Hi Robbie,
After setting KRB5_TRACE to a file in /tmp and running ssh command I get the following
output:
[1714] 1533649123.284380: ccselect module realm chose cache
KEYRING:persistent:1234:krb_ccache_6taXFjL with client principal testuser(a)EXAMPLE.COM for
server principal host/testclient2.example.com(a)EXAMPLE.COM
[1714] 1533649123.284381: Getting credentials testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM using ccache
KEYRING:persistent:1234:krb_ccache_6taXFjL
[1714] 1533649123.284382: Retrieving testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM from KEYRING:persistent:1234:krb_ccache_6taXFjL
with result: -1765328243/Matching credential not found
[1714] 1533649123.284383: Retrieving testuser(a)EXAMPLE.COM ->
krbtgt/EXAMPLE.COM(a)EXAMPLE.COM from KEYRING:persistent:1234:krb_ccache_6taXFjL with
result: 0/Success
[1714] 1533649123.284384: Starting with TGT for client realm: testuser(a)EXAMPLE.COM ->
krbtgt/EXAMPLE.COM(a)EXAMPLE.COM
[1714] 1533649123.284385: Requesting tickets for host/testclient2.example.com(a)EXAMPLE.COM,
referrals on
[1714] 1533649123.284386: Generated subkey for TGS request: aes256-cts/4DAD
[1714] 1533649123.284387: etypes requested in TGS request: aes256-cts, aes128-cts,
aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[1714] 1533649123.284389: Encoding request body and padata into FAST request
[1714] 1533649123.284390: Sending request (947 bytes) to
EXAMPLE.COM
[1714] 1533649123.284391: Initiating TCP connection to stream 129.57.255.203:88
[1714] 1533649123.284392: Sending TCP request to stream 129.57.255.203:88
[1714] 1533649123.284393: Received answer (895 bytes) from stream 129.57.255.203:88
[1714] 1533649123.284394: Terminating TCP connection to stream 129.57.255.203:88
[1714] 1533649123.284395: Response was from master KDC
[1714] 1533649123.284396: Decoding FAST response
[1714] 1533649123.284397: FAST reply key: aes256-cts/EEAB
[1714] 1533649123.284398: TGS reply is for testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM with session key aes256-cts/FE3B
[1714] 1533649123.284399: TGS request result: 0/Success
[1714] 1533649123.284400: Received creds for desired service
host/testclient2.example.com(a)EXAMPLE.COM
[1714] 1533649123.284401: Storing testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM in KEYRING:persistent:1234:krb_ccache_6taXFjL
[1714] 1533649123.284403: Creating authenticator for testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM, seqnum 485909485, subkey aes256-cts/061A,
session key aes256-cts/FE3B
[1714] 1533649123.284410: ccselect module realm chose cache
KEYRING:persistent:1234:krb_ccache_6taXFjL with client principal testuser(a)EXAMPLE.COM for
server principal host/testclient2.example.com(a)EXAMPLE.COM
[1714] 1533649123.284411: Getting credentials testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM using ccache
KEYRING:persistent:1234:krb_ccache_6taXFjL
[1714] 1533649123.284412: Retrieving testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM from KEYRING:persistent:1234:krb_ccache_6taXFjL
with result: 0/Success
[1714] 1533649123.284414: Getting credentials testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM using ccache
KEYRING:persistent:1234:krb_ccache_6taXFjL
[1714] 1533649123.284415: Retrieving testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM from KEYRING:persistent:1234:krb_ccache_6taXFjL
with result: 0/Success
[1714] 1533649123.284417: Creating authenticator for testuser(a)EXAMPLE.COM ->
host/testclient2.example.com(a)EXAMPLE.COM, seqnum 29531773, subkey aes256-cts/DCC1, session
key aes256-cts/FE3B