fix: krb5 ticket forwarding (#227)

* use openssh_gssapi for sshd on all hosts

* GSSAPIKeyExchange = yes if host has a keytab

* test an option

* ticket forwarding flag

* undo unhelpful option

* test without specifying openssh package

* implement oliver suggestions

---------

Co-authored-by: 24apricots <michaelzls@berkeley.edu>

Author: 2 people

profiles/desktop.nix

@@ -119,11 +119,11 @@ in
   # Add forward flag to tickets on desktops
   security.krb5.settings.libdefaults.forwardable = true;
 
-  # Only forward Kerberos tickets to login servers (carp and koi)
+  # Only forward Kerberos tickets to login servers (fluttershy and rainbowdash)
   programs.ssh.extraConfig = lib.mkOverride 90 ''
     CanonicalizeHostname yes
     CanonicalDomains ocf.berkeley.edu
-    Host carp.ocf.berkeley.edu koi.ocf.berkeley.edu
+    Host fluttershy.ocf.berkeley.edu rainbowdash.ocf.berkeley.edu
         GSSAPIAuthentication yes
         GSSAPIKeyExchange yes
         GSSAPIDelegateCredentials yes