#pragma section-numbers off This page explains how to log in to our servers without having to type in a password. We use kerberos for this rather than RSA/DSA public keys. An extra benefit is that passwordless logins using kerberos are noticably faster than passwordless logins using public key authentication. This is because kerberos uses symmetric cryptography (which is faster) and requires fewer round-trips during the authentication process. [[TableOfContents]] = Prerequisites = You must have openssh client 4.3 or later. Other versions may work, but we make no guarantees. You will also want the {{{krb5-user}}} package if you are using Debian or Ubuntu. For Mac OS X 10.3 and later no additional software is required for the instructions below to work. For further details, check out ["MemberManual/TransferringFiles/OpenAFS"], and follow just the Kerberos instructions. = Instructions = Once a Kerberos client hsa been installed, you must obtain Kerberos tickets. If your username is "fred", you would do this by typing: {{{ kinit fred@HCOOP.NET }}} Then type your password when prompted. Note that you '''must''' capitalize HCOOP.NET and you '''must not''' capitalize your user name. This is important. Next, make sure you have your tickets. To do this, type {{{ klist }}} You should see your tickets and their expiration dates. Last, type {{{ ssh -o 'GSSAPIAuthentication yes' -o 'GSSAPIDelegateCredentials yes' fred@mire.hcoop.net }}} (GSSAPI is sort of like Kerberos. Don't worry about the difference at this point.) If that doesn't work, add "`-vvv`" to the command line and copy and paste the ENTIRE output into an email to hcoop-discuss and we'll tell you what's up. = Automating things = If you do this a lot, you can include the `GSSAPIAuthentication` and `GSSAPIDelegateCredentials` options in your `~/.ssh/config` file. But you should NOT turn on `GSSAPIDelegateCredentials` for arbitrary hosts (make sure you only enable it for HCOOP hosts). Here is an example entry for `~/.ssh/config`: {{{ Host mire.hcoop.net GSSAPIAuthentication yes GSSAPIDelegateCredentials yes User fred }}} This will allow you to type the following, instead of the longer command above. {{{ ssh fred@mire.hcoop.net }}} = If it doesn't work = See the [:MemberManual/ShellAccess/TroubleshootingKerberos:Troubleshooting Kerberos] page if you run into any problems.