Destroy expired tickets?

[Simon Wilkinson]

On 6 Nov 2008, at 15:05, Ken Raeburn wrote:

> On Nov 5, 2008, at 21:16, Stefan Monnier wrote:
>> How can I destroy expired tickets?
>>
>> They're useless at best, and in some cases they're positively harmful
>> (their presence prompts `ssh' to contact the KDC to try and delegate
>> credentials, which is a waste if the tickets are expired, and is
>> really
>> annoying when the KDC times out because it's behind a firewall).
>
> Hm, that sounds a bit broken.  I could see, maybe, inferring that you
> want to use Kerberos and prompting to get new tickets, but trying to
> forward expired ones is no good...

I'm not sure which version of ssh is being referred to here, however  
I can comment on what OpenSSH does (I suspect SunSSH has similar  
behaviour)

OpenSSH with my patches calls gss_init_sec_context() for each  
supported mechanism to determine whether it should try key exchange  
for that mechanism (that's because if we pick a key exchange  
mechanism that fails for any reason, we've got not choice but to fail  
the connection).

Depending on your Kerberos library, the presence (or absence) of a  
credentials cache may affect whether the call to gss_init_sec_context 
() causes the KDC to be contacted. It won't have any effect on  
delegation.

S.