Configure Kerberos Server and Client Authentication

Kerberos can be used for mutual authentication (both client and server), or for client authentication only.

When the authentication method is gssapi-keyex, both server and client authentication occur during the key exchange portion of the connection negotiations. If this authentication fails, the connection fails; no subsequent authentication methods are attempted.
When the authentication method is gssapi-with-mic, Kerberos is not used for server authentication. Client authentication using Kerberos is attempted after successful server authentication. If Kerberos authentication fails, other allowed authentication methods are tried.

Here's a quick summary of the important steps. The details are explained in the procedures that follow.

Configure connections to the KDC.
- Add the host principal and install a keytab file on the Secure Shell server host.
- Add client user principals.
Configure the AllowedAuthentications in the server configuration file (as needed).
Configure AllowedAuthentications and GSSAPIDelegateCredentials in the client configuration file (as needed).
Authenticate the client user to the KDC using kinit before you make a Secure Shell connection.

To configure connections to the KDC

Log in to your Secure Shell server.
Confirm that the server is configured to authenticate to your Kerberos realm. If not, install a correctly configured krb5.conf file.
Authenticate to your Kerberos realm using a principal with administrative rights:
```
kinit root/admin
```
Launch the Kerberos administration utility:
```
/usr/krb5/sbin/kadmin
```
Add a host principal for this server. For example, to add the host myhost.sample.com:
```
addprinc -randkey host/myhost.sample.com
```
Extract a keytab file for this server:
```
ktadd host/myhost.sample.com
```
Add a principal for each client user. For example, to add Joe:
```
addprinc joe
```

To configure Secure Shell settings on the server

Edit the AllowedAuthentications keyword:

To	Use
Authenticate both the server and the client using Kerberos	AllowedAuthentications=gssapi-keyex
Authenticate only the client using Kerberos	AllowedAuthentications=gssapi-with-mic

To configure the client

Edit the AllowedAuthentications keyword:

To	Use
Authenticate both the server and the client using Kerberos	AllowedAuthentications=gssapi-keyex
Authenticate only the client using Kerberos	AllowedAuthentications=gssapi-with-mic

(Optional) Edit the GSSAPIDelegateCredentials keyword if you want to enable ticket forwarding:
```
GSSAPIDelegateCredentials=Yes
```

To obtain Kerberos credentials

Before you can connect to the Secure Shell server, you need to obtain your Kerberos credentials.

Use kinit to authenticate.
```
kinit -f
```
NOTE:The -f option is not required. This option requests a forwardable ticket. If ticket forwarding has been enabled (using GSSAPIDelegateCredentials) this ticket is forwarded to the server. This means that you can access other kerberized applications without having to obtain additional Kerberos credentials.
Enter your password for the Kerberos KDC.