I want to setup a ssh server for our users. Our users authenticate against our ldap server with Kerberos encryption, upon which they get access to their home dir's. The ssh server has to listen to the entire world, because our users can be anywhere. So we've decided, we would only allow login with key and configure fail2ban fairly strictly.
The problem with key authentication is that it doesn't work with encrypted home dir's. So I've moved the key authentication outside the users home dir with the "AuthorizedKeysFile" option in sshd_config. The problem then is... the user doesn't get it's home dir on key authentication... of course... they don't request a kerberos principal. How do I configure ssh, so that it does pam authentication after the key login succeeds, so they get they're home dir's too? Does anyone have a good solution for this?