From 97019205da071301f9891c3177a7657844bb0fd9 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 09:47:11 +1000 Subject: [PATCH] fix(ipa): create home dir on first login + AuthorizedKeysCommand - security.pam.services.sshd.makeHomeDir: IPA users have no pre-created home directory on the host; without this, sshd opens a session to a missing directory and resets the connection immediately after auth - AuthorizedKeysCommand was already added in previous commit Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index 1aa8deb..2278fe7 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -68,6 +68,11 @@ in AuthorizedKeysCommandUser nobody ''; + # Create the home directory on first login if it doesn't exist yet. + # IPA users have no pre-created home on the host; without this sshd + # opens a session to a non-existent directory and resets the connection. + security.pam.services.sshd.makeHomeDir = true; + # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary. # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates # to IPA without running ipa-client-install.