>Another use case is getting tickets for Mac users. We have a few users >that ssh into enough different hosts that they want to use kerberized >ssh. Unless we open port 88 to the outside, they have to install Mac >ports and use the MIT kinit. So they can't open port 88 to the outside, but port 88-via-80 is fine? --Ken