In ssh, as in standard UNIX, each end system has to store information sufficient to check the password, which is therefore also sufficient to try to guess the password. If the RSA authentication method is used, the RSA keys can give access to various accounts, and there's no way to know with certainty who possesses which keys. In the event of a compromise of a private key, there's no mechanism for locating every host on which the corresponding public key appears. User logs into Kerberized computer at the console, and may have to type kinit and give Kerberos password if the login program on the machine is not the Kerberized one. Password is used to derive a key to encrypt the exchanges between host and KDC, but is not transmitted between them.
User can now log in to other strengthened hosts without typing a password again.
All machines at FNAL will be Kerberized by default. If you bring a machine from your university to FNAL then it will be Kerberized if you wish to participate in the strengthened realm. This is highly recommended as it makes your access to other FNAL machines much simpler. Non-kerberized ssh is not permitted on these machines. This is the preferred method if you are able to do this.