From ea93eb8c5960cac3608300663acecfa3869808ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?= <1536672+jokesterfr@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:21:06 +0200 Subject: [PATCH] fix(sshd): make authorized_keys fallback readable by the session user The fallback was created via cp as root:root 0600 and relied on a separate chown task to fix ownership. When that chown did not take, sshd could not read /etc/ssh/authorized_keys/ in the unprivileged session, so pubkey auth failed whenever the encrypted home was locked. Replace the cp + chown pair with a single idempotent copy that keeps the file root-owned but world-readable (0644). It contains only public keys, so 0644 is safe and passes StrictModes. --- roles/sshd/tasks/main.yml | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml index caa8308..3a1049f 100644 --- a/roles/sshd/tasks/main.yml +++ b/roles/sshd/tasks/main.yml @@ -51,16 +51,13 @@ mode: "0755" - name: Backup authorized_keys out of HOME dir (if unavailable at startup) - ansible.builtin.command: "cp /home/{{ item }}/.ssh/authorized_keys {{ ssh_authorized_keys_fallback_dir }}/{{ item }}" - loop: "{{ ssh_users.split() }}" - changed_when: false - - - name: Fix ownership - ansible.builtin.file: - path: "{{ ssh_authorized_keys_fallback_dir }}/{{ item }}" - owner: "{{ item }}" - group: "{{ item }}" - mode: "0600" + ansible.builtin.copy: + src: "/home/{{ item }}/.ssh/authorized_keys" + dest: "{{ ssh_authorized_keys_fallback_dir }}/{{ item }}" + remote_src: true + owner: root + group: root + mode: "0644" loop: "{{ ssh_users.split() }}" - name: Remove motd on Debian