Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to figure out the SSH mechanism used while I try to ssh onto a production host. I see that the SSH client can choose among the available modes. But I'm not sure which mode is chosen and how.

The SSHServer side sshd_config is configured for:

UsePAM yes
PasswordAuthentication yes
GSSAPIAuthentication yes
KerberosAuthentication no
KerberosOrLocalPassword no

I want to know if the authentication uses kerberos or ssh_key based.

share|improve this question
up vote 4 down vote accepted

You can use Kerberos authentication using the GSSAPI (Generic Security Services Application Program Interface).

To achieve this you can put these settings on your sshd_config file:

ChallengeResponseAuthentication yes
GSSAPIKeyExchange yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

To enable PAM with password access, you should have this options enabled:

UsePAM yes
PasswordAuthentication yes

Test if everything is working fine issuing a ticket for yourself and then try to connect over ssh and see if the sshd accepts your connection without any password. To do this you first need the Kerberos ticket:

kinit username@EXAMPLE.COM

Check if the ticket has been granted successfully with the klistcommand and then ssh to your server:

ssh -k

If you want some debugging during the connection, just append the -v flag in the ssh command.

share|improve this answer
Thanks, for SSH -v i got Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive,hostbased. And I see failures for GSS and jumped to public and then to passowrd. How is the order determined as kerberos->key->password – broun Jun 19 '14 at 2:37
The order is defined in the client side, with the PreferredAuthentications options in /etc/ssh/ssh_config or in user defined preferences in ~/.ssh/config – Vinícius Ferrão Jun 19 '14 at 2:42
Just one more thing. If you want to use precedence for logins you should seriously consider using the PAM stack and make rules. PAM rules are processed in order, so if you put Kerberos first, it will first try Kerberos authentication (with password, for TGT), then Unix, then LDAP, or whatever. But keep in mind that using PAM only passwords are accepted. – Vinícius Ferrão Jun 19 '14 at 14:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.