Clément Désiles
ea93eb8c59
The fallback was created via cp as root:root 0600 and relied on a separate chown task to fix ownership. When that chown did not take, sshd could not read /etc/ssh/authorized_keys/<user> in the unprivileged session, so pubkey auth failed whenever the encrypted home was locked. Replace the cp + chown pair with a single idempotent copy that keeps the file root-owned but world-readable (0644). It contains only public keys, so 0644 is safe and passes StrictModes.
SSH server
Enable authorized_keys fallback
When you encrypt your home data, you cannot allow hardened remote SSH connection. To make this still possible, here is the trick: a fallback authorized_key file: /etc/ssh/authorized_keys/myuser
Simply enable this setting to get this working:
ssh_authorized_keys_fallback_enabled: true
And you're set.