diff -up openssh-6.8p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-6.8p1/gss-serv-krb5.c

--- openssh-6.8p1/gss-serv-krb5.c.GSSAPIEnablek5users	2015-03-18 13:04:21.505306818 +0100

+++ openssh-6.8p1/gss-serv-krb5.c	2015-03-18 13:04:21.527306764 +0100

@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri

 	FILE *fp;

 	char file[MAXPATHLEN];

 	char line[BUFSIZ] = "";

-	char kuser[65]; /* match krb5_kuserok() */

 	struct stat st;

 	struct passwd *pw = the_authctxt->pw;

 	int found_principal = 0;

@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri

 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);

 	/* If both .k5login and .k5users DNE, self-login is ok. */

-	if (!k5login_exists && (access(file, F_OK) == -1)) {

+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {

                 return ssh_krb5_kuserok(krb_context, principal, luser,

                                         k5login_exists);

 	}

diff -up openssh-6.8p1/servconf.c.GSSAPIEnablek5users openssh-6.8p1/servconf.c

--- openssh-6.8p1/servconf.c.GSSAPIEnablek5users	2015-03-18 13:04:21.516306791 +0100

+++ openssh-6.8p1/servconf.c	2015-03-18 13:05:26.846146608 +0100

@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions

 	options->version_addendum = NULL;

 	options->fingerprint_hash = -1;

 	options->use_kuserok = -1;

+	options->enable_k5users = -1;

 }

 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */

@@ -348,6 +349,8 @@ fill_default_server_options(ServerOption

 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;

 	if (options->use_kuserok == -1)

 		options->use_kuserok = 1;

+	if (options->enable_k5users == -1)

+		options->enable_k5users = 0;

 	/* Turn privilege separation on by default */

 	if (use_privsep == -1)

 		use_privsep = PRIVSEP_NOSANDBOX;

@@ -406,7 +409,7 @@ typedef enum {

 	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,

 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,

 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,

-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,

+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,

 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,

 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,

 	sUsePrivilegeSeparation, sAllowAgentForwarding,

@@ -484,6 +487,7 @@ static struct {

 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },

 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },

 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },

+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },

 #else

 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },

 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },

@@ -491,6 +495,7 @@ static struct {

 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },

 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },

 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },

+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },

 #endif

 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },

 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },

@@ -1623,6 +1628,10 @@ process_server_config_line(ServerOptions

 		intptr = &options->use_kuserok;

 		goto parse_flag;

+	case sGssEnablek5users:

+		intptr = &options->enable_k5users;

+		goto parse_flag;

+

 	case sPermitOpen:

 		arg = strdelim(&cp;;

 		if (!arg || *arg == '\0')

@@ -1947,6 +1956,7 @@ copy_set_server_options(ServerOptions *d

 	M_CP_INTOPT(ip_qos_interactive);

 	M_CP_INTOPT(ip_qos_bulk);

 	M_CP_INTOPT(use_kuserok);

+	M_CP_INTOPT(enable_k5users);

 	M_CP_INTOPT(rekey_limit);

 	M_CP_INTOPT(rekey_interval);

@@ -2207,6 +2217,7 @@ dump_config(ServerOptions *o)

 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);

 	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);

 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);

+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);

 	/* string arguments */

 	dump_cfg_string(sPidFile, o->pid_file);

diff -up openssh-6.8p1/servconf.h.GSSAPIEnablek5users openssh-6.8p1/servconf.h

--- openssh-6.8p1/servconf.h.GSSAPIEnablek5users	2015-03-18 13:04:21.506306815 +0100

+++ openssh-6.8p1/servconf.h	2015-03-18 13:04:21.528306762 +0100

@@ -177,7 +177,8 @@ typedef struct {

 	int	num_permitted_opens;

-	int	use_kuserok;

+	int		use_kuserok;

+	int		enable_k5users;

 	char   *chroot_directory;

 	char   *revoked_keys_file;

 	char   *trusted_user_ca_keys;

diff -up openssh-6.8p1/sshd_config.GSSAPIEnablek5users openssh-6.8p1/sshd_config

--- openssh-6.8p1/sshd_config.GSSAPIEnablek5users	2015-03-18 13:04:21.506306815 +0100

+++ openssh-6.8p1/sshd_config	2015-03-18 13:04:21.528306762 +0100

@@ -94,6 +94,7 @@ GSSAPIAuthentication yes

 GSSAPICleanupCredentials no

 #GSSAPIStrictAcceptorCheck yes

 #GSSAPIKeyExchange no

+#GSSAPIEnablek5users no

 # Set this to 'yes' to enable PAM authentication, account processing,

 # and session processing. If this is enabled, PAM authentication will

diff -up openssh-6.8p1/sshd_config.5.GSSAPIEnablek5users openssh-6.8p1/sshd_config.5

--- openssh-6.8p1/sshd_config.5.GSSAPIEnablek5users	2015-03-18 13:04:21.506306815 +0100

+++ openssh-6.8p1/sshd_config.5	2015-03-18 13:04:21.528306762 +0100

@@ -576,6 +576,12 @@ on logout.

 The default is

 .Dq yes .

 Note that this option applies to protocol version 2 only.

+.It Cm GSSAPIEnablek5users

+Specifies whether to look at .k5users file for GSSAPI authentication

+access control. Further details are described in

+.Xr ksu 1 .

+The default is

+.Dq no .

 .It Cm GSSAPIStrictAcceptorCheck

 Determines whether to be strict about the identity of the GSSAPI acceptor 

 a client authenticates against. If