Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm using ksshaskpass to add my password protected keys into ssh-agent upon logging into KDE, is there something similar for kerberos?

share|improve this question

3 Answers 3

up vote 10 down vote accepted

I would look into using pam-krb5.

On Debian and Ubuntu, it should be apt-get install libpam-krb5.

The PAM configuration would look something like:

auth required
auth optional try_first_pass


auth required
auth optional use_first_pass   

in /etc/pam.d/common-auth.

It takes the password you used to authenticate locally, e.g. the password in /etc/shadow, and then tries to use the same one as your Kerberos password.

If your Kerberos password is the same as your system password, you don't need to type it again.

If your Kerberos password is different from your system password, what happens depends on whether you used try_first_pass or use_first_pass:

  • try_first_pass will ask you for your Kerberos password
  • use_first_pass won't ask you, but you'll have to run kinit yourself later

Note that this probably makes ksshaskpass redundant too, because you can also have:

auth required
auth optional try_first_pass
auth optional try_first_pass

On Debian and Ubuntu, that requires installing libpam-ssh.

share|improve this answer
Yeah I know about this, but I would like some solution that works with different passwords. – Let_Me_Be Apr 26 '11 at 8:49
@Let_Me_Be: Can you elaborate? try_first_pass or no option should work in that case. – Mikel Apr 28 '11 at 0:39
How would this work if my kerberos username is different from the local username? E.g. gert versus gertvdijk. – gertvdijk Sep 2 '13 at 11:16
It would be great to have kinit using a keyring, does someone know about something like that? – Dave Sep 8 at 10:18

It is possible to automate kinit during SSH login by editing .bash_profile. You need too edit this file at /etc/skel/.bash_profile, logoff and login back for the changes to take effect. Further info can be found on this website vmlinux


share|improve this answer
welcomme to U&L SE, we do appricate if you tell what to do, not merely giving a link. – Archemar Mar 13 at 9:02

Normally, Kerberos would be integrated with PAM It will attempt to acquire a Kerberos ticket based on your username and the password you supply. It can also use that to verify whether you are allowed to login, but that can be set to ignore if you just want the ticket. It needs to be added as both an auth and a session module, probably also password if you plan to keep your Kerberos password in sync with your desktop. If you plan to use Kerberos for verifying a user's login, you should also setup your keytab file at /etc/krb5.keytab with a key for host/ replace hostname and as appropriate for your environment.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.