# systemd.system-credentials

## NAME



           systemd.system-credentials - System Credentials
    


## DESCRIPTION



           **System and Service Credentials******[1] are data objects that may be
           passed into booted systems or system services as they are invoked.
           They can be acquired from various external sources, and propagated
           into the system and from there into system services. Credentials
           may optionally be encrypted with a machine-specific key and/or
           locked to the local TPM2 device, and are only decrypted when the
           consuming service is invoked.
    
           System credentials may be used to provision and configure various
           aspects of the system. Depending on the consuming component
           credentials are only used on initial invocations or are needed for
           all invocations.
    
           Credentials may be used for any kind of data, binary or text, and
           may carry passwords, secrets, certificates, cryptographic key
           material, identity information, configuration, and more.


## WELL KNOWN SYSTEM CREDENTIALS



           _firstboot.keymap_
               The console key mapping to set (e.g.  "de"). Read by
               systemd-firstboot(1), and only honoured if no console keymap
               has been configured before.
    
               Added in version 252.
    
           _firstboot.locale_ , _firstboot.locale-messages_
               The system locale to set (e.g.  "de_DE.UTF-8"). Read by
               systemd-firstboot(1), and only honoured if no locale has been
               configured before.  _firstboot.locale_ sets "LANG", while
               _firstboot.locale-message_ sets "LC_MESSAGES".
    
               Added in version 252.
    
           _firstboot.timezone_
               The system timezone to set (e.g.  "Europe/Berlin"). Read by
               systemd-firstboot(1), and only honoured if no system timezone
               has been configured before.
    
               Added in version 252.
    
           _login.issue_
               The data of this credential is written to
               /etc/issue.d/50-provision.conf, if the file does not exist
               yet.  agetty(8) reads this file and shows its contents at the
               login prompt of terminal logins. See issue(5) for details.
    
               Consumed by /usr/lib/tmpfiles.d/provision.conf, see
               tmpfiles.d(5).
    
               Added in version 252.
    
           _login.motd_
               The data of this credential is written to
               /etc/motd.d/50-provision.conf, if the file does not exist yet.
               pam_motd(8) reads this file and shows its contents as "message
               of the day" during terminal logins. See motd(5) for details.
    
               Consumed by /usr/lib/tmpfiles.d/provision.conf, see
               tmpfiles.d(5).
    
               Added in version 252.
    
           _network.hosts_
               The data of this credential is written to /etc/hosts, if the
               file does not exist yet. See hosts(5) for details.
    
               Consumed by /usr/lib/tmpfiles.d/provision.conf, see
               tmpfiles.d(5).
    
               Added in version 252.
    
           _network.dns_ , _network.search_domains_
               DNS server information and search domains. Read by
               systemd-resolved.service(8).
    
               Added in version 253.
    
           _network.conf.*_ , _network.link.*_ , _network.netdev.*_ ,
           _network.network.*_
               Configures network devices. Read by
               systemd-network-generator.service(8). These credentials should
               contain valid networkd.conf(5), systemd.link(5),
               systemd.netdev(5), systemd.network(5) configuration data. From
               each matching credential a separate file is created. Example:
               the contents of a credential network.link.50-foobar will be
               copied into a file 50-foobar.link.
    
               Note that the resulting files are created world-readable, it
               is hence recommended to not include secrets in these
               credentials, but supply them via separate credentials directly
               to systemd-networkd.service, e.g.  _network.wireguard.*_  as
               described below.
    
               Added in version 256.
    
           _network.wireguard.*_
               Configures secrets for WireGuard netdevs. Read by
               systemd-networkd.service(8). For more information, refer to
               the **[WireGuard]** section of systemd.netdev(5).
    
               Added in version 256.
    
           _passwd.hashed-password.root_ , _passwd.plaintext-password.root_
               May contain the password (either in UNIX hashed format, or in
               plaintext) for the root users. Read by both
               systemd-firstboot(1) and systemd-sysusers(8), and only
               honoured if no root password has been configured before.
    
               Added in version 252.
    
           _passwd.shell.root_
               The path to the shell program (e.g.  "/bin/bash") for the root
               user. Read by both systemd-firstboot(1) and
               systemd-sysusers(8), and only honoured if no root shell has
               been configured before.
    
               Added in version 252.
    
           _ssh.authorized_keys.root_
               The data of this credential is written to
               /root/.ssh/authorized_keys, if the file does not exist yet.
               This allows provisioning SSH access for the system's root
               user.
    
               Consumed by /usr/lib/tmpfiles.d/provision.conf, see
               tmpfiles.d(5).
    
               Added in version 252.
    
           _ssh.listen_
               May be used to configure SSH sockets the system shall be
               reachable on. See systemd-ssh-generator(8) for details.
    
               Added in version 256.
    
           _sysusers.extra_
               Additional sysusers.d(5) lines to process during boot.
    
               Added in version 252.
    
           _sysctl.extra_
               Additional sysctl.d(5) lines to process during boot.
    
               Added in version 252.
    
           _tmpfiles.extra_
               Additional tmpfiles.d(5) lines to process during boot.
    
               Added in version 252.
    
           _fstab.extra_
               Additional mounts to establish at boot. For details, see
               systemd-fstab-generator(8).
    
               Added in version 254.
    
           _vconsole.keymap_ , _vconsole.keymap_toggle_ , _vconsole.font_ ,
           _vconsole.font_map_ , _vconsole.font_unimap_
               Console settings to apply, see
               systemd-vconsole-setup.service(8) for details.
    
               Added in version 253.
    
           _getty.auto_
               Used for controlling the execution mode of
               systemd-getty-generator. See systemd-getty-generator(8) for
               details.
    
