BTW, the new SASL code I just committed does not set local or remove IP addresses. As previously noted, you can build Cyrus SASL with KRB4_IGNORE_IP_ADDRESS if you desire to use the KERBEROS_V4 mechanism (without layers).