Skip to content

fix(packer): clear epoch account-expiry on Kali service accounts so clones don't boot degraded #1195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gerrrt merged 1 commit into from
Oct 14, 2026
Merged

fix(packer): clear epoch account-expiry on Kali service accounts so clones don't boot degraded #1195

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions packer/kali/preseed.cfg.pkrtpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,15 @@ d-i grub-installer/bootdev string default
# Packer timed out waiting for SSH (#790, two proof builds on Saruman, 2026-10-08).
# interfaces sources interfaces.d, so this adds eth0 without editing the
# installer's file. A clone's cloud-init configures its own network on top.
#
# The chage loop clears a bogus account-expiry (shadow field 8 == 1, i.e. the
# epoch, 1970-01-02) that Kali's package postinsts leave on service accounts
# (lightdm, _gvm, inetsim, nm-*, dnsmasq, ...). lightdm is the one that bites:
# systemd starts a user@<uid>.service for it (the greeter lingers a session),
# PAM's account step sees the expired account and fails 224/PAM, so every clone
# boots `degraded` (#1194, found on garuda #921). Only accounts actually at the
# epoch are touched; real users (packer, and a clone's operator) have an empty
# expiry field and are left alone.
d-i preseed/late_command string \
printf 'allow-hotplug eth0\niface eth0 inet dhcp\n' > /target/etc/network/interfaces.d/eth0; \
in-target mkdir -p /home/packer/.ssh; \
Expand All @@ -83,6 +92,7 @@ d-i preseed/late_command string \
in-target chmod 600 /home/packer/.ssh/authorized_keys; \
echo 'packer ALL=(ALL) NOPASSWD:ALL' > /target/etc/sudoers.d/90-packer; \
chmod 0440 /target/etc/sudoers.d/90-packer; \
in-target sh -c 'while IFS=: read -r n pass lastchg min max warn inactive expire rest; do [ "$expire" = 1 ] && chage -E -1 "$n"; done < /etc/shadow'; \
in-target systemctl enable ssh qemu-guest-agent

d-i finish-install/reboot_in_progress note
Loading