A way to automatically get a ticket through ssh for a local user

[Mark Pröhl]

On 07/15/2016 12:25 AM, Brandon Allbery wrote:
> On 7/14/16, 17:32, "kerberos-bounces at mit.edu on behalf of Mauro Cazzari" <kerberos-bounces at mit.edu on behalf of mymagicid at gmail.com> wrote:
> 
>     # Kerberos options
>     KerberosAuthentication yes
>     KerberosOrLocalPasswd yes
>     KerberosTicketCleanup yes
>     #KerberosGetAFSToken no
>     #KerberosUseKuserok yes
>     
>     
> I would turn these off; they refer to an older Kerberos API in ssh and may interfere with GSSAPI.
> 
> The others look correct. Note that if it is using public key authentication to get to the next server, it will not use the Kerberos code and therefore won’t forward (delegate) credentials to the next server. (Also note that if there are other matching Host blocks, the “Host *” block in ssh_config won’t be used.
> 
> 

and remember that tickets need to be flagged as forwardable (i.e. "kinit
-f ..." or by setting "forwardable  = true" in /etc/krb5.conf,
[libdefaults])