So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a mixture of CentOS 5 and OpenSuSE 13.1. Some of these machines use sssd and some use /etc/krb5.conf. In all of the sshd_confs I've enabled the following options:# Kerberos optionsKerberosAuthentication yesKerberosOrLocalPasswd yesKerberosTicketCleanup yes#KerberosGetAFSToken yes #Not always supported# GSSAPI optionsGSSAPIAuthentication yesGSSAPICleanupCredentials yesI think this may be a pam\sssd problem, but let me put the following diagram to try and clear everything up----------------   ssh -K  ------------------| OpenSuSE 13.1 | -------> | CentOS 5       || sssd          |          | /etc/krb5.conf |-----------------\         | kdc server     |                  ssh -K   ------------------                    \            ^  |                     \           |  v                       - > ------------------                           | CentOS 5       |                           | /etc/krb5.conf |                           | kdc server     |                           ------------------To understand this, if there is an arrow, then that means I can log in without entering another password. So, between the two kdc servers I can log in without a password. From the OpenSuSE box, I have to specify the -K option when performing ssh; however, I am not able to get back from CentOS to OpenSuSE, even when at the console. What I want is to be able to go from any machine to any other, using my ticket, and without having to do the -K option for SSH. Any ideas?
Kerberos Forwarding in SSSD
ssh;pam;sshd;kerberos;sssd