With just some configuration changes, the kdc authentication, token-getting
and ticket-getting all worked out of the box once-upon a time... although,
we now have compiled our own version of ssh/sshd.
This seems sort of unavoidable if you want to use some of the more advanced OpenAFS/Kerberos related features, esp. if you must support platforms other than Debian/Ubuntu.
Do you happen to have specs of your OpenSSH compiles anywhere?
I am also doing this; my work is up at [1]; I just got stuff to compile cleanly, but still need to test against Kerberos 5 / PAM / OpenAFS etc.
[1] http://www.dclark.us/encaps/profiles/openssh-4.4p1.ep
-Danny
