Reinventing Home Directories
summary
Proposes replacing classic /etc-based users with portable, signed systemd-homed accounts that store a JSON user record plus an encrypted home as a LUKS loopback file (or fscrypt backend), bind encryption keys to user passwords or YubiKeys, and synthesize UID, groups and resource limits at login. Implements PAM/systemd session hooks, per-machine bindings to control where a record can log in, and copy/rsync-friendly images; prototype works for laptop use but has remaining SSH, UID-mapping and resize edge cases.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:41Home Directories
- 1:09User Directory
- 2:03User ID
- 3:52Passwords
- 8:14Real Users
- 10:04Gradable Home Directory
- 12:36User Password and Encryption Key
- 13:23Inherent Extensibility
- 17:56Complications
- 20:27Disk Space Assignment
- 21:53Home Directory Assignment
- 25:17Filebased Encryption
- 29:22HomeD
- 30:26Container
- 31:31Trust
- 34:51Home
- 36:51Home D
- 38:52User Records
- 41:21Home Control Tool
- 44:27Recording
- 45:29Sharing
- 48:08Backups
- 48:58User Record
- 50:16File Based Backup
- 51:37Change Password
- 52:43Lock Down
- 54:21PAM
- 55:34SSH authentication
related talks
35mNew security features in systemd
50mPortable Services Are Ready To Use
31mUsing kAFS on Linux for Network Home Directories
57mNamespaces for Security
42mSecuring Filesystem Images for Unprivileged Containers
42mWhat's New in the User Namespace
47msystemd and TPM2
01h 05mImmutable and Stateless Systems with systemd