Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I desire to do should be pretty simple.

I have an Ubuntu 10.04 box. It's currently configured to authenticate users against a kerberos realm (EXAMPLE.ORG). There is only one realm in the krb5.conf file and it is the default realm.

    default_realm = EXAMPLE.ORG

PAM is configured to use the pam_krb5 module, so if a user account is created on the local machine, and that username matches the username@EXAMPLE.ORG credential, that user may log in by supplying his kerberos password.

What I would like to do instead is create a local user account with a different username, but have it always authenticate against the canonical name in the kerberos server.

For example, the kerberos principal is I would like to create the local account and somehow configure kerberos that when someone attempts to log in as, it uses the principal

I have tried using the auth_to_local_names in krb5.conf, but this doesn't seem to do the trick.

            auth_to_local_names = {

I have tried adding to

In all cases, when I attempt to log in as and enter the password for, I get Access denied.

I even tried using auth_to_local in krb5.conf, but I couldn't get the syntax right.

Is it possible to have a (distinct) local username that for all purposes behaves exactly like a matching username does? If so, how is this done?

share|improve this question
up vote 4 down vote accepted

I figured it out. I didn't need to use auth_to_local at all. I could use .k5login in the user's home directory. First,

cat >

Then, I had to configure PAM to honor the .k5login. In /etc/pam.d/common-auth, where I find auth sufficient, append the option search_k5login.

Thereafter, any attempt to log in as will accept the password for

share|improve this answer
that's awesome. Is it possible to do the same using just settings in krb5.conf? thanks. – Ruslan Nov 9 '15 at 3:22
@Ruslan I don't know. I haven't tried. Let us know what you find. – Jason R. Coombs Nov 10 '15 at 21:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.