Hi,

i'm currently trying to add a SLES11 SP1 server to our Kerberos/LDAP/AD (Univention UCS). So far everything is working as expected, but if somebody is logging in via "ssh-password-auth" (not keyboard-interactive!) the tickets are created in /tmp/, but it looks like there is something going wrong, because after each login another /tmp/krb5cc_[UID]_XXXXX-file is left back.

Code:
ssh -v -o 'PreferredAuthentications=password'  server
everything else like pubkey-auth, keyboard-interactive ... is working/cleaned like it should - incl. "klist" returns valid tickets. Here my config-files:

Code:
/etc/ldap.conf

tls_cacert	/etc/univention/ssl/ucsCA/CAcert.pem
base	dc=ad,dc=x,dc=y,dc=z
binddn	cn=mon3,cn=computers,dc=ad,dc=x,dc=y,dc=z
bindpw	xxx
ssl	start_tls
host	ucs:7389 backup:7389
nss_map_attribute	uniqueMember uniqueMember
ldap_version	3
pam_password	crypt
pam_filter	objectClass=posixAccount
tls_checkpeer	no
bind_policy	soft

/etc/krb5.conf
[libdefaults]
	default_realm = AD.IN.x.DE
	clockskew = 300
#	default_realm = EXAMPLE.COM

[realms]
AD.IN.x.DE = {
	kdc = ucs.ad.in.x.de
	default_domain = ad.in.x.de
	admin_server = ucs.ad.in.x.de
	kdc = backup.ad.in.x.de
	admin_server = backup.ad.in.x.de
}
#	EXAMPLE.COM = {
#                kdc = kerberos.example.com
#		admin_server = kerberos.example.com
#	}

[logging]
	kdc = FILE:/var/log/krb5/krb5kdc.log
	admin_server = FILE:/var/log/krb5/kadmind.log
	default = SYSLOG:NOTICE:DAEMON
[domain_realm]
	.ad.in.x.de = AD.IN.x.DE
[appdefaults]
pam = {
	ticket_lifetime = 1d
	renew_lifetime = 1d
	forwardable = true
	proxiable = false
	minimum_uid = 1
	external = sshd
	use_shmem = sshd
}
here the verbose logs (pam_krb5 debug / sshd_config DEBUG3):

Code:
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_authenticate called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: authenticating 'f.zimmermann@AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: checking for externally-obtained v5 credentials
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: KRB5CCNAME is not set, none found
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: trying previously-entered password for 'f.zimmermann', allowing libkrb5 to prompt for more
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: authenticating 'f.zimmermann@AD.IN.x.DE' to 'krbtgt/AD.IN.x.DE@AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: krb5_get_init_creds_password(krbtgt/AD.IN.x.DE@AD.IN.x.DE) returned 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: got result 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: 'f.zimmermann@AD.IN.x.DE' passes .k5login check for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: saved v5 credentials to shared memory segment 264699905 (creator pid 19391)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: saved v4 credential state to shared memory segment 264732674 (creator pid 19391)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: authentication succeeds for 'f.zimmermann' (f.zimmermann@AD.IN.x.DE)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_authenticate returning 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_acct_mgmt called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: account management succeeds for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: 'f.zimmermann@AD.IN.x.DE' passes .k5login check for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_acct_mgmt returning 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: Accepted password for f.zimmermann from 10.0.0.217 port 41414 ssh2
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_setcred (establish credential) called
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_open_session called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: removing v5 shared memory segment 264699905 creator pid 19391
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: cleanup function removing shared memory segment 264699905 belonging to process 19391
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: removing v4 shared memory segment 264732674 creator pid 19391
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: cleanup function removing shared memory segment 264732674 belonging to process 19391
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: creating v5 ccache for 'f.zimmermann', uid=2618, gid=5001
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: saving v5 credentials to 'MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-0' for internal use
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: copied credentials from "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-0" to "FILE:/tmp/krb5cc_2618_W19391" for the user, destroying "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-0"
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: created v5 ccache 'FILE:/tmp/krb5cc_2618_mdrqil' for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_open_session returning 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will ask for a password if that fails
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_open_session called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: creating v5 ccache for 'f.zimmermann', uid=2618, gid=5001
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: saving v5 credentials to 'MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-1' for internal use
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: copied credentials from "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-1" to "FILE:/tmp/krb5cc_2618_z19391" for the user, destroying "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-1"
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: created v5 ccache 'FILE:/tmp/krb5cc_2618_6d7xJn' for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_open_session returning 0 (Success)
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: pam_setcred (establish credential) called
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: debug
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: user_check
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: will try previously set password first
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: external
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: flag: warn
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: pam_open_session called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: creating v5 ccache for 'f.zimmermann', uid=2618, gid=5001
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: saving v5 credentials to 'MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-2' for internal use
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: copied credentials from "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-2" to "FILE:/tmp/krb5cc_2618_r19403" for the user, destroying "MEMORY:_pam_krb5_tmp_s_f.zimmermann@AD.IN.x.DE-2"
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: created v5 ccache 'FILE:/tmp/krb5cc_2618_L3LyAp' for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19403]: pam_krb5[19403]: pam_open_session returning 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will ask for a password if that fails
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_close_session called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: afs not running
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: removing ccache 'FILE:/tmp/krb5cc_2618_6d7xJn'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: destroyed v5 ccache for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_close_session returning 0 (Success)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_setcred (delete credential) called
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: default/local realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: configured realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: debug
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flags: forwardable not proxiable
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no ignore_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no null_afs
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: user_check
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: no krb4_convert
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_convert_524
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: krb4_use_as_req
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will try previously set password first
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: will let libkrb5 ask questions
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: use_shmem
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: external
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: flag: warn
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ticket lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: renewable lifetime: 86400s (1d,0h,0m,0s)
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: minimum uid: 1
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: banner: Kerberos 5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccache dir: /tmp
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: ccname template: FILE:%d/krb5cc_%U_XXXXXX
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: keytab: FILE:/etc/krb5.keytab
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: token strategy: v4,524,2b,rxk5
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_close_session called for 'f.zimmermann', realm 'AD.IN.x.DE'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: afs not running
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: removing ccache 'FILE:/tmp/krb5cc_2618_mdrqil'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: destroyed v5 ccache for 'f.zimmermann'
May 21 15:12:21 mon3 sshd[19391]: pam_krb5[19391]: pam_close_session returning 0 (Success)
the file left back is "/tmp/krb5cc_2618_L3LyAp" any hints how to debug/solve this?

Thanks a lot,

Fabian Zimmermann