Clément Désiles ea93eb8c59 fix(sshd): make authorized_keys fallback readable by the session user ...

The fallback was created via cp as root:root 0600 and relied on a separate
chown task to fix ownership. When that chown did not take, sshd could not
read /etc/ssh/authorized_keys/<user> in the unprivileged session, so pubkey
auth failed whenever the encrypted home was locked.

Replace the cp + chown pair with a single idempotent copy that keeps the
file root-owned but world-readable (0644). It contains only public keys, so
0644 is safe and passes StrictModes.

2026-09-10 21:21:06 +02:00

..

main.yml

fix(sshd): make authorized_keys fallback readable by the session user

2026-09-10 21:21:06 +02:00