> homectl [OPTION…] COMMAND … Create, manipulate or inspect home directories. Basic User Manipulation Commands: [list] List home areas inspect USER… Inspect a home area create USER Create a home area update USER Update a home area passwd USER Change password of a home area resize USER SIZE Resize a home area remove USER… Remove a home area Advanced User Manipulation Commands: activate USER… Activate a home area deactivate USER… Deactivate a home area deactivate-all Deactivate all active home areas with USER [COMMAND…] Run shell or command with access to a home area authenticate USER… Authenticate a home area User Migration Commands: adopt PATH… Add an existing home area on this system register PATH… Register a user record locally unregister USER… Unregister a user record locally Signing Keys Commands: list-signing-keys List home signing keys get-signing-key [NAME…] Get a named home signing key add-signing-key FILE… Add home signing key remove-signing-key NAME… Remove home signing key Lock/Unlock Commands: lock USER… Temporarily lock an active home area unlock USER… Unlock a temporarily locked home area lock-all Lock all suitable home areas Other Commands: rebalance Rebalance free space between home areas firstboot Run first-boot home area creation wizard Options: -h --help Show this help --version Show package version --offline Don't update record embedded in home directory -H --host=[USER@]HOST Operate on remote host -M --machine=CONTAINER Operate on local container -I --identity=PATH Read JSON identity from file --json=FORMAT Generate JSON output (pretty, short, or off) -j Equivalent to --json=pretty (on TTY) or --json=short (otherwise) --export-format=FORMAT Strip JSON inspection data (full, stripped, minimal) -E Same as -j --export-format=stripped -EE Same as -j --export-format=minimal --key-name=NAME Key name when adding a signing key --seize=BOOL Whether to strip existing signatures of user record when creating --prompt-new-user firstboot: Query user interactively for user to create --prompt-groups=BOOL In first-boot mode, don't prompt for auxiliary group memberships --prompt-shell=BOOL In first-boot mode, don't prompt for shells --chrome=BOOL In first-boot mode, don't show colour bar at top and bottom of terminal --mute-console=BOOL In first-boot mode, tell kernel/PID 1 to not write to the console while running --no-pager Do not start a pager --no-legend Do not show headers and footers --no-ask-password Do not prompt for password General User Record Properties: -c --real-name=REALNAME Real name for user --realm=REALM Realm to create user in --alias=ALIAS Define alias usernames for this account --email-address=EMAIL Email address for user --location=LOCATION Set location of user on earth --birth-date[=DATE] Set user birth date (YYYY-MM-DD) --icon-name=NAME Icon name for user -d --home-dir=PATH Home directory -u --uid=UID Numeric UID for user -G --member-of=GROUP Add user to group --capability-bounding-set=CAPS Bounding POSIX capability set --capability-ambient-set=CAPS Ambient POSIX capability set --access-mode=MODE User home directory access mode --umask=MODE Umask for user when logging in -k --skel=PATH Skeleton directory to use -s --shell=PATH Shell for account --setenv=VARIABLE[=VALUE] Set an environment variable at log-in --timezone=TIMEZONE Set a time-zone --language=LOCALE Set preferred languages --default-area=AREA Select default area Authentication User Record Properties: --ssh-authorized-keys=KEYS Specify SSH public keys --pkcs11-token-uri=URI URI to PKCS#11 security token containing private key and matching X.509 certificate --fido2-device=PATH Path to FIDO2 hidraw device with hmac-secret extension --fido2-with-client-pin=BOOL Whether to require entering a PIN to unlock the account --fido2-with-user-presence=BOOL Whether to require user presence to unlock the account --fido2-with-user-verification=BOOL Whether to require user verification to unlock the account --recovery-key=BOOL Add a recovery key --recovery-key-file=PATH Write the generated recovery key to a file Blob Directory User Record Properties: -b --blob=[FILENAME=]PATH Path to a replacement blob directory, or replace an individual files in the blob directory --avatar=PATH Path to user avatar picture --login-background=PATH Path to user login background picture Account Management User Record Properties: --locked=BOOL Set locked account state --not-before=TIMESTAMP Do not allow logins before --not-after=TIMESTAMP Do not allow logins after --rate-limit-interval=SECS Login rate-limit interval in seconds --rate-limit-burst=NUMBER Login rate-limit attempts per interval Password Policy User Record Properties: --password-hint=HINT Set Password hint --enforce-password-policy=BOOL Control whether to enforce system's password policy for this user -P Same as --enforce-password-policy=no --password-change-now=BOOL Require the password to be changed on next login --password-change-min=TIME Require minimum time between password changes --password-change-max=TIME Require maximum time between password changes --password-change-warn=TIME How much time to warn before password expiry --password-change-inactive=TIME How much time to block password after expiry Resource Management User Record Properties: --disk-size=BYTES Size to assign the user on disk --nice=NICE Nice level for user --rlimit=LIMIT=VALUE[:VALUE] Set resource limits --tasks-max=MAX Set maximum number of per-user tasks --memory-high=BYTES Set high memory threshold in bytes --memory-max=BYTES Set maximum memory limit --cpu-weight=WEIGHT Set CPU weight --io-weight=WEIGHT Set IO weight --tmp-limit=BYTES|PERCENT Set limit on /tmp/ --dev-shm-limit=BYTES|PERCENT Set limit on /dev/shm/ Storage User Record Properties: --storage=STORAGE Storage type to use (luks, fscrypt, directory, subvolume, cifs) --image-path=PATH Path to image file/directory --drop-caches=BOOL Whether to automatically drop caches on logout LUKS Storage User Record Properties: --fs-type=TYPE File system type to use in case of luks storage (btrfs, ext4, xfs) --luks-discard=BOOL Whether to use 'discard' feature of file system when activated (mounted) --luks-offline-discard=BOOL Whether to trim file on logout --luks-cipher=CIPHER Cipher to use for LUKS encryption --luks-cipher-mode=MODE Cipher mode to use for LUKS encryption --luks-volume-key-size=BITS Volume key size to use for LUKS encryption --luks-pbkdf-type=TYPE Password-based Key Derivation Function to use --luks-pbkdf-hash-algorithm=ALG PBKDF hash algorithm to use --luks-pbkdf-time-cost=SECS Time cost for PBKDF in seconds --luks-pbkdf-memory-cost=BYTES Memory cost for PBKDF in bytes --luks-pbkdf-parallel-threads=N Number of parallel threads for PKBDF --luks-sector-size=BYTES Sector size for LUKS encryption in bytes --luks-extra-mount-options=… LUKS extra mount options --auto-resize-mode=MODE Automatically grow/shrink home on login/logout --rebalance-weight=WEIGHT Weight while rebalancing Mounting User Record Properties: --nosuid=BOOL Control the 'nosuid' flag of the home mount --nodev=BOOL Control the 'nodev' flag of the home mount --noexec=BOOL Control the 'noexec' flag of the home mount CIFS User Record Properties: --cifs-domain=DOMAIN CIFS (Windows) domain --cifs-user-name=USER CIFS (Windows) user name --cifs-service=SERVICE CIFS (Windows) service to mount as home area --cifs-extra-mount-options=… CIFS (Windows) extra mount options Login Behaviour User Record Properties: --stop-delay=SECS How long to leave user services running after logout --kill-processes=BOOL Whether to kill user processes when sessions terminate --auto-login=BOOL Try to log this user in automatically --session-launcher=LAUNCHER Preferred session launcher file --session-type=TYPE Preferred session type See the homectl(1) man page for details.