Loading...
Loading...
This article documents how to configure the /etc/krb5.conf file on the Veeam Software Appliance (VSA) to enable Kerberos authentication when managing a Microsoft Hyper-V cluster whose nodes belong to a different Active Directory domain than the backup server. As noted in the VBR 13 User Guide — Before You Begin (Hyper-V): [For Linux-based backup servers] Both the Hyper-V nodes and the backup server must be joined to the same Active Directory domain. If they are not joined to the same Active Directory domain, additional manual configuration of the krb5.conf file is required.
Linux uses /etc/krb5.conf to determine which Key Distribution Center (KDC) to contact when requesting Kerberos tickets. If the VSA and Hyper-V cluster nodes are in different AD domains and the [realms] section of krb5.conf does not contain entries for those domains, Kerberos authentication will fail when Veeam Backup & Replication attempts to connect to the cluster. For more information, please reference the krb5.conf documentation.
Export the existing /etc/krb5.conf file using the Host Configuration file manager. Edit the downloaded krb.conf file and update the [realms] section to include an entry for each AD domain containing Hyper-V cluster nodes: Example
An additional factor that can contribute to KDC lookup failures is that Linux DNS resolution queries only the first three DNS servers listed in /etc/resolv.conf. Critically, Linux falls over to the next DNS server only if the previous one times out or returns a hard failure. DNS server failover will not occur if the DNS lookup returns an NXDOMAIN ("host does not exist") response. If the primary DNS server returns NXDOMAIN for a KDC hostname, the query fails even when other DNS servers could resolve it. To test DNS resolution, enable SSH on the VSA via the Host Management Console, then SSH into the VSA and test the resolution of each realm's KDC server.
Click on a version to see all relevant bugs
Veeam Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.