ssh to IP literal

[Greg Hudson]

On Sun, 2010-12-19 at 14:36 -0500, Russ Allbery wrote:
> It uses whatever one the client uses, in general.

Actually, as of MIT krb5 1.7, we usually ignore the principal sent by
the client, because it might be an alias.  If the server application
doesn't specify a principal, we just try every entry in the keytab until
we find one which can decrypt the ticket.

(The exception is when we're using a keytab with no iterator methods,
such as the KDB keytab.)

> There are some services
> that limit what principals they'll accept to only that one principal that
> matches what the service thinks is the local hostname, but given how many
> problems this causes, an increasing number of services will accept any
> principal found in the system keytab.

This is still true.