diff -u openssh-3.0.2p1.ORIG/auth-krb4.c openssh-3.0.2p1/auth-krb4.c
--- openssh-3.0.2p1.ORIG/auth-krb4.c	Wed Jul  4 00:21:15 2001
+++ openssh-3.0.2p1/auth-krb4.c	Thu Dec  6 13:33:52 2001
@@ -128,6 +128,12 @@
 		}
 		/* Successful authentication. */
 		chown(tkt_string(), pw->pw_uid, pw->pw_gid);
+
+		/* If we do not need to verify the kerberos server,
+		 * then authentication has already succeeded.
+		 */
+		if (!options.kerberos_verify_server)
+		        return (1);
 		
 		/*
 		 * Now that we have a TGT, try to get a local
Common subdirectories: openssh-3.0.2p1.ORIG/autom4te.cache and openssh-3.0.2p1/autom4te.cache
Common subdirectories: openssh-3.0.2p1.ORIG/contrib and openssh-3.0.2p1/contrib
Common subdirectories: openssh-3.0.2p1.ORIG/openbsd-compat and openssh-3.0.2p1/openbsd-compat
Common subdirectories: openssh-3.0.2p1.ORIG/scard and openssh-3.0.2p1/scard
diff -u openssh-3.0.2p1.ORIG/servconf.c openssh-3.0.2p1/servconf.c
--- openssh-3.0.2p1.ORIG/servconf.c	Tue Nov 13 08:03:15 2001
+++ openssh-3.0.2p1/servconf.c	Thu Dec  6 13:33:52 2001
@@ -78,6 +78,7 @@
 	options->kerberos_authentication = -1;
 	options->kerberos_or_local_passwd = -1;
 	options->kerberos_ticket_cleanup = -1;
+	options->kerberos_verify_server = -1;
 #endif
 #if defined(AFS) || defined(KRB5)
 	options->kerberos_tgt_passing = -1;
@@ -185,6 +186,8 @@
 		options->kerberos_or_local_passwd = 1;
 	if (options->kerberos_ticket_cleanup == -1)
 		options->kerberos_ticket_cleanup = 1;
+	if (options->kerberos_verify_server == -1)
+	        options->kerberos_verify_server = 1;
 #endif
 #if defined(AFS) || defined(KRB5)
 	if (options->kerberos_tgt_passing == -1)
@@ -242,6 +245,7 @@
 	sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
 #if defined(KRB4) || defined(KRB5)
 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+	sKerberosVerifyServer,
 #endif
 #if defined(AFS) || defined(KRB5)
 	sKerberosTgtPassing,
@@ -293,6 +297,7 @@
 	{ "kerberosauthentication", sKerberosAuthentication },
 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
 	{ "kerberosticketcleanup", sKerberosTicketCleanup },
+	{ "kerberosverifyserver", sKerberosVerifyServer },
 #endif
 #if defined(AFS) || defined(KRB5)
 	{ "kerberostgtpassing", sKerberosTgtPassing },
@@ -626,6 +631,10 @@
 		case sKerberosTicketCleanup:
 			intptr = &options->kerberos_ticket_cleanup;
 			goto parse_flag;
+
+		case sKerberosVerifyServer:
+		        intptr = &options->kerberos_verify_server;
+			goto parse_flag;
 #endif
 #if defined(AFS) || defined(KRB5)
 		case sKerberosTgtPassing:
diff -u openssh-3.0.2p1.ORIG/servconf.h openssh-3.0.2p1/servconf.h
--- openssh-3.0.2p1.ORIG/servconf.h	Wed Sep 12 12:40:06 2001
+++ openssh-3.0.2p1/servconf.h	Thu Dec  6 13:33:52 2001
@@ -82,6 +82,9 @@
 						 * /etc/passwd */
 	int     kerberos_ticket_cleanup;	/* If true, destroy ticket
 						 * file on logout. */
+        int     kerberos_verify_server;         /* If true, verify the
+						 * kerberos server using
+						 * the host principal. */
 #endif
 #if defined(AFS) || defined(KRB5)
 	int     kerberos_tgt_passing;	/* If true, permit Kerberos TGT
diff -u openssh-3.0.2p1.ORIG/sshd.8 openssh-3.0.2p1/sshd.8
--- openssh-3.0.2p1.ORIG/sshd.8	Sat Dec  1 18:37:08 2001
+++ openssh-3.0.2p1/sshd.8	Thu Dec  6 13:33:52 2001
@@ -557,6 +557,11 @@
 file on logout.
 Default is
 .Dq yes .
+.It Cm KerberosVerifyServer
+Specifies whether or not the Kerberos server should be authenticated
+by attempting to authenticate the local host principal.
+Default is
+.Dq yes .
 .It Cm KeyRegenerationInterval
 In protocol version 1, the ephemeral server key is automatically regenerated
 after this many seconds (if it has been used).
diff -u openssh-3.0.2p1.ORIG/sshd_config openssh-3.0.2p1/sshd_config
--- openssh-3.0.2p1.ORIG/sshd_config	Thu Sep 20 19:15:44 2001
+++ openssh-3.0.2p1/sshd_config	Thu Dec  6 13:33:52 2001
@@ -59,6 +59,7 @@
 
 # To change Kerberos options
 #KerberosAuthentication no
+#KerberosVerifyServer no
 #KerberosOrLocalPasswd yes
 #AFSTokenPassing no
 #KerberosTicketCleanup no
