How to Configure krb5.conf for Cross-Domain Hyper-V Cluster Management
Purpose
This article documents how to configure the /etc/krb5.conf file on the Veeam Software Appliance (VSA) to enable Kerberos authentication when managing a Microsoft Hyper-V cluster whose nodes belong to a different Active Directory domain than the backup server.
As noted in the VBR 13 User Guide — Before You Begin (Hyper-V):
- [For Linux-based backup servers] Both the Hyper-V nodes and the backup server must be joined to the same Active Directory domain. If they are not joined to the same Active Directory domain, additional manual configuration of the krb5.conf file is required.
Cause
Linux uses /etc/krb5.conf to determine which Key Distribution Center (KDC) to contact when requesting Kerberos tickets. If the VSA and Hyper-V cluster nodes are in different AD domains and the [realms] section of krb5.conf does not contain entries for those domains, Kerberos authentication will fail when Veeam Backup & Replication attempts to connect to the cluster.
For more information, please reference the krb5.conf documentation.
Solution
- Export the existing
/etc/krb5.conffile using the Host Configuration file manager. - Edit the downloaded
krb.conffile and update the[realms]section to include an entry for each AD domain containing Hyper-V cluster nodes:
Example
Replace the following placeholders:
- EXAMPLE1.COM, EXAMPLE2.COM — the fully qualified domain names (in uppercase) of the AD domains containing the Hyper-V cluster nodes.
- kerberos.example1.com, kerberos.example2.com — the DNS-resolvable hostnames or IP addresses of the KDC servers for the respective domains. By default, the KDC is the domain controller.
- Review krb5.conf documentation to determine if the
[domain_realm]section or thedefault_realmoption need configured for your environment. - Once the
krb5.conffile is updated, use the Import button in the Host Configuration file manager to import it into the VSA.
Note: If the Security Officer role is enabled, the import will require veeamso approval.
More Information
An additional factor that can contribute to KDC lookup failures is that Linux DNS resolution queries only the first three DNS servers listed in /etc/resolv.conf. Critically, Linux falls over to the next DNS server only if the previous one times out or returns a hard failure. DNS server failover will not occur if the DNS lookup returns an NXDOMAIN ("host does not exist") response. If the primary DNS server returns NXDOMAIN for a KDC hostname, the query fails even when other DNS servers could resolve it.
To test DNS resolution, enable SSH on the VSA via the Host Management Console, then SSH into the VSA and test the resolution of each realm's KDC server.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.