<html><head></head><body>Was thinking about the ssh part. Ssh has the ability to retrieve keys from ldap. Ok, so not all releases but most of the big distros now ship that ability. FreeIPA is a scalable tool for user management that is easy for users to publish their pub key with into ldap.<br><br><div class="gmail_quote">On May 1, 2020 7:18:36 AM EDT, Solomon Peachy via Ale <ale@ale.org> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On Thu, Apr 30, 2020 at 02:59:44PM -0400, Boris Borisov via Ale wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><a href="https://www.techrepublic.com/article/linux-home-directory-management-is-about-to-undergo-major-change/">https://www.techrepublic.com/article/linux-home-directory-management-is-about-to-undergo-major-change/</a><br></blockquote><br>It provides a good alternative to full-disk encrpytion, and makes <br>homedirectories fully portable from one system to another. (Assuming <br>nothing hardcodes absolute paths, heh..) Each user's homedir becomes <br>its own encrpyted filesystem, accessible only to them, and not even the <br>local admins. Which is both good and bad; depends on the use case and <br>trust model.<br><br>(Worth mentioning that LUKS can have parallel admin/fallback keys, so <br> it's really up to how the admins set things up. The same caveats apply <br> to systemd-homed too..)<br><br>So it's a good option to have for single-user systems or multi-user <br>systems that are accessed via a "local" login (ie on the console or via <br>the likes of full remote sessions ala VNC). Which I suspect encompasses <br>the overwhelming majority of "workstation/desktop" types of use cases.<br><br>Consider the UI implications of using encrypted storage; the current <br>model presents an all-or-nothing approach, and requires a password or <br>other token (which can be the built-in TPM) to be physically present at <br>boot. This new approach allows the base system to be [un]encrypted <br>independently of the user data, and also prevents any given user from <br>being able to decrpyt any other user's data.<br><br>Where systemd-homed falls down is on systems/accounts that are accessed <br>primarily via ssh (and authenticated via ssh keys) -- ie most server-ish <br>use cases. So it's not some universal pancea.<br><br> - Solomon</pre></blockquote></div><br>-- <br>"no government by experts in which the masses do not have the chance to inform the experts as to their needs can be anything but an oligarchy managed in the interests of the few.” - John Dewey</body></html>