system;
• systemd-userdbd.service — translates UNIX/glibc NSS accounts into JSON records and provides a unified Varlink API for querying and traversing records.

Among the advantages of the proposed system are the ability to manage users when mounting the /etc directory in read-only mode, the absence of the need to synchronize identifiers (UID/GID) between systems, user independence from a specific computer, data locking during transitions to sleep mode, the use of encryption and modern authentication methods. Systemd-homed is planned to be included in the main systemd release in version 244 or 245.

Example user JSON profile:

"autoLogin": true,
"binding": {
"15e19cd24e004b949ddaac60c74aa165": {
"fileSystemType": "ext4",
"fileSystemUUID": "758e88c8-5851-4a2a-b98f-e7474279c111",
"gid": 60232,
"homeDirectory": "/home/test",
"imagePath": "/home/test.home",
"luksCipher": "aes",
"luksCipherMode": "xts-plain64",
"luksUUID": "e63581ba-79fa-4226-b9de-1888393f7573",
"luksVolumeKeySize": 32,
"partitionUUID": "41f9ce04-c927-4b74-a981-c669f93eb4dc",
"storage": "luks",
"uid": 60233,
}
},
"disposition": "regular",
"enforcePasswordPolicy": false,
"lastChangeUSec" : 1565951024279735,
"memberOf" : [
"wheel"
],
"privileged" : {
"hashedPassword" : [
"$6$WHBKvAFFT9jKPA4k$OPY4D5…/"
]
},
"signature" : [
{
"data" : "LU/HeVrPZSzi3M3J…==",
"key" : "——BEGIN PUBLIC KEY——\nMCowBQADK2VwAy…=\n——END PUBLIC KEY——\n"
}
],
"userName" : "test",
"status" : {
"15e19cf24e004b949dfaac60c74aa165" : {
"goodAuthenticationCounter" : 16,
"lastGoodAuthenticationUSec" : 1566309343044322,
"rateLimitBeginUSec" : 1566309342341723,
"rateLimitCount" : 1,
"state" : "inactive",
"service" : "io.systemd.Home",
"diskSize" : 161218667776,
"diskCeiling" : 191371729408,
"diskFloor" : 5242780,
"signedLocally" : true,
}
}

Source: opennet.ru