Via rh#1169843:

IssueDescription:

In a Kerberos environment, OpenSSH allows remote, authenticated users
to log in as another user if they are listed in a ~/.k5users file of that
other user.  This unexpectedly alters the system security policy, as
expressed through the ~/.k5users file, because previously, users would
have to log in locally, potentially requiring different forms of
authentication, before they could use the ksu command to switch users.

Proposed fix: Change the magic file name to ~/.ssh/k5users.  This needs careful review to make sure that the file is opened as the correct user, to avoid attacks by moving around ~/.ssh, leading to arbitrary file reads.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1169843
https://bugzilla.mindrot.org/show_bug.cgi?id=1867
http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855