fix(packer): clear epoch account-expiry on Kali service accounts so clones don't boot degraded

[Gerrrt]

What

Add one late_command step to packer/kali/preseed.cfg.pkrtpl that clears a bogus account-expiry Kali's package postinsts leave on service accounts.

Why

Kali package postinsts create service accounts (lightdm, _gvm, inetsim, nm-openvpn, nm-openconnect, dnsmasq, tcpdump, mysql, pcscd, rtkit, Debian-snmp, systemd-network, systemd-timesync, _dhcpcd) with their shadow account-expiry pinned to the epoch (field 8 == 1, 1970-01-02). lightdm is the one that bites: systemd starts a user@<uid>.service manager for it (the greeter lingers a session), its PAM account step sees the expired account and fails 224/PAM, and the whole guest boots degraded.

Found on garuda during the #921 §9 pass; fixed live there, and tracked for the template in #1194. This is the template-side fix so fresh clones aren't born degraded.

Change

in-target sh -c 'while IFS=: read -r n pass lastchg min max warn inactive expire rest; do [ "$expire" = 1 ] && chage -E -1 "$n"; done < /etc/shadow'

• Runs at the end of late_command, after package postinsts, so it's the last word before first boot; cloud-init on clones never touches expiry.
• Touches only accounts actually at the epoch. Real users (packer, and a clone's operator) have an empty expiry field and are left alone.
• A while IFS=: read loop (not awk) so there are no $1/$8 tokens for the shell or Packer's templatefile() to expand; the only interpolation token in the file remains ${ssh_public_key}. sh -n-clean.

Scope

• Covers the shared Kali preseed → both 910 (tpl-kali-saruman) and 902 (ifrit's tpl-kali).
• 903 (tpl-debian-13) has the same upstream quirk on two base accounts but is benign (no display manager → no user manager → not degraded), so it needs no change.

Verification

• Local: interpolation tokens unchanged (only ${ssh_public_key}); embedded loop passes sh -n; commit passes scripts/check_close_keywords.py.
• Owed (needs phoenix / ifrit): rebuild 910 + scripts/packer-smoke.sh 910, confirm a fresh first boot is running not degraded; check 902 on ifrit when next built.

Closes #1194

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The narrowly scoped cleanup correctly targets only shadow expiry field 8 values equal to 1.

0 open findings

What changed in this PR

Clears erroneous epoch account-expiry values from Kali service accounts, preventing clones from booting degraded.

Changes:

• Adds a late-install shadow-account cleanup.
• Documents the underlying LightDM/PAM failure.

File	Description
packer/​kali/​preseed.cfg.pkrtpl	Clears epoch expiry values in shared Kali templates 902 and 910.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gerrrt]

As-run verification (phoenix + Saruman, 2026-10-14)

Rebuilt template 910 from this branch and proved the fix end to end.

Build — packer build -force -only='kali.proxmox-iso.kali-saruman' packer/ on phoenix (packer 1.16.1, token from phoenix.env in-env, ufw inactive so no 8800 rule needed):

INIT_EXIT=0
==> found existing resource with ID 910 ... deleting it
==> Successfully deleted 910 / Creating VM / Starting VM ...
BUILD_EXIT=0   (template 910 re-created)

Smoke — scripts/packer-smoke.sh 910:

PASS cloned / PASS cloud-init (user smoke, DHCP) / PASS agent reports 10.0.30.102
PASS hostname smoke-910 / PASS phoenix's key opens smoke@10.0.30.102
template 910 is usable

Degraded-state acceptance — full-cloned the fresh 910 to a throwaway (930), booted it, checked, destroyed it:

system: running          <- was `degraded` before the fix
failed units: 0          <- user@968 no longer fails PAM
accounts still at epoch (field8==1): 0   <- late_command cleared them in the template

So fresh clones of 910 now inherit a clean /etc/shadow and boot running. garuda (162) was already fixed live; this makes the template itself correct for every future clone.

Still owed (not blocking this PR): the same check on 902 (ifrit's Kali, same preseed) when it's next built — it will carry the identical defect until a rebuild picks up this change.