homectl tips — authorized homed user literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run homectl on the lab host (syllabus box you own or were given access to; systemd-homed must be present).
2. Prefer documenting who / why / ticket before any create/remove/passwd write — never manage production homed users without change control.
3. Record short factual notes; quote short Evidence (username, storage type label, whether home is active — never recovery keys or encryption secrets).
4. Optional: classic create path → useradd-tips.
5. Optional: session peer → loginctl-tips.
6. Prefer disposable lab users for homectl drills; quote homectl list / inspect afterward as Evidence.
7. Prefer read-only list / inspect for most Evidence binders unless the syllabus asks for create/remove.
8. Stop at literacy — no attack or unauthorized home-encryption cookbooks.

Allowed framing

• Classroom labs reviewing homectl list / inspect / create on authorized disposable users.
• Binding short factual notes as Evidence (username/storage labels — no secrets).
• Documenting expected vs observed home state for authorized inventory notes.
• Comparing homectl ↔ useradd / passwd / login peer tip pages under one binder.
• Testing activate/deactivate/passwd only when the syllabus authorizes that drill on lab homes.

Scope we will not cover

• No crack/pirate/keygen via homectl.
• No intentional unauthorized home create/inspect/remove against foreign hosts.
• No secret-theft or recovery-key harvesting against hosts you do not own.
• No cookbooks that weaken home encryption or plant backdoor users without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with systemd-homed available.
2. Prefer a throwaway lab username before any create drill.
3. With authorization, run homectl list and (if created) homectl inspect labuser; quote non-secret username/storage labels as Evidence.
4. Optional: classic peer with useradd-tips; session peer with loginctl-tips.
5. Stop at literacy — no attack or unauthorized home-management cookbooks.

Practical notes for authorized labs

• homectl manages systemd-homed users — keep Evidence labels distinct from classic /etc/passwd useradd-tips.
• Recovery keys and LUKS/fscrypt secrets are highly sensitive — never paste them into notes or git.
• Pair with loginctl-tips for session Evidence after a homed login.
• Prefer documenting storage backend labels the syllabus authorized (directory/luks/…) without dumping key material.
• Never commit home identity JSON with secrets to git — even for labs.
• Label lab-only homed users clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host homed create/inspect/remove → refuse.
• Unauthorized encryption-weaken / backdoor-user cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources