Forwarding kerberos ticket

[CowTux]

I can't forward my kerberos credentials to a computing resource before connecting to the resource for which I have kerberos credentials. In other words, from my machine at work I obtain my ticket with kinit -f to a computing facility off in some lab somewhere. Then, I want to ssh to another machine in another department (I don't have control over the krb5.conf file or this would have been easy) where I work. It is on this machine I want to be able to ssh,scp, etc to this far off lab.

I've tried several options around this barrier, but I'm a total failure thus far.
I checked that GSSAPIAuthentication is set to yes.

work$ ssh -v -A -o "GSSAPIDelegateCredentials yes"  me@otherdept.net

doesn't forward my credential. But, it does remind me the server is not found in the kerberos database.

I've also tried ssh port forwarding (only locally) from the other dept (after I have a valid ticket of course on my work machine).

dept$ ssh -L 9999:somelab:22 me@work.net

returns:
Permission denied (gssapi-keyex,gssapi-with-mic,keyboard-interactive).

Does anyone have any suggestions?

Thanks in advance.

C

[Redagadir]

you have 2 issues to take care of:
1. is your remote server added to the kdc server? <- if not, there is nothing to delegate...
2. is your remote sshd server allowing GSSAPIDelegateCredentials on setting? <- if not, ssh options won't be able to change its value.

servlet jsp

[CowTux]

Thanks for the reply.

I'm still a little confused, to which servers were you referring?

This looks like there isn't anything I can do about it if you are referring to the servers I think you are referring.

C