> Did you already try with -N? Nope, a bit embarrassed that I didn't find that on my own. Thanks! It does work with the -N flag. I think there is still argument for making that the default and providing a flag to canonicalize the hostname, but I don't know enough about GSSAPI's standard to say for certain. I've only used it with Kerberos.