Allow key authentication for SSH proxy users

Author: andre487

roles/ssh_proxy/tasks/main.yml

@@ -37,8 +37,10 @@
     append: false
     create_home: false
     shell: /usr/sbin/nologin
-    password: "{{ item.authentication.password_hash | default('!') }}"
-    password_lock: "{{ item.authentication.type != 'password' }}"
+    # A leading ! or * marks the whole account as locked, so OpenSSH rejects public keys too.
+    # "x" is not a usable crypt hash but leaves key-only accounts eligible for public-key auth.
+    password: "{{ item.authentication.password_hash if item.authentication.type == 'password' else 'x' }}"
+    password_lock: false
     update_password: always
   loop: "{{ megaproxy_services.ssh.users }}"
   when: not ansible_check_mode or megaproxy_group_current.rc == 0

tests/test_ssh_proxy_role.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_key_only_account_is_not_locked_before_public_key_authentication() -> None:
+    tasks = (ROOT / "roles" / "ssh_proxy" / "tasks" / "main.yml").read_text(encoding="utf-8")
+    user_task = tasks.split("- name: Create restricted SSH proxy users", 1)[1].split(
+        "- name: Explain deferred SSH user planning", 1
+    )[0]
+
+    assert "else 'x'" in user_task
+    assert "password_lock: false" in user_task