How to use the command 'systemd-creds' (with examples)

The command ‘systemd-creds’ is a powerful tool that allows users to list, show, encrypt, and decrypt service credentials. It provides an easy way to manage and secure sensitive information used by services. In this article, we will explore different use cases of the ‘systemd-creds’ command, along with their code, motivation, explanation, and example output.

Use case 1: Encrypt a file and set a specific name

Code:

systemd-creds encrypt --name=name path/to/input_file path/to/output

Motivation: We may need to encrypt a file and give it a specific name for organizational purposes. By using this use case, we can encrypt the file while setting a user-defined name.

Explanation:

• encrypt is the sub-command to encrypt the file.
• --name=name specifies the name of the encrypted file.
• path/to/input_file is the path to the file that needs to be encrypted.
• path/to/output is the path to the encrypted output file.

Example output: If we run the command systemd-creds encrypt --name=credentials.txt secret_data.txt credentials.enc, it would encrypt the contents of secret_data.txt and save it as credentials.enc with the name credentials.txt in the metadata.

Use case 2: Decrypt the file again

Code:

systemd-creds decrypt path/to/input_file path/to/output_file

Motivation: Once we have encrypted a file, there might be a need to decrypt it again. This use case allows us to decrypt the previously encrypted file.

Explanation:

• decrypt is the sub-command to decrypt the file.
• path/to/input_file is the path to the encrypted file that needs to be decrypted.
• path/to/output_file is the path where the decrypted output file will be saved.

Example output: If we run the command systemd-creds decrypt credentials.enc decrypted_data.txt, it would decrypt the contents of credentials.enc and save it as decrypted_data.txt.

Use case 3: Encrypt text from stdin

Code:

echo -n text | systemd-creds encrypt --name=name - path/to/output

Motivation: Sometimes we may want to encrypt text directly from the command line without needing to create a file first. This use case allows us to encrypt text provided from stdin.

Explanation:

• echo -n text outputs the text that needs to be encrypted.
• systemd-creds encrypt is the sub-command to encrypt the text.
• --name=name specifies the name of the encrypted output.
• path/to/output is the path where the encrypted output will be saved.
• - is used to denote input from stdin.

Example output: Running the command echo -n "secret text" | systemd-creds encrypt --name=text - encrypted_text.enc would encrypt the text “secret text” and save it as encrypted_text.enc with the name text in the metadata.

Use case 4: Encrypt text and append it to the service file

Code:

echo -n text | systemd-creds encrypt --name=name --pretty - - >> service

Motivation: We might want to directly append encrypted text to a service file for easy access to the credentials. This use case enables us to encrypt text and append it to a service file.

Explanation:

• echo -n text outputs the text that needs to be encrypted.
• systemd-creds encrypt is the sub-command to encrypt the text.
• --name=name specifies the name of the encrypted output.
• --pretty formats the output in a human-readable format.
• - is used to denote input from stdin.
• - denotes the encrypted output that will be appended.
• >> service appends the encrypted output to the end of the file ‘service’.

Example output: If we run the command echo -n "api_key123" | systemd-creds encrypt --name=api_key --pretty - - >> service, it would encrypt the text “api_key123” and append it to the service file in a human-readable format.

Use case 5: Create a credential that is only valid until the given timestamp

Code:

systemd-creds encrypt --not-after="timestamp" path/to/input_file path/to/output_file

Motivation: There might be cases where we need to create a credential that is only valid until a specific timestamp. This use case allows us to set an expiration for the credential.

Explanation:

• encrypt is the sub-command to encrypt the file.
• --not-after="timestamp" specifies the timestamp until which the credential will be valid.
• path/to/input_file is the path to the file that needs to be encrypted.
• path/to/output_file is the path to the encrypted output file.

Example output: If we run the command systemd-creds encrypt --not-after="2022-12-31" secret_data.txt encrypted_data.enc, it would encrypt the contents of secret_data.txt and save it as encrypted_data.enc with an expiration date set to “2022-12-31”.

Conclusion:

The ‘systemd-creds’ command provides essential functionalities to manage service credentials securely. By utilizing the different use cases covered in this article, users can efficiently encrypt, decrypt, and manage sensitive information, making it a valuable tool for system administrators and developers alike.