Assume that several machines with Unix-like OSs are connected to a server, which for example runs LDAP. Its database includes many users: one of them is testuser. This way, testuser can perform a login in any of the machines with the same credentials.

Assume now that testuser successfully logged in host1. Is it possible to make this login valid also for all the other hosts in the domain, so that, when testuser tries to log in them, he is already authenticated?

This should work approximately the following way: each machine belonging to the domain is trusted. When a user logs in a machine, a check is performed if he/she has already logged in another machine of the domain; if no, a password (or key) is required; if yes, user is automatically authenticated also in the current machine.

Plan 9 offers something similar. Is it possible to obtain this with Unix-like OSs?

Edit: by login I mean the successful access to the system shell or GUI. Logins may occur remotely, through ssh, as well as locally, through a keyboard. The authentication method should be password for a local access, password or key for ssh. I would always consider the use of PAM.


1 Answer 1


When using Kerberos as SSO protocol: If a user logs into his/her workstation there's a ticket-granting ticket (TGT) stored in the user's session (e.g. file). With this TGT the user can obtain service tickets for accessing other "kerberized" services, e.g. SSH servers.

This assumes that your security policy allows all systems to be accessed with a common account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .