-## Dealing with srvtabs
-
-If you don't specifically mention a "keytab" in your request to
-Accounts, they may give you the Kerberos 4 equivalent, a srvtab.
-
-In this case you'll want to convert the srvtab to a keytab, like so.
-
- $ ktutil
- ktutil: rst /mit/accounts/srvtabs/FOR_JOEUSER/joeserver-new-srvtab
- ktutil: wkt /etc/krb5.keytab
- ktutil: q
+If you don't want it to be possible to log in to a user account via
+Kerberos, create an empty `.k5login` file in their home directory.
+Otherwise, by default, you can log in to a user account with a Kerberos
+principal from the default realm (ATHENA, presumably) whose username
+matches; that is to say, an Athena user whose username matches a local
+username can log in to that local account. (One option to avoid this is
+to create a `.k5login` file in `/etc/skel` so that new accounts you
+later add get this file by default.)