6cf9b8
diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c
6cf9b8
--- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
6cf9b8
+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 15:18:40.628216102 +0100
6cf9b8
@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
140e5c
 	FILE *fp;
140e5c
 	char file[MAXPATHLEN];
bbf61d
 	char *line = NULL;
140e5c
-	char kuser[65]; /* match krb5_kuserok() */
140e5c
 	struct stat st;
140e5c
 	struct passwd *pw = the_authctxt->pw;
140e5c
 	int found_principal = 0;
6cf9b8
@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
140e5c
 
140e5c
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
140e5c
 	/* If both .k5login and .k5users DNE, self-login is ok. */
140e5c
-	if (!k5login_exists && (access(file, F_OK) == -1)) {
140e5c
+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
140e5c
                 return ssh_krb5_kuserok(krb_context, principal, luser,
140e5c
                                         k5login_exists);
140e5c
 	}
6cf9b8
diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
6cf9b8
--- openssh-7.4p1/servconf.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
6cf9b8
+++ openssh-7.4p1/servconf.c	2016-12-23 15:35:36.354401156 +0100
6cf9b8
@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions
5b55d0
 	options->gss_strict_acceptor = -1;
5b55d0
 	options->gss_store_rekey = -1;
140e5c
 	options->use_kuserok = -1;
140e5c
+	options->enable_k5users = -1;
5b55d0
 	options->password_authentication = -1;
5b55d0
 	options->kbd_interactive_authentication = -1;
5b55d0
 	options->challenge_response_authentication = -1;
6cf9b8
@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption
5b55d0
 		options->gss_store_rekey = 0;
3f5513
 	if (options->use_kuserok == -1)
3f5513
 		options->use_kuserok = 1;
6cf9b8
+	if (options->enable_k5users == -1)
6cf9b8
+		options->enable_k5users = 0;
5b55d0
 	if (options->password_authentication == -1)
5b55d0
 		options->password_authentication = 1;
5b55d0
 	if (options->kbd_interactive_authentication == -1)
6cf9b8
@@ -418,7 +421,7 @@ typedef enum {
132f8f
 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
3f5513
 	sHostKeyAlgorithms,
132f8f
 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
140e5c
-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
140e5c
+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
bbf61d
 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sSetEnv, sPermitTunnel,
bbf61d
 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
140e5c
 	sUsePrivilegeSeparation, sAllowAgentForwarding,
6cf9b8
@@ -497,12 +500,14 @@ static struct {
140e5c
 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
140e5c
 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
140e5c
 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
140e5c
+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
140e5c
 #else
140e5c
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
140e5c
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
140e5c
 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
140e5c
 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
140e5c
 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
140e5c
+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
140e5c
 #endif
140e5c
 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
140e5c
 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
6cf9b8
@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions
140e5c
 		intptr = &options->use_kuserok;
140e5c
 		goto parse_flag;
140e5c
 
140e5c
+	case sGssEnablek5users:
140e5c
+		intptr = &options->enable_k5users;
140e5c
+		goto parse_flag;
140e5c
+
bbf61d
 	case sPermitListen:
140e5c
 	case sPermitOpen:
bbf61d
 		if (opcode == sPermitListen) {
6cf9b8
@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
140e5c
 	M_CP_INTOPT(ip_qos_interactive);
140e5c
 	M_CP_INTOPT(ip_qos_bulk);
140e5c
 	M_CP_INTOPT(use_kuserok);
140e5c
+	M_CP_INTOPT(enable_k5users);
140e5c
 	M_CP_INTOPT(rekey_limit);
140e5c
 	M_CP_INTOPT(rekey_interval);
5b55d0
 	M_CP_INTOPT(log_level);
6cf9b8
@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o)
5b55d0
 # endif
117678
 	dump_cfg_fmtint(sKerberosUniqueTicket, o->kerberos_unique_ticket);
140e5c
 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
140e5c
+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
5b55d0
 #endif
5b55d0
 #ifdef GSSAPI
5b55d0
 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
6cf9b8
diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h
6cf9b8
--- openssh-7.4p1/servconf.h.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
6cf9b8
+++ openssh-7.4p1/servconf.h	2016-12-23 15:18:40.629216102 +0100
5b55d0
@@ -174,6 +174,7 @@ typedef struct {
117678
	int     kerberos_unique_ticket;		/* If true, the aquired ticket will
117678
						 * be stored in per-session ccache */
5b55d0
 	int	use_kuserok;
140e5c
+	int		enable_k5users;
5b55d0
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
5b55d0
 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
5b55d0
 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
6cf9b8
diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5
6cf9b8
--- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users	2016-12-23 15:18:40.630216103 +0100
6cf9b8
+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:36:21.607408435 +0100
6cf9b8
@@ -628,6 +628,12 @@ Specifies whether to automatically destr
13073f
 on logout.
140e5c
 The default is
6cf9b8
 .Cm yes .
140e5c
+.It Cm GSSAPIEnablek5users
140e5c
+Specifies whether to look at .k5users file for GSSAPI authentication
140e5c
+access control. Further details are described in
140e5c
+.Xr ksu 1 .
140e5c
+The default is
6cf9b8
+.Cm no .
6cf9b8
 .It Cm GSSAPIKeyExchange
6cf9b8
 Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
6cf9b8
 doesn't rely on ssh keys to verify host identity.
6cf9b8
diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
6cf9b8
--- openssh-7.4p1/sshd_config.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
6cf9b8
+++ openssh-7.4p1/sshd_config	2016-12-23 15:18:40.631216103 +0100
6cf9b8
@@ -80,6 +80,7 @@ GSSAPIAuthentication yes
535d34
 GSSAPICleanupCredentials no
535d34
 #GSSAPIStrictAcceptorCheck yes
535d34
 #GSSAPIKeyExchange no
535d34
+#GSSAPIEnablek5users no
535d34
 
535d34
 # Set this to 'yes' to enable PAM authentication, account processing,
535d34
 # and session processing. If this is enabled, PAM authentication will