Page History

...

1. Turn on GSSAPI options in your ~/.ssh/config file.

   Code Block
   # Specifies whether user authentication based on GSSAPI is allowed. GSSAPIAuthentication yes # Forward (delegate) credentials to the server. GSSAPIDelegateCredentials yes

2. On your non-SLAC machine:

   Code Block
   language bash
   kinit --renew userid@SLAC.STANFORD.EDU || kinit --renewable userid@SLAC.STANFORD.EDU

   OR

   Code Block
   kinit -R userid@SLAC.STANFORD.EDU || kinit -r 7d userid@SLAC.STANFORD.EDU

   
   replace 'userid' with your SLAC username, and replace 'machine' with a slac machine (eg, centos7.slac.stanford.edu). Note: the version of 'kinit' on your machine may have different options, please see your local documentation (eg, 'man kinit' or 'kinit --help'
   
   

3. Then each time before you ssh (or at least once per day), renew your Kerberos ticket with this command (if the renew fails, then you will be prompted to enter your password to get a new Kerberos ticket). As long as your ticket remains renewable and hasn't expired, you can renew it for a longer period without having to enter your password again.

   Code Block
   kinit --renew userid@SLAC.STANFORD.EDU || kinit --renewable userid@SLAC.STANFORD.EDU

   OR

   Code Block
   kinit -R userid@SLAC.STANFORD.EDU || kinit -r 7d userid@SLAC.STANFORD.EDU

   
   Note: the version of 'kinit' on your machine may have different options, please see your local documentation (eg, 'man kinit' or 'kinit --help'

    

4. You can run the 'klist' command on your remote machine to view your Kerberos ticket:

   Code Block
   klist

   'klist -v' will show more details.
   
   

5. Now you can ssh to slac using Kerberos GSSAPI Authentication:

   Code Block
   ssh userid@machine.slac.stanford.edu

6. After you ssh to SLAC, you can run the 'tokens' command to verify you have an AFS token:

   Code Block
   tokens

7. After you ssh to SLAC, you can renew your afs token with this command

   Code Block
   kinit && aklog

...