Written by Rafael Silva

How to Configure krb5.conf for Cross-Domain Hyper-V Cluster Management

How to Configure krb5.conf for Cross-Domain Hyper-V Cluster Management

https://ift.tt/cfwVZe6

How to Configure krb5.conf for Cross-Domain Hyper-V Cluster Management

KB ID: 4841
Product: Veeam Backup & Replication | 13
Published: 2026-04-01
Last Modified: 2026-04-01

Purpose

This article documents how to configure the /etc/krb5.conf file on the Veeam Software Appliance (VSA) to enable Kerberos authentication when managing a Microsoft Hyper-V cluster whose nodes belong to a different Active Directory domain than the backup server.

As noted in the VBR 13 User Guide — Before You Begin (Hyper-V):

  • [For Linux-based backup servers] Both the Hyper-V nodes and the backup server must be joined to the same Active Directory domain. If they are not joined to the same Active Directory domain, additional manual configuration of the krb5.conf file is required.

Cause

Linux uses /etc/krb5.conf to determine which Key Distribution Center (KDC) to contact when requesting Kerberos tickets. If the VSA and Hyper-V cluster nodes are in different AD domains and the [realms] section of krb5.conf does not contain entries for those domains, Kerberos authentication will fail when Veeam Backup & Replication attempts to connect to the cluster.

For more information, please reference the krb5.conf documentation.

Solution

  1. Export the existing /etc/krb5.conf file using the Host Configuration file manager.
  2. Edit the downloaded krb.conf file and update the [realms] section to include an entry for each AD domain containing Hyper-V cluster nodes:

    Example
[realms]
 EXAMPLE1.COM = {
     kdc = kerberos.example1.com
 }
 EXAMPLE2.COM = {
     kdc = kerberos.example2.com
 }

Replace the following placeholders:

  • EXAMPLE1.COM, EXAMPLE2.COM — the fully qualified domain names (in uppercase) of the AD domains containing the Hyper-V cluster nodes.
  • kerberos.example1.com, kerberos.example2.com — the DNS-resolvable hostnames or IP addresses of the KDC servers for the respective domains. By default, the KDC is the domain controller.
  1. Review krb5.conf documentation to determine if the [domain_realm] section or the default_realm option need configured for your environment.
  2. Once the krb5.conf file is updated, use the Import button in the Host Configuration file manager to import it into the VSA.

    Note:     If the Security Officer role is enabled, the import will require veeamso approval.

More Information

An additional factor that can contribute to KDC lookup failures is that Linux DNS resolution queries only the first three DNS servers listed in /etc/resolv.conf. Critically, Linux falls over to the next DNS server only if the previous one times out or returns a hard failure. DNS server failover will not occur if the DNS lookup returns an NXDOMAIN ("host does not exist") response. If the primary DNS server returns NXDOMAIN for a KDC hostname, the query fails even when other DNS servers could resolve it.

To test DNS resolution, enable SSH on the VSA via the Host Management Console, then SSH into the VSA and test the resolution of each realm’s KDC server.

nslookup kerberos.example1.com
nslookup kerberos.example2.com

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Veeam

via Veeam Support Knowledge Base https://ift.tt/dCimhVk

April 1, 2026 at 07:00PM
Veeam Backup & Replication