diff -up openssh/gss-serv-krb5.c.GSSAPIEnablek5users openssh/gss-serv-krb5.c
--- openssh/gss-serv-krb5.c.GSSAPIEnablek5users	2015-06-24 11:40:03.716448353 +0200
+++ openssh/gss-serv-krb5.c	2015-06-24 11:40:03.739448295 +0200
@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 	FILE *fp;
 	char file[MAXPATHLEN];
 	char line[BUFSIZ] = "";
-	char kuser[65]; /* match krb5_kuserok() */
 	struct stat st;
 	struct passwd *pw = the_authctxt->pw;
 	int found_principal = 0;
@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 	/* If both .k5login and .k5users DNE, self-login is ok. */
-	if (!k5login_exists && (access(file, F_OK) == -1)) {
+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
                 return ssh_krb5_kuserok(krb_context, principal, luser,
                                         k5login_exists);
 	}
diff -up openssh/servconf.c.GSSAPIEnablek5users openssh/servconf.c
--- openssh/servconf.c.GSSAPIEnablek5users	2015-06-24 11:40:03.728448323 +0200
+++ openssh/servconf.c	2015-06-24 11:40:03.740448292 +0200
@@ -171,6 +171,7 @@ initialize_server_options(ServerOptions
 	options->version_addendum = NULL;
 	options->fingerprint_hash = -1;
 	options->use_kuserok = -1;
+	options->enable_k5users = -1;
 }
 
 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
@@ -353,6 +354,8 @@ fill_default_server_options(ServerOption
 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
 	if (options->use_kuserok == -1)
 		options->use_kuserok = 1;
+	if (options->enable_k5users == -1)
+		options->enable_k5users = 0;
 	/* Turn privilege separation on by default */
 	if (use_privsep == -1)
 		use_privsep = PRIVSEP_NOSANDBOX;
@@ -412,7 +415,7 @@ typedef enum {
 	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 	sUsePrivilegeSeparation, sAllowAgentForwarding,
@@ -490,12 +493,14 @@ static struct {
 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
 #else
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
 #endif
 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
@@ -1663,6 +1668,10 @@ process_server_config_line(ServerOptions
 		intptr = &options->use_kuserok;
 		goto parse_flag;
 
+	case sGssEnablek5users:
+		intptr = &options->enable_k5users;
+		goto parse_flag;
+
 	case sPermitOpen:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
@@ -2018,6 +2027,7 @@ copy_set_server_options(ServerOptions *d
 	M_CP_INTOPT(ip_qos_interactive);
 	M_CP_INTOPT(ip_qos_bulk);
 	M_CP_INTOPT(use_kuserok);
+	M_CP_INTOPT(enable_k5users);
 	M_CP_INTOPT(rekey_limit);
 	M_CP_INTOPT(rekey_interval);
 
@@ -2300,6 +2310,7 @@ dump_config(ServerOptions *o)
 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
 	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
 
 	/* string arguments */
 	dump_cfg_string(sPidFile, o->pid_file);
diff -up openssh/servconf.h.GSSAPIEnablek5users openssh/servconf.h
--- openssh/servconf.h.GSSAPIEnablek5users	2015-06-24 11:40:03.717448351 +0200
+++ openssh/servconf.h	2015-06-24 11:40:03.740448292 +0200
@@ -179,7 +179,8 @@ typedef struct {
 
 	int	num_permitted_opens;
 
-	int	use_kuserok;
+	int		use_kuserok;
+	int		enable_k5users;
 	char   *chroot_directory;
 	char   *revoked_keys_file;
 	char   *trusted_user_ca_keys;
diff -up openssh/sshd_config.5.GSSAPIEnablek5users openssh/sshd_config.5
--- openssh/sshd_config.5.GSSAPIEnablek5users	2015-06-24 11:40:03.741448290 +0200
+++ openssh/sshd_config.5	2015-06-24 11:40:40.707354263 +0200
@@ -628,6 +628,12 @@ on logout.
 The default is
 .Dq yes .
 Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIEnablek5users
+Specifies whether to look at .k5users file for GSSAPI authentication
+access control. Further details are described in
+.Xr ksu 1 .
+The default is
+.Dq no .
 .It Cm GSSAPIStrictAcceptorCheck
 Determines whether to be strict about the identity of the GSSAPI acceptor
 a client authenticates against.
diff -up openssh/sshd_config.GSSAPIEnablek5users openssh/sshd_config
--- openssh/sshd_config.GSSAPIEnablek5users	2015-06-24 11:40:03.717448351 +0200
+++ openssh/sshd_config	2015-06-24 11:40:03.740448292 +0200
@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
 GSSAPICleanupCredentials no
 #GSSAPIStrictAcceptorCheck yes
 #GSSAPIKeyExchange no
+#GSSAPIEnablek5users no
 
 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will