Lesson 4.63: Service secrets with systemd credentials
The quickest way to give a service its database password is an Environment= line in its unit file, and it is also one of the leakiest: unit files are world-readable, systemctl show prints the value to any user, and the process environment is copied into every child and every crash report. systemd credentials hand a secret to one service as a file under /run/credentials, readable only by that service, and can keep it encrypted on disk. In the lab you find the billing API's password in plain sight, rotate it, store the new one encrypted with systemd-creds and load it with LoadCredentialEncrypted=.
17 min
You will learn to
- Find secrets exposed through Environment= and /proc/PID/environ
- Explain who can read a unit file and systemctl show
- Encrypt a secret with systemd-creds
- Load it with LoadCredentialEncrypted= in a drop-in and reset Environment=
- Verify the credential file and the new environment
Key terms
- Environment=
- A unit setting that puts variables into the service's environment; visible to every user through systemctl show.
- Credential
- A secret systemd hands to one service as a file in /run/credentials/UNIT.
- systemd-creds encrypt
- Seals a secret with the host key or the TPM so the file is useless on another machine.
- LoadCredentialEncrypted=
- Decrypts a credential file at service start and gives it to the service.
- Secret rotation
- Replacing a secret that may have leaked; hiding the old value is not enough.
← How a name is resolved · All lessons · Hash sweeps against allow-lists and IOCs →