Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been investigating options for minimizing the amount of credentials that need to be retyped as credentials expire. One of the big problems I'm having now is dealing with delegated credentials, which interferes with long-running SSH sessions.

It seems like the GSSAPIRenewalForcesRekey and GSSAPIStoreCredentialsOnRekey options do exactly what I want - when a client renews its ticket, the credentials would be re-sent to the server.

However, the options appear to have no effect at all. For example, once I set up an SSH connection, I expect that running kinit or kinit -R would eventually refresh the credential cache on the server.

Running ssh and sshd in verbose/debug mode doesn't shed any light on this either.

Do I have the wrong idea about what these options do? I would greatly appreciate any information on what I'm doing wrong or alternate ways of accomplishing this.

share|improve this question
up vote 1 down vote accepted

As usual, figured this out 5 minutes after posting. For future reference:

Turning GSSAPIKeyExchange on fixed the problem for me.

GSSAPIRenewalForcesRekey and GSSAPIStoreCredentialsOnRekey require GSSAPIKeyExchange to be turned on before they appear to have any effect. In hindsight, it makes some sense that GSSAPI needs to be in charge of the key exchange, but it would have helped a lot if the documentation pointed out this fact...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.