From 842c24acd8f0086f30c28b40ccba74e76969ecdd Mon Sep 17 00:00:00 2001 From: Damien Date: Wed, 10 Jun 2026 10:41:40 +0200 Subject: [PATCH] Unlock user account on Alpine Use `passwd -u` workaround for reliable unlocking --- cloud-init/user-data-alpine.yml.tftpl | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cloud-init/user-data-alpine.yml.tftpl b/cloud-init/user-data-alpine.yml.tftpl index c805380..8d60b5d 100644 --- a/cloud-init/user-data-alpine.yml.tftpl +++ b/cloud-init/user-data-alpine.yml.tftpl @@ -58,6 +58,11 @@ runcmd: # Enable and start qemu-guest-agent via OpenRC - [ rc-update, add, qemu-guest-agent, default ] - [ rc-service, qemu-guest-agent, start ] + # Unlock the user account: cloud-init's lock_passwd: false is unreliable on + # Alpine (passwd -u refuses on passwordless accounts), so we force the shadow + # entry to "*" ourselves. "*" means: no password login possible, but pubkey + # auth works (unlike "!" which sshd treats as locked). + - [ sh, -c, "sed -i 's/^${username}:!:/${username}:*:/' /etc/shadow" ] # Enable and start Tailscale via OpenRC - [ rc-update, add, tailscale, default ] - [ rc-service, tailscale, start ]