Are there any good (reliable / free) ssh clients that work easily with Active Directory authenticated accounts in a Windows environment? Ideally that wouldn't need the Kerberos for Windows package?

I know there are various modified versions of putty that support GSSAPI authentication which in turn allows authentication via Kerberos to remote systems if you've authenticated via Kerberos on the local system (IE you've logged into your windows system using an Active Directory account and that same AD account exists on the remote server you're accessing via SSH)

Are there any other ssh clients that support kerberos / GSSAPI authentication using the local windows AD generated Kerberos credentials?

I found this page which has a list of GSSAPI aware windows clients but I've never used any of them. This page also seems to imply that secureCRT also supports kerberos, but again I've never used it in a kerberized environment.

Any experiences with good ssh clients? Good and free?

My experience with various modified versions of putty is that it works great when accessing Kerberized servers but if you tell it to try GSSAPI and then access a non-kerberized server, it hangs for almost a minute before attempting password authentication. It also relies on the MIT Kerberos for Windows Identity Manager, which isn't a deal breaker for me but when I try to explain how it works to others, their eyes start to glaze over as I describe all the moving parts...


  • 1
    The development snapshot of PuTTY has GSSAPI support. – Alex Holst Jun 6 '11 at 22:15
  • @alex thanks I'll take a look at it. Hopefully it has fixed the weird problem with forks of putty where accessing a non-kerberized host with GSSAPI turned on would cause a 45+ second pause before attempting any other authentication. – chris Jun 11 '11 at 2:38

I believe that both putty (see here) and SecureCRT support Kerberos. I've never tried either of them in a kerberized environment, so I can't speak about the delay you mentioned...
There are probably other options available too.

  • It looks like gssapi has been added to putty. I had used a clunky hacked version that would hang for 30 seconds or more if you had gssapi turned on on the client but not the remote system. I don't currently work in an environment that uses kerberos so I can't tell if that issue is the case with the stock putty version. Nevertheless, I think mainline is probably the place to start here. Thx! – chris Apr 30 '13 at 11:50

Have you considered Cygwin's ssh client? I don't actually know if it does this (and don't have a copy around to test with), but I'd imagine it has the capability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.