Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever one of our server's admins tries to access our machine running Mac OS X Server 10.5 via SSH, I get the following error exactly every 10 seconds in the security log:

sshd[32575]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken

sshd[32575]: error: PAM: Authentication failure for (username) from

sshd[32575]: Failed keyboard-interactive/pam for (username) from

The user is able to log in and work as normal, but this error is dominating the log file. At first we discovered he had a left-over public ssh key on his system, but even after deleting that the error persists. The error keeps appearing every 10 seconds, even when the user is no longer logged into the server!

Has anyone seen this issue before? How can these errors be generated from the same IP even when that machine does not have an open connection to the server? Where else should I look?

Thanks very much for your help!

share|improve this question
I'd go to that machine and see if you can find the process that's opening a periodic network connection on that port to the server first. – Bart Silverstrim Jun 9 '11 at 12:58
up vote 0 down vote accepted

Sounds like some rogue script that runs on and tries to log in. I'd have a look at that host directly.

Or if it's not under your control block it with the firewall. If it indeed is needed than somebody will come screaming at you at you'll have the option to "repair" this. If you have a contact for the server probably drop a mail with some deadline to give a warning.

share|improve this answer
Found it! You were right, the client machine had a monitoring tool in the background that was trying to access the server over and over. Thanks for the help, everyone! – Zach Esposito Jun 9 '11 at 14:54

You might want to look at this

It's for Ubuntu but I believe it might be related.

Basically it's as if the ssh client is looking to authenticate using GSSAPI. I read that the client will try a rekey. This rekey transmits the new credentials to the server.

That would explain the logs being populated every 10 seconds.

Edit: I also found this mailing list tread that talks about GSSAPI and it covers AFS as well...pretty much what you see in your logs. AFS, Kerberos and PAM...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.