What config options need to be set to stop the creation of the unique kerberos cache file
Applies to Centrify Enabled OpenSSH
Question:
When Windows users login to a centrified linux/unix server with a password, by default centrify agent will create a unique kerberos cache file with the following format:
krb5cc_<uid>
For example for user with uid=127138
krb5cc_127138
If that file already exists, then a new cache will created with a unique file name:
krb5cc_cdc<uid>_<6 Random Digit>
For example: krb5cc_cdc127138_08XvhG
Please read KB-3167 for detail on how to configure the environment to not the create unique kerberos cache file with password login.
But for user ssh to system with single sign on (SSO), and system is enabled for ticket forwarding, the parameter described in KB-3167 does not take effect and each forwarded ticket would generate a unique kerberos cache file. Why and is there a way to configure the system to not always generate a new file?
Answer:
With stock OpenSSH, this is the expected behavior and currently there is no parameter to override this behavior. With Centrify Enabled OpenSSH, we have implemented a parameter to allow override. This parameter is introduced in Centrify OpenSSH version 5.3.0 and up.
To configure not to create a unique kerberos cache when forwarding the kerberos ticket, please add the following parameter to /etc/centrifydc/ssh/sshd_config file:
Krb5ccUnique yes
Centrify OpenSSH needs to be restarted to take effect.