Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 10 submissions in the queue.

Linux Home Directory Management is About to Undergo Major Change

posted by Fnord666 on Friday May 01 2020, @11:04AM   Printer-friendly
from the resistance-is-futile.-/home-will-be-assimilated dept.

DannyB writes:

Good News:

Linux home directory management is about to undergo major change:

With systemd 245 comes systemd-homed. Along with that, Linux admins will have to change the way they manage users and users' home directories.

[...] Prior to systemd every system and resource was managed by its own tool, which was clumsy and inefficient. Now? Controlling and managing systems on Linux is incredibly easy.

But one of the creators, Leannart Poettering, has always considered systemd to be incomplete. With the upcoming release of systemd 245, Poettering will take his system one step closer to completion. That step is by way of homed.

[...] let's take a look at the /home directory. This is a crucial directory in the Linux filesystem hierarchy, as it contains all user data and configurations. For some admins, this directory is so important, it is often placed on a separate partition or drive than the operating system. By doing this, user data is safe, even if the operating system were to implode.

However, the way /home is handled within the operating system makes migrating the /home directory not nearly as easy as it should be. Why? With the current iteration of systemd, user information (such as ID, full name, home directory, and shell) is stored in /etc/passwd and the password associated with that user is stored in /etc/shadow. The /etc/passwd file can be viewed by anyone, whereas /etc/shadow can only be viewed by those with admin or sudo privileges.

[...] Poettering has decided to make a drastic change. That change is homed. With homed, all information will be placed in a cryptographically signed JSON record for each user. That record will contain all user information such as username, group membership, and password hashes.

Each user home directory will be linked as LUKS-encrypted containers, with the encryption directly coupled to user login. Once systemd-homed detects a user has logged in, the associated home directory is decrypted. Once that user logs out, the home directory is automatically encrypted.

[...] Of course, such a major change doesn't come without its share of caveats. In the case of systemd-homed, that caveat comes by way of SSH. If a systemd-homed home directory is encrypted until a user successfully logs in, how will users be able to log in to a remote machine with SSH?

The big problem with that is the .ssh directory (where SSH stores known_hosts and authorized_keys) would be inaccessible while the user's home directory is encrypted. Of course Poettering knows of this shortcoming. To date, all of the work done with systemd-homed has been with the standard authentication process. You can be sure that Poettering will come up with a solution that takes SSH into consideration.

Older articles:

Will systemd be considered complete once the kernel and boot loader have been absorbed into systemd?

Original Submission

 
This discussion has been archived. No new comments can be posted.
Linux Home Directory Management is About to Undergo Major Change | Log In/Create an Account | Top | 303 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by janrinok on Saturday May 02 2020, @12:43PM (3 children)

    by janrinok (52) Subscriber Badge on Saturday May 02 2020, @12:43PM (#989437) Journal

    You seem to have taken offence to something in the comment that I made - I can assure you that no offence was intended and I apologise if my comment has been misconstrued. You have made comments elsewhere that have positively contributed to the discussion and I was merely surprised.

    As for my 'true colours', I can only point out the claimed advantages [linuxreviews.org] including enhanced security of a user's data:

    Encrypted folders are not new, most Linux distributions have had support for full disk encryption using LUKS for quite some time. It works. It's fine. But it does have some slight problems. Full disk encryption means that the encryption password, the only important password when it comes to protecting your data, has to be known by everyone who is using a computer on a regular basis. Encrypting each user's home directory with a personal key is a fundamentally far better and more logical approach.

    Suspending computers to RAM is also an issue when full disk encryption is used since the encryption keys are kept in RAM while the machine is sleeping. Suspending to disk (hibernating) instead of RAM does solve that one. Most do not use that solution either because both suspending and restoring the system takes longer or because they are unaware that cold-boot attacks are a very real threat to cryptographic security. systemd-homed solves the suspend to RAM case by unmounting home directories before the machine suspends to RAM.

    The ability to easily move home directories around is another clear advantage. This is not just handy if you want your /home/you on a USB stick, it is also very handy when you buy a new computer.

    There's also support for remote CIFS mounted directories built right into systemd-homed. Those who administer a large number of computers within an organization will likely find those aspects of it to be very appealing.

    As someone who does encrypt all of his data the security benefits are of interest to me but, of course, these may not be of interest to everybody. And the use of homed is entirely optional by using 'systemctl mask homed' which prevents it from ever being started even if another service depends upon it.

    Again, I apologise if I have inadvertently caused you any offence.

    --
    I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 2) by gtomorrow on Saturday May 02 2020, @01:26PM (2 children)

    by gtomorrow (2230) on Saturday May 02 2020, @01:26PM (#989448)

    1...2...3...4...5...6...7..8...9...

    This is a big, big virtual forum...go sit somewhere else.

    ...and yet, here you are again. Non-comment-reading-yet-still-replying, thread-losing, obtuse janrinok. The same janrinok who I explained in my last reply that my /home folder is encrypted, hence my concern about homed.

    I'm no more "offended" by you than by anyone else who butts into my conversation with someone else and then has the nerve to reprimand me. I think "annoyed" is more the word. Thanks for nothing for your "I feel I have to apologize but I'm not sure why" apology. You could have saved yourself the trouble by just not responding.

    Don't go away mad...

    • (Score: 0) by Anonymous Coward on Saturday May 02 2020, @01:55PM

      by Anonymous Coward on Saturday May 02 2020, @01:55PM (#989459)

      lol we can tell who is mad in this thread. But I don't blame you for raging, I blame Poettering.

    • (Score: 2) by janrinok on Saturday May 02 2020, @02:05PM

      by janrinok (52) Subscriber Badge on Saturday May 02 2020, @02:05PM (#989466) Journal
      I won't.
      --
      I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.