Cosmic Ossifrage's questions

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo and gain super-user privileges. Hence, I can log in as an LDAP group to manage the machine. This is all working fine, and ssh login works well with an LDAP user.

I was just experimenting with a .k5login file in the home directory of my user account, Cosmic Ossifrage. In the file, I listed:

[email protected]

which is a valid Kerberos identity. SSH logins as this user continued to work correctly with the .k5login file in place.

However, with this .k5login file in my home directory, I was no longer able to use sudo -i to gain super-user privileges. This does not seem to make any sense, since the .k5login is in my home directory, not root's, so to my mind, neither the root user, nor the sudo command, should be restricted any further than what is present in the sudoers file.

However, with the .k5login file as above in place, neither sudo -i nor sudo su were working whereas they were before. Once the .k5login file was removed, this functionality was restored and I was able to sudo again.

In the log file /var/log/auth.log, among the many error messages reported at this time was one from sudo, stating:

[pam:sudo] krb5_kuserok failed for user cosmic_ossifrage

Did I miss something fundamental in the definition of what a .k5login is supposed to do? Is this expected behaviour, and if so, why?

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab locally on the client machines (as well as the NFS server hosts).

1. What badness, if any, could result from sharing the same key in a generic keytab file (for NFS purposes) between all client machines requiring access to the NFS host(s)?

2. If, from the result of #1, we really do need to use a separate key in a different keytab on every client, what is an effective -- and, more importantly, secure -- way to automate the creation of the keytab for each of several thousand machines? I don't want to have to generate and export a key on every box!