userdbctl tips — authorized UserDB literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run userdbctl on the lab host (syllabus box you own or were given access to; userdb services must be present).
2. Prefer documenting who / why / ticket before any privileged UserDB write — never change production identity services without change control.
3. Record short factual notes; quote short Evidence (username, UID/GID, providing service — never password hashes or recovery keys).
4. Optional: NSS peer → getent-tips.
5. Optional: homed peer → homectl-tips.
6. Prefer disposable lab users for userdbctl drills; quote userdbctl user labuser afterward as Evidence.
7. Prefer read-only user / group / services for most Evidence binders unless the syllabus asks for privileged writes.
8. Stop at literacy — no attack or unauthorized identity-enumeration cookbooks.

Allowed framing

• Classroom labs reviewing userdbctl user / group / services on authorized disposable hosts.
• Binding short factual notes as Evidence (username/UID/service — no secrets).
• Documenting expected vs observed UserDB provider for authorized inventory notes.
• Comparing userdbctl ↔ getent / homectl / loginctl peer tip pages under one binder.
• Testing privileged UserDB paths only when the syllabus authorizes that drill on lab hosts.

Scope we will not cover

• No crack/pirate/keygen via userdbctl.
• No intentional unauthorized UserDB dumps against foreign hosts.
• No secret-theft or hash harvesting against hosts you do not own.
• No cookbooks that weaken identity providers or plant backdoor users without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with systemd-userdbd (or equivalent) available.
2. Prefer a throwaway lab username before any privileged drill.
3. With authorization, run userdbctl services and userdbctl user labuser; quote non-secret username/UID/service labels as Evidence.
4. Optional: NSS peer with getent-tips; homed peer with homectl-tips.
5. Stop at literacy — no attack or unauthorized identity-dump cookbooks.

Practical notes for authorized labs

• userdbctl aggregates UserDB providers — keep Evidence labels distinct from classic getent-tips NSS views.
• Password hashes and recovery keys are highly sensitive — never paste them into notes or git.
• Pair with loginctl-tips for session Evidence after a UserDB-backed login.
• Prefer documenting providing-service labels the syllabus authorized without dumping full JSON blobs with secrets.
• Never commit UserDB JSON with secrets to git — even for labs.
• Label lab-only UserDB providers clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host UserDB dump → refuse.
• Unauthorized identity-weaken / backdoor-user cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources