SYSTEMD-CREDS(1) systemd-creds SYSTEMD-CREDS(1) (NAME) systemd-creds - (SYNOPSIS) systemd-creds [OPTIONS...] COMMAND [ARGS...] (DESCRIPTION) systemd-creds (unit credentials) . . ( ) . ImportCredential=, LoadCredential=, SetCredential=, LoadCredentialEncrypted= SetCredentialEncrypted= systemd.exec(5) . System and Service Credentials[1] . (COMMANDS) : list (execution context) . $CREDENTIALS_DIRECTORY . . : "secure" ( /swap "ramfs") "weak" ( ) "insecure" ( 0400 ). 250. cat credential... . . --json= --transcode= ( ) . 250. setup . /var/lib/systemd/credential.secret . / encrypt decrypt (root) . encrypt . 250. encrypt input|- output|- ( ) ( ) . LoadCredentialEncrypted= SetCredentialEncrypted= . . . --name= . "-" . "-" --name= . (authenticate) : 1. TPM2 . TPM2 . . 2. /var/lib/systemd/credential.secret . <<>> (host) . setup ( ). 3. : TPM2 . TPM2 . TPM2 /var/lib/systemd/ (persistent media) . --with-key= . . initrd initrd . TPM2 . Base64 . decrypt ( ) . AES256-GCM SHA256 . 250. decrypt input|- [output|-] encrypt : ( ) ( ) . . . . . --name= . "-" . "-" . --name= . TPM2 / ( ). . 250. --no-ask-password . -h, --help . --version . (OPTIONS) --system list cat . . 250. --user encrypt decrypt ( ) . --uid= . . . (UID) machine-id(5) . 256. --uid= . UID . --user . "self" . --user --uid= --uid=self . 256. --transcode= cat decrypt ( ) . "base64", "unbase64", "hex" "unhex" Base64 / . "help" . encrypt Base64 . 250. --newline= cat decrypt ( ) . "auto", "yes" "no" . "auto" TTY . 250. --pretty, -p encrypt SetCredentialEncrypted= . --name= "-" . 250. --name=name encrypt . . . decrypt . . ( --name= ) . . 250. --timestamp=timestamp encrypt (timestamp) . . systemd.time(7) . decrypt "not-after" --not-after= . . 250. --not-after=timestamp encrypt . . . . systemd.time(7) . 250. --with-key=, -H, -T encrypt / . "host", "tpm2", "host+tpm2", "null", "auto", "auto-initrd". . . "auto" ( ) TPM2 TPM2 . /var/lib/systemd/ . TPM2 . "auto" TPM2 ( ) /var/lib/systemd/ . "null" ( !). TPM2 . TPM2 UEFI SecureBoot ( . UEFI SecureBoot TPM2 ). "auto-initrd" TPM2 TPM2 . "null" . TPM2 / . "help" . -H --with-key=host . -T --with-key=tpm2 . initrd ( /var/lib/systemd/ ) --with-key=auto-initrd . decrypt . 250. --tpm2-device=PATH TPM2 . TPM2 ( /dev/tpmrm0). "auto" TPM2 ( ) . "list" TPM2 . 250. --tpm2-pcrs=PCR[+PCR...] PCR TPM2 ( ) . PCR 0...23 "+" . PCR ( ). PCR systemd-cryptenroll(1) . 250. --tpm2-public-key=PATH, --tpm2-public-key-pcrs=PCR[+PCR...] PCR TPM2 encrypt . --tpm2-public-key= RSA PEM . tpm2-pcr-public-key.pem /etc/systemd/, /run/systemd/, /usr/lib/systemd/ ( ) . --tpm2-public-key-pcrs= TPM2 PCR ( --tpm2-pcrs= ). 11 ( (UKIs) PCR ). --tpm2-pcrs= --tpm2-public-key-pcrs= : PCR PCR . . 252. --tpm2-signature=PATH TPM2 PCR systemd-measure(1) decrypt PCR . PCR tpm2-pcr-signature.json /etc/systemd/, /run/systemd/, /usr/lib/systemd/ ( ) . 252. --allow-null (null) . / UEFI SecureBoot TPM2 . 256. --refuse-null (null) UEFI SecureBoot TPM2 ( ). 259. --quiet, -q . 251. --no-pager (pager) . --no-legend ( ) . --json=MODE JSON . "short" ( ) "pretty" ( ) "off" ( JSON ) . (EXIT STATUS) 0 . (EXAMPLES) . "hunter2" password.cred . # echo -n hunter2 | systemd-creds encrypt - password.cred password.cred : # systemd-creds decrypt password.cred hunter2 . SetCredentialEncrypted= "mysql-password" . # systemd-ask-password -n | systemd-creds encrypt --name=mysql-password -p - - Password: **** SetCredentialEncrypted=mysql-password: \ k6iUCUh0RJCQyvL8k8q1UyAAAAABAAAADAAAABAAAAASfFsBoPLIm/dlDoGAAAAAAAAAA \ NAAAAAgAAAAAH4AILIOZ3w6rTzYsBy9G7liaCAd4i+Kpvs8mAgArzwuKxd0ABDjgSeO5k \ mKQc58zM94ZffyRmuNeX1lVHE+9e2YD87KfRFNoDLS7F3YmCb347gCiSk2an9egZ7Y0Xs \ 700Kr6heqQswQEemNEc62k9RJnEl2q7SbcEYguegnPQUATgAIAAsAAAASACA/B90W7E+6 \ yAR9NgiIJvxr9bpElztwzB5lUJAxtMBHIgAQACCaSV9DradOZz4EvO/LSaRyRSq2Hj0ym \ gVJk/dVzE8Uxj8H3RbsT7rIBH02CIgm/Gv1ukSXO3DMHmVQkDG0wEciyageTfrVEer8z5 \ 9cUQfM5ynSaV2UjeUWEHuz4fwDsXGLB9eELXLztzUU9nsAyLvs3ZRR+eEK/A== 1:1 $CREDENTIALS_DIRECTORY/mysql-password . drop-in . xyz.service: # mkdir -p /etc/systemd/system/xyz.service.d # systemd-ask-password -n | ( echo "[Service]" && systemd-creds encrypt --name=mysql-password -p - - ) >/etc/systemd/system/xyz.service.d/50-password.conf # systemctl daemon-reload # systemctl restart xyz.service (SEE ALSO) systemd(1), systemd.exec(5), systemd-measure(1) (NOTES) 1. System and Service Credentials https://systemd.io/CREDENTIALS systemd 261.2 SYSTEMD-CREDS(1)