# Kerberos Auth to \*nix hosts

**URL:** <https://forum.ansible.com/t/kerberos-auth-to-nix-hosts/28593>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [September 17, 2018, 6:42pm UTC](https://forum.ansible.com/t/kerberos-auth-to-nix-hosts/28593 "2018-09-17T18:42:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Foley](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@John\_Foley](https://forum.ansible.com/u/John_Foley)\
**Post date:** [September 17, 2018, 6:42pm UTC](https://forum.ansible.com/t/kerberos-auth-to-nix-hosts/28593/1 "2018-09-17T18:42:35Z")

</div>

Good afternoon,

Is it possible to somehow configure kerberos authentication to linux hosts? I see some documentation on using the winrm module with kerberos, but nothing much involving SSH.

In my environment, I can either use kerberos tickets, SSH keys, or a password with an MFA challenge. MFA Challenges and Ansible are a no go, SSH keys are not 100% dependable due to other standing issues with our environment, but kerberos, kerberos is a pretty good bet at the current time.

I can ssh into the awx server, su to awx, and kinit to grab a ticket. I can SSH using said ticket with no problems, and actually run awx jobs with no problems that use the krb ticket. Problem is, I don’t want to have to SSH into awx and manually do a kinit. It kind of defeats the automation ethos in my opinion.

I thought of maybe doing a workflow and having a local shell command do a kinit and then move on to the playbook, but that seems like overkill.

Any thoughts?

Thanks!

JF

---

<div class="post-metadata">

**Author:** ![Ben\_Spencer](https://avatars.discourse-cdn.com/v4/letter/b/e274bd/32.png) [@Ben\_Spencer](https://forum.ansible.com/u/Ben_Spencer)\
**Post date:** [September 19, 2018, 12:40am UTC](https://forum.ansible.com/t/kerberos-auth-to-nix-hosts/28593/2 "2018-09-19T00:40:39Z")

</div>

John

I haven’t worked with Kerberos much but your “overkill” is the only thing which came to my mind also. Found a post someplace (lost it now) were someone was doing something similar with winrm as well (not sure which version of Ansible)

---

<div class="post-metadata">

**Author:** ![John\_Foley](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@John\_Foley](https://forum.ansible.com/u/John_Foley)\
**Post date:** [September 20, 2018, 12:59pm UTC](https://forum.ansible.com/t/kerberos-auth-to-nix-hosts/28593/3 "2018-09-20T12:59:44Z")

</div>

Creating a custom credential and a simple playbook that employs the expect module on the awx server itself seems to have worked.