As far as I understand, issuing ssh -K somehost will use a kerberos token to authenticate with somehost. Is it possible to specify which file to use as the token?Note that Kerberos is not properly set up on my machine, but I only copied the TGT from a machine on which Kerberos is set up properly.More specifically, I copied the token to /tmp/krb5cc_1000 (where 1000 is my uid), so that klist recognizes the token as follows:  ~ klistTicket cache: FILE:/tmp/krb5cc_1000Default principal: XXX@XXX.COMValid starting       Expires              Service principal  XXXX  XXXXI would like to do this as I currently need to ssh from my Laptop (L) to a gateway server (G) on which I may issue the token and then ssh to the final server (S). Given that the token may be valid for an extended timeframe and that transparent ssh forwarding would simplify my development setup I aim to set up ssh ProxyCommand. However, ssh ProxyCommand requires all keys / tokens to be present on the local machine (L).Currently I am using a ProxyCommand as follows:ProxyCommand ssh gateway nc %h %pThis enables me to establish a connection to (S), however authentication does not finish:OpenSSH_7.3p1-hpn14v11, OpenSSL 1.0.2k  26 Jan 2017debug1: Reading configuration data /home/user/.ssh/configdebug1: /home/user/.ssh/config line 1: Applying options for *debug1: /home/user/.ssh/config line 10: Applying options for Sdebug1: Reading configuration data /etc/ssh/ssh_configdebug1: Executing proxy command: exec ssh GW nc S -p 22debug1: permanently_drop_suid: 1000debug1: identity file /home/user/.ssh/id_rsa type 1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_rsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_dsa type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_dsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_ecdsa type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_ecdsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_ed25519 type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/user/.ssh/id_ed25519-cert type -1debug1: Enabling compatibility mode for protocol 2.0debug1: Local version string SSH-2.0-OpenSSH_7.3p1-hpn14v11debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000debug1: Remote is NON-HPN awaredebug1: Authenticating to S:22 as 'user'debug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug1: AUTH STATE IS 0debug1: kex: algorithm: curve25519-sha256@libssh.orgdebug1: kex: host key algorithm: ecdsa-sha2-nistp256debug1: REQUESTED ENC.NAME is 'chacha20-poly1305@openssh.com'debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: nonedebug1: REQUESTED ENC.NAME is 'chacha20-poly1305@openssh.com'debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: nonedebug1: expecting SSH2_MSG_KEX_ECDH_REPLYI have tried setting GSSAPIAuthentication yes which should force authentication via kerberos as far as I understand.
How can I manually specify token (tgt) for ssh -K?
ssh;kerberos
Is it possible to specify which file to use as the token?No. SSH is using the ticket the same ticket as is visible for klist and accessible using GSSAPI.copied the TGT from a machine on which Kerberos is set up properly.I don't think this is how it works. Start from the start and set up the kerberos properly.This enables me to establish a connection to (S), however authentication does not finish:The authentication did not even start according to this log. It hangs on the key exchange, which is completely another issue (unless you would do gssapi key exchange which you don't do).