You are not logged in.
I recently set up a new system and decided to use systemd-homed (because it seemed like an easy way to encrypt home and perhaps improve portability next time I had to update my system with completely new hardware). I set it up so that my home directory is on a separate, LUKS-encrypted 3TB internal hard drive. However, the hard drive I chose is incredibly loud and it's driving me crazy, so I am considering moving home to an ssd, which would probably be 2TB. In looking over the homed/homectl documentation, I can see how I could use the old 3TB HD in a new system, but I don't see anything about how to move the homed home directory from one physical drive to another. Does anyone know how I might go about doing that (other than rsyncing all the files to a temp drive, removing the old user, creating a new user with home on the new disc and then rsyncing everything over to that)?
Offline
Don't remove the user. With LUKS, your home directory defaults to /home/$USER.home. After transferring your home directory to the new location, you can either mount the new drive as /home (assuming the old one was mounted there) or use homectl with the --image-path option to change the path of the home directory. See homectl(1).
Last edited by tucuxi (2021-01-09 00:31:51)
Offline
Thanks for the reply. I still am a little confused about how to duplicate or replace the setup I have now. When I created the user, I specified the (previously empty) drive as the image path, so homectl set everything up itself with a correctly formatted LUKS volume on the drive. I assume that homectl only does this when I "create" the user, and not when I change the image-path to a new (empty) drive. I kind of understand that I can set up the new drive, creating the LUKS volume myself, and then change the image-path option to the new drive, but I am finding the process to be a bit confusing. Specifically, I'm not sure how to do everything necessary from this step of the arch wiki on homed:
This partition must contain a LUKS2 volume, whose label must be the user name. The LUKS2 volume must contain a LUKS2 token field of type systemd-homed. The JSON data of this token must have a record field, containing a string with base64-encoded data. This data is the JSON user record, in the same serialization as in ~/.identity, though encrypted. The JSON data of this token must also have an iv field, which contains a base64-encoded binary initialization vector for the encryption. The encryption used is the same as the LUKS2 volume itself uses, unlocked by the same volume key, but based on its own IV.
I looked over the man page for crypsetup and I see references to adding a token to the volume, but I'm having trouble translating the steps in the above to the actions and options described in the cryptsetup man page.
Also, once I set this LUKS volume up correctly, all I need to do is change the image-path and homectl will take care of everything else?
Offline
What command did you use to create the homed user originally?
Offline
I used the options to create the home directory inside a luks volume, but using the instructions for setting it up on removable media (as the wiki notes, it doesn't really have to be removable media, so this worked as I intended, using the whole disk for the LUKS volume):
homectl create username --storage=luks --image-path=/dev/disk/by-uuid/[actual uuid]
Offline
Okay, so my setup is different. I use a LUKS volume inside a loopback file. Disregard the suggestions in my first reply. I'd probably also go the route of creating a new user and transferring all files to that user's home directory.
Offline
Okay, thanks. I did try some things to see whether I could get it to work without removing and recreating the user, but no luck.
Specifically, I tried creating a new test user with the image path for home on a USB drive. I then used a second USB drive and created a new LUKS volume and filesystem, following the instructions in my post above (i.e., with all the right labels). To get the token for the LUKS header, I just exported the token from the first drive and imported it to the new drive, but I'm guessing that this isn't right and may be part of my problem.
I then tried to use "homectl update" to change the image-path for the test user from the first USB drive to the second, but then I couldn't log in to the test account either with the new or the old USB drive plugged in (it worked before trying to change the path). It said the media on which home was located was not available.
When I used "homectl inspect" to check the details of the user, it has two places where it lists the image path, and one lists the old image path and one lists the new one. I'm not sure how to update the user info so that this is consistent, and again, I'm guessing that the token in the LUKS header might also be part of the problem. If anyone else has any ideas, I'd love to hear them.
Offline