How about stock openssh, no patches, set up for gss (kerberos) authentication and ticket passing? That's what I use. Then you can aklog (or afslog) in your .cshrc (or whatever). No k4 required.