# kadmin -p host/red.fnal.gov
	Enter password: (enter the password you were given)
	kadmin:  ktadd host/red.fnal.gov
	Entry for principal host/red.fnal.gov with kvno 2, encryption
	  type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
	kadmin:  exit
	# kadmin -p ftp/red.fnal.gov
	Enter password: (enter the password you were given)
	kadmin:  ktadd ftp/red.fnal.gov
	Entry for principal ftp/red.fnal.gov with kvno 2, encryption
	  type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
	kadmin:  exit

This is the easy part.  The hard part is setting up ssh to authenticate against kerberos.  Here's the sshd_config file that I finally got to work correctly:

$OpenBSD: sshd_config,v 1.48 2002/02/19 02:50:59 deraadt Exp

# This is the sshd server system-wide configuration file.  See sshd(8
# for more information

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

#Port 22

#Protocol 2,1

#ListenAddress 0.0.0.0

#ListenAddress ::

# HostKey for protocol version 1

#HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key

#KeyRegenerationInterval 3600

#ServerKeyBits 768

# Logging

#obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

#SyslogFacility AUTHPRIV

#LogLevel INFO



# Authentication:

#LoginGraceTime 600
#PermitRootLogin yes

#StrictModes yes



RSAAuthentication no

PubkeyAuthentication no

#AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used

#RhostsAuthentication no

# Don't read the user's ~/.rhosts and ~/.shosts files

IgnoreRhosts no

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

RhostsRSAAuthentication yes

# similar for protocol version 2

HostbasedAuthentication yes

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

#PermitEmptyPasswords no



# Change to no to disable s/key passwords

ChallengeResponseAuthentication no



# Kerberos options
# KerberosAuthentication automatically enabled if keyfile exists

KerberosAuthentication yes

KerberosOrLocalPasswd yes

KerberosTicketCleanup yes



# AFSTokenPassing automatically enabled if k_hasafs() is true
#AFSTokenPassing yes



# Kerberos TGT Passing only works with the AFS kaserver


KerberosTgtPassing yes



# Set this to 'yes' to enable PAM keyboard-interactive authentication

# Warning: enabling this may bypass the setting of 'PasswordAuthentication'

#PAMAuthenticationViaKbdInt yes



#X11Forwarding no

X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PrintMotd yes

#PrintLastLog yes


#KeepAlive yes

#UseLogin no

UsePrivilegeSeparation no



#MaxStartups 10

# no default banner path

#Banner /some/path

#VerifyReverseMapping no



# override default of no subsystems

Subsystem sftp /usr/libexec/openssh/sftp-server



GssapiAuthentication yes

GssapiKeyExchange yes

GssapiUseSessionCredcache yes

GssapiCleanupCreds yes



AklogCmd /usr/krb5/bin/aklog

Don't forget to restart sshd after every edit to sshd_config
> /etc/init.d/sshd restart