How to Setup Kerberos Server and Client on Ubuntu 18.04 LTS?

Updated: 28 September 2026 · Applies to: Ubuntu 24.04 (MIT Kerberos 1.20)

Ubuntu 18.04 is end of life; these steps are for Ubuntu 24.04. Kerberos provides single sign-on: users authenticate once and get tickets for other services. For a complete identity system, also consider FreeIPA, which includes Kerberos.

Server (KDC)

apt install krb5-kdc krb5-admin-server        # the installer asks for the realm, e.g. EXAMPLE.COM, and server names
krb5_newrealm                                  # creates the realm database
kadmin.local -q "addprinc alice"
kadmin.local -q "addprinc alice/admin"

Give admin rights in /etc/krb5kdc/kadm5.acl (*/admin@EXAMPLE.COM *) and restart krb5-admin-server. Open ports 88 (TCP/UDP) and 749/tcp for clients.

Client

apt install krb5-user        # enter the realm and the KDC name when asked
kinit alice
klist

Note: Kerberos needs correct DNS names and closely synchronised clocks on all machines (install chrony).

Use Kerberos for SSH logins

kadmin -p alice/admin -q "addprinc -randkey host/server1.example.com"
kadmin -p alice/admin -q "ktadd host/server1.example.com"      # run on server1

Set GSSAPIAuthentication yes in /etc/ssh/sshd_config on the server and restart SSH. A user with a ticket (kinit) can then log in without typing a password.