paramiko doesn't understand kerberos tickets

I'd vote for GSSAPI support in paramiko, as there are already kerberos libraries available for Python.

Is there any chance we will see this implemented in the near future?

I'm looking to use fabric as a foundation of a deployment system. Kerberos support is a key feature, as we'd like to track information on all systems with personalized kerberized accounts.

FWIW, Paramiko does support SSH key-based authentication. Are you sure you can't use SSH keys to accomplish your goal, capitol? That wouldn't expose any password, as only the public key is on the server... As it stands, unless you have insanely long TGT expiry times, I can't see how Kerberos could be used in anything but an interactive setting, unless you kept a local password stash - I don't know if that's any better. Of course, the private key is the same thing, but you can restrict what services it opens, and a password stash might contain a password you use elsewhere.

I could of course setup ssh keys, but that's more of a workaround than a solution.

Kerberos can use a keytab in order to use it outside of a interactive setting, you can read more about it here: http://kb.iu.edu/data/aumh.html but that's somewhat outside the scope of this feature request.

+1

I would like to use fabric but I can't without gssapi/kerberos support :|
Hope it will be implemented soon !

great job !

+1

+1: Having GSSAPI support would be invaluable for me. I have an entirely integrated Kerberos environment with which I would like to replace a cluster of legacy bash scripts with Paramiko. Please consider implementing this!

+1: Using fabric in a clunky and reduced manner due to lack of GSSAPI support in paramiko, please implement.

+1 please implement

+1

Adding my name to the hat. I would love to see GSSAPI support.

Another +1 from me.

+1

+1

+1; I'd also love to see GSSAPI support.

+1

+1

+1

Please use the "Affects me too" link on the bug report rather than posting +1's; that way not everybody subscribed to this bug gets spammed. Thanks.

I suspect that the use of the regular ol' 'kerberos' module is all that is necessary for this to work. It can implement standard GSSAPI authentication. Someone needs to try it out (if I had time...).