>One of the most annoying things about GSSAPI for SSHv2 is the occasional
>rekeying that the SSHv2 transport does.  What happens is that the user's
>ticket eventually expires during the login session, a rekey is attempted,
>and the session is killed because the rekey failed due to expired ticket.
>Now, while this may be strictly correct ("of course the session should
>die once the ticket expires!"), it is different from every other login
>mechanism that uses Kerberos that I am aware of.

When I talked to people about this, they said if there was a host key,
your login session wouldn't be killed when your tickets expired (so I
was told, I haven't verified it).

>Also, as far as I am aware (caveat: I haven't had much time to keep up
>with the ietf-secsh mailing list), there aren't any Kerberized methods
>for doing the host authentication in SSH (v1 or v2).  Because of this,
>you still have a key distribution problem for the host keys.

It's my understanding that the GSSAPI exchange can be used to authenticate
the host key.  But how well that works in practice ... well, it's not that
clear to me.

--Ken