SYSTEMD-CREDS(1) systemd-creds SYSTEMD-CREDS(1) systemd-creds - systemd-creds [...] [...] systemd-creds . . ( ) . ImportCredential= LoadCredential= SetCredential= LoadCredentialEncrypted= SetCredentialEncrypted= systemd.exec(5) . [1]. : list . $CREDENTIALS_DIRECTORY . . "" ( "ramfs") "" ( ) " " ( 0400 ). 250. cat _... . . --json= --transcode= . 250. setup . /var/lib/systemd/credential.secret . / encrypt decrypt . encrypt . 250. encrypt |- |- ( ) ( ) . LoadCredentialEncrypted= SetCredentialEncrypted=. . . --name=. "-" / . "-" --name=. : 1. TPM2 . TPM2 . . 2. /var/lib/systemd/credential.secret . "" . setup . 3. : TPM2 . TPM2 . TPM2 /var/lib/systemd/ . --with-key=. . initrd initrd. TPM2 . Base64. decrypt ( ) . AES256-GCM SHA256 . 250. decrypt |- [|-] encrypt: ( ) ( ) . . . . . --name=. "-" . "-" . --name=. TPM2 / . . 250. --no-ask-password . -h --help . --version . --system list cat . . 250. --user encrypt decrypt ( ). --uid= . UID machine-id(5) . 256. --uid= . UID . --user. "self" . --user --uid= --uid=self . 256. --transcode= cat decrypt . "base64" "unbase64" "hex" "unhex" / Base64 . "help" . encrypt Base64. 250. --newline= cat decrypt . "auto" "yes" "no". "auto" TTY. 250. --pretty, -p encrypt SetCredentialEncrypted= . --name= "-" . 250. --name= encrypt . . . decrypt . . ( --name= ) . . 250. --timestamp=_ encrypt . . systemd.time(7). decrypt "not-after" --not-after= . . 250. --not-after=_ encrypt . . . . systemd.time(7). 250. --with-key=, -H, -T encrypt / . "host" "tpm2" "host+tpm2" "null" "auto" "auto-initrd". . "auto" ( ) TPM2 TPM2 . /var/lib/systemd/ . TPM2 . "auto" TPM2 ( ) /var/lib/systemd/ . "null" ( !). TPM2 . TPM2 UEFI SecureBoot ( . UEFI SecureBoot TPM2 ). "auto-initrd" TPM2 TPM2. "null". / TPM2 . "help" . -H --with-key=host. -T --with-key=tpm2. initrd ( /var/lib/systemd/ ) --with-key=auto-initrd . decrypt . 250. --tpm2-device= TPM2 . TPM2 ( /dev/tpmrm0). "auto" TPM2 ( ). "list" TPM2 . 250. --tpm2-pcrs=PCR[+PCR...] (PCRs) TPM2 . "+" PCR 0...23. PCRs ( ). PCRs systemd-cryptenroll(1). 250. --tpm2-public-key= --tpm2-public-key-pcrs=PCR[+PCR...] PCR TPM2 encrypt. --tpm2-public-key= RSA PEM . tpm2-pcr-public-key.pem /etc/systemd/ /run/systemd/ /usr/lib/systemd/ ( ) . --tpm2-public-key-pcrs= TPM2 PCR ( --tpm2-pcrs= ). 11 (. PCR ). B --tpm-public-key-pcrs=: PCR PCR . . 252. --tpm2-signature= PCR TPM2 systemd-measure(1) decrypt PCR . PCR tpm2-pcr-signature.json /etc/systemd/ /run/systemd/ /usr/lib/systemd/ ( ) . 252. --allow-null . / UEFI SecureBoot TPM2. 256. --refuse-null UEFI SecureBoot TPM2 ( ). 259. --quiet -q . 251. --no-pager (pager). --no-legend . --json= JSON. : "short" ( ) "pretty" ( ) "off" ( JSON ). 0. 1. "hunter2" password.cred. # echo -n hunter2 | systemd-creds encrypt - password.cred password.cred : # systemd-creds decrypt password.cred hunter2 2. SetCredentialEncrypted= "mysql-password" . # systemd-ask-password -n | systemd-creds encrypt --name=mysql-password -p - - Password: **** SetCredentialEncrypted=mysql-password: \ k6iUCUh0RJCQyvL8k8q1UyAAAAABAAAADAAAABAAAAASfFsBoPLIm/dlDoGAAAAAAAAAA \ NAAAAAgAAAAAH4AILIOZ3w6rTzYsBy9G7liaCAd4i+Kpvs8mAgArzwuKxd0ABDjgSeO5k \ mKQc58zM94ZffyRmuNeX1lVHE+9e2YD87KfRFNoDLS7F3YmCb347gCiSk2an9egZ7Y0Xs \ 700Kr6heqQswQEemNEc62k9RJnEl2q7SbcEYguegnPQUATgAIAAsAAAASACA/B90W7E+6 \ yAR9NgiIJvxr9bpElztwzB5lUJAxtMBHIgAQACCaSV9DradOZz4EvO/LSaRyRSq2Hj0ym \ gVJk/dVzE8Uxj8H3RbsT7rIBH02CIgm/Gv1ukSXO3DMHmVQkDG0wEciyageTfrVEer8z5 \ 9cUQfM5ynSaV2UjeUWEHuz4fwDsXGLB9eELXLztzUU9nsAyLvs3ZRR+eEK/A== 1:1 $CREDENTIALS_DIRECTORY/mysql-password . . xyz.service: # mkdir -p /etc/systemd/system/xyz.service.d # systemd-ask-password -n | ( echo "[Service]" && systemd-creds encrypt --name=mysql-password -p - - ) >/etc/systemd/system/xyz.service.d/50-password.conf # systemctl daemon-reload # systemctl restart xyz.service systemd(1), systemd.exec(5), systemd-measure(1) 1. https://systemd.io/CREDENTIALS 3 . . : . systemd 260.2 SYSTEMD-CREDS(1)