Disable SSH Kerberos authentication

Description

The SSH daemon must not use Kerberos password authentication. This directive controls whether sshd attempts to validate password credentials against a Kerberos KDC, which is separate from GSSAPI ticket-based authentication.

Rationale

Kerberos password authentication through SSH sends credentials to a KDC for validation, adding an unnecessary authentication path when standard PAM-based or public key methods are available. An attacker could exploit this path to intercept or redirect Kerberos authentication attempts, especially in environments without a properly configured Kerberos realm.

Framework references

Live verification