Updated: 28 September 2026 · Applies to: Ubuntu 24.04 (MIT Kerberos 1.20)
Ubuntu 18.04 is end of life; these steps are for Ubuntu 24.04. Kerberos provides single sign-on: users authenticate once and get tickets for other services. For a complete identity system, also consider FreeIPA, which includes Kerberos.
Server (KDC)
apt install krb5-kdc krb5-admin-server # the installer asks for the realm, e.g. EXAMPLE.COM, and server names krb5_newrealm # creates the realm database kadmin.local -q "addprinc alice" kadmin.local -q "addprinc alice/admin"
Give admin rights in /etc/krb5kdc/kadm5.acl (*/admin@EXAMPLE.COM *) and restart krb5-admin-server. Open ports 88 (TCP/UDP) and 749/tcp for clients.
Client
apt install krb5-user # enter the realm and the KDC name when asked kinit alice klist
Note: Kerberos needs correct DNS names and closely synchronised clocks on all machines (install chrony).
Use Kerberos for SSH logins
kadmin -p alice/admin -q "addprinc -randkey host/server1.example.com" kadmin -p alice/admin -q "ktadd host/server1.example.com" # run on server1
Set GSSAPIAuthentication yes in /etc/ssh/sshd_config on the server and restart SSH. A user with a ticket (kinit) can then log in without typing a password.