               Added in version 258.
    
           _getty.ttys.serial_ , _getty.ttys.container_
               Used for spawning additional login prompts, see
               systemd-getty-generator(8) for details.
    
               Added in version 254.
    
           _journal.forward_to_socket_
               Used by systemd-journald(8) to determine where to forward log
               messages for socket forwarding, see journald.conf(5) for
               details.
    
               Added in version 256.
    
           _journal.storage_
               Used by systemd-journald(8) to determine where to store
               journal files, see journald.conf(5) for details.
    
               Added in version 256.
    
           _vmm.notify_socket_
               Configures an sd_notify(3) compatible **AF_VSOCK** socket the
               service manager will report status information, ready
               notification and exit status on. For details see systemd(1).
    
               Added in version 253.
    
           _shell.prompt.prefix_ , _shell.prompt.suffix_
               Defines strings to prefix and suffix any interactive UNIX
               shell prompt with. For details see pam_systemd(8).
    
               Added in version 257.
    
           _shell.welcome_
               Define a string to print when an interactive UNIX shell
               initializes. For details see pam_systemd(8).
    
               Added in version 257.
    
           _system.machine_id_
               Takes a 128bit ID to initialize the machine ID from (if it is
               not set yet). Interpreted by the service manager (PID 1). For
               details see systemd(1).
    
               Added in version 254.
    
           _system.hostname_
               Accepts a (transient) hostname to configure during early boot.
               The static hostname specified in /etc/hostname, if configured,
               takes precedence over this setting. Interpreted by the service
               manager (PID 1). For details see systemd(1).
    
               Added in version 254.
    
           _home.add-signing-key.*_
               Adds a new signing key for user records to the system. The
               credential contents should contain a user signing key, for
               example as reported by **homectl get-signing-key**. Multiple keys
               may be specified, and they will be put in place under the name
               of the credential name suffix (which must itself carry the
               .public suffix). For details see homectl(1).
    
               Added in version 258.
    
           _home.create.*_
               Creates a new home area for the specified user with the user
               record data passed in. For details see homectl(1).
    
               Added in version 256.
    
           _home.register.*_
               Registers an existing home area for the specified user with
               the user record data passed in. For details see homectl(1).
    
               Added in version 258.
    
           _cryptsetup.passphrase_ , _cryptsetup.tpm2-pin_ , _cryptsetup.fido2-pin_ ,
           _cryptsetup.pkcs11-pin_ , _cryptsetup.luks2-pin_
               Specifies the passphrase/PINs to use for unlock encrypted
               storage volumes. For details see systemd-cryptsetup(8).
    
               Added in version 256.
    
           _systemd.extra-unit.*_ , _systemd.unit-dropin.*_
               These credentials specify extra units and drop-ins to add to
               the system. For details see systemd-debug-generator(8).
    
               Added in version 256.
    
           _udev.conf.*_ , _udev.rules.*_
               Configures udev configuration file and udev rules. Read by
               systemd-udev-load-credentials.service, which invokes **udevadm**
               **control --load-credentials**. These credentials directly
               translate to a matching udev.conf(5) or udev(7) rules file.
               Example: the contents of a credential udev.conf.50-foobar will
               be copied into a file /run/udev/udev.conf.d/50-foobar.conf,
               and udev.rules.50-foobar will be copied into a file
               /run/udev/rules.d/50-foobar.rules. See udev(7), udev.conf(5),
               and udevadm(8) for details.
    
               Added in version 256.
    
           _import.pull_
               Specified disk images (tarballs and DDIs) to automatically
               download and install at boot. For details see
               systemd-import-generator(8).
    
               Added in version 257.
    
           _userdb.user.*_ , _userdb.group.*_ , _userdb.transient.user.*_ ,
           _userdb.transient.group.*_
               Configure JSON user and group records. Read by
               systemd-userdb-load-credentials.service, which invokes
               **userdbctl load-credentials**. These credentials directly
               translate to matching **JSON User******[2] and**JSON Group******[3] records.
               Example: the contents of a credential userdb.user.foobar will
               be copied into a file /etc/userdb/foobar.user, and
               userdb.group.foobar will be copied into a file
               /etc/userdb/foobar.group. Symlinks for the uid/gid will also
               be created in /etc/userdb/, as well as the
               corresponding.membership files. See**systemd-userdb**(7),
               nss-systemd(8), and userdbctl(1) for details.
    
               Any passed user records must contain uid and gid fields. Any
               passed group records must contain a gid field. For both user
               and group records, the credential suffix (for
               "userdb.user.foobar" the suffix is "foobar") must match the
               user or group name field from the user or group record.
    
               Note that the records created for _userdb.user.*_  and
               _userdb.group.*_  credentials are created in /etc/userdb/ and
               the records created for _userdb.transient.user.*_  and
               _userdb.transient.group.*_  are created in /run/userdb/
               (/etc/passwd and /etc/group are not modified).
    
               Added in version 258.
    
           _fsck.*_
               Read by systemd-fsck@.service, systemd-fsck-root.service, and
               systemd-fsck-usr.service. See systemd-fsck@.service(8) for
               more details.
    
               Added in version 258.
    
           _quotacheck.*_
               Read by systemd-quotacheck@.service and
               systemd-quotacheck-root.service. See systemd-quotacheck(8) for
               more details.
    
               Added in version 258.
    


## NOTES



            1. System and Service Credentials
               https://systemd.io/CREDENTIALS
    
            2. JSON User
               https://systemd.io/USER_RECORD
    
            3. JSON Group
               https://systemd.io/GROUP_RECORD
    


* * *