Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to get a Kerberos 5 ticket when ssh-ing to get to a fully-automated login solution.

Typically, you use kinit first and then ssh:

> kinit user@DOMAIN
user@DOMAIN's Password: (enter password)
> ssh user@host
(successful login)

I'd like to simply run ssh user@host and automatically check for a Kerberos ticket. If one isn't there, I'd like it to get a ticket and then log in.

> kdestroy
> ssh user@host
user@DOMAIN's Password: (enter password)
(successful login)
(log off of host)
> klist
(show ticket info)

I'd like this to be configured on a per-host basis, as not every host I log into supports Kerberos.

share|improve this question

migrated from Nov 20 '11 at 1:13

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

I'm assuming you're using OpenSSH, in which case it just doesn't work that way. Besides, getting the TGT is considered the job of the primary authentication program, the client would just be involved in using the TGT to get a service ticket for the client, so if the project did add that functionality, it would look very odd and likely lead to constant confusion on a subject people are already pretty confused on.

That said, you can actually just write a script that wraps around ssh and klist/kinit and either use that directly or alias "ssh" to your script. Once you're executing a script you wrote you can go based off whatever criteria you feel like going off of.

share|improve this answer
I was afraid the only answer would be something along these lines. Thanks anyway. – Joel Aug 24 '11 at 21:00

This is actually somewhat possible if you use pam-krb5 in your PAM chain (before normal password). This will automatically check your username and password against kerberos and attempt to fetch a ticket.

This also works for ssh if you have PAM configured correctly (i.e. entry is in common-auth and common-session). So any host which supports Kerberos for login will also grant a ticket on ssh if a principal with the ssh username exists.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.