Since Fedora 10, we reintroduced /sbin in non-root user's path. For consistency, /etc/profile.d/krb5-workstation.sh should be modified to unconditionally add /usr/kerberos/sbin in PATH Better yet, the whole /usr/kerberos hierarchy could be folded in /usr like was done with /usr/X11R6.
We can't fold all of it in because of duplicate filenames in the "bin" directory. Kerberos's rsh actually falls back to exec()ing /usr/bin/rsh if it fails to establish a connection to the Kerberos rshd, and it doesn't implement the traditional rsh protocol (which requires that the app be setuid) so it's not a direct replacement. This might change if the conflicting stuff gets split out in 1.8 or later, at which point tools which conflict name-wise could stay where they are while the rest of the krb5 package moves entirely to /usr, but that's not an option yet. Putting /usr/kerberos/sbin in the path for everyone starting with 1.7-1.