Since apple removed this functionality, you can still build your own local copy of openssh that is compatible with gssapi (via adding some gssapi patches).
$ brew tap rdp/homebrew-openssh-gssapi
$ brew install rdp/homebrew-openssh-gssapi/openssh-patched --with-gssapi-support
then restart your terminal session and you should be in business. It creates a new /usr/local/bin/ssh executable that is Kerberos fluent, and, with typical install of homebrew, that one should end up first in your PATH so the one used by default now. There are also some other patch options to that tap as well (--with-hpn
faster for large files, and --with-keychain-support
) see it's README if interested.
Background: If you still want Kerberos ticket functionality (i.e. ssh without identity key file and without having to enter password), or the "hpn openssh patch" (purportedly speeds up large file transfer) or the "keychain patch", here's a way to install your own copy of a version of openssh that supports them (this happens to also overcome the OP's problem):
We'll use homebrew for it.
Turns out that homebrew "used to" support an openssh install option called --with-gssapi-support
that would give you an ssh/scp that supported kerberos tickets.
This may have been removed inadvertently with their update to version 6.6p1 of openssh [?] . Some tickets have been proposed to "re add it" since then, but the maintainers went through a fiasco of some kind with the "keychain" patch and they've resolved to try and keep their openssh formula much more vanilla than they used to, so rejected subsequent proposals.
They suggest creating a "tap" if you want the patches back. See above for one with the patches available.
Another option is to use ssh identity key files (authentication/authorized keys) instead of Kerberos, then you can still use the default provided ssh as is.
Another alternative is to use macports openssh package, which has good support for openssh with Kerberos (as an install option), similar to the homebrew tap mentioned. sudo port install openssh +gsskex
but the kinit
it puts on the PATH doesn't support --keychain
which is a bit more painful.