Fix Authentication failed: Invalid credential after installing VSA
In this guide, we shall discuss how to fix Authentication failed: Invalid credential after installing VSA. Please, see how to fix MDT Invalid credentials: The network was not found, and Disable credential Prompts for Remote Desktop Connections. According to Veeam KB4648, the user’s proposed configuration is incomplete and requires several additions to fix the described issue.
The necessary changes include correctly specifying the Active Directory domain which is not in my case, setting the id_provider and auth_provider to ad, defining the realm, and adding the required [pam] configuration for the Veeam appliance.
To resolve the problem, the sssd.conf file needs to be updated with the correct domain and PAM settings as outlined in the knowledge base article
Also, see how to fix “Error 1707: Network address invalid when trying to connect remotely“, and how to Resolve Invalid Key ID when requesting BitLocker Recovery Key.
Reproducing the Error “Authentication failed: Invalid credential”
During the installation of Veeam Software Appliance. Veeam recommends that you use a Fully Qualified Domain Name (FQDN) as a hostname.
Because of this, I use a FQDN. But then, I had the above error messages and decided to change the name, same issue. I reinstalled using just a host name, the same error messages were prompted.
Note: Initially, I configured the Veeam Software Appliance with a non-existent subdomain, and even after changing to just the hostname instead of the FQDN, local authentication still failed. Even if the appliance isn’t domain-joined, the setup process may detect and apply a non-existent FQDN from DHCP or metadata, causing SSSD to misconfigure authentication.
As a result, local accounts like veeamadmin are interpreted as [email protected] for example. Thereby, leading to the “Authentication failed: invalid credentials” error. Using a hostname or FQDN does not change the outcome.
As you can see, below is the error message (Authentication failed). You will get when you use the “veeamso” or the “veeamadmin” account to login.
Sometimes, you will get the Invalid credential error message.
Please, see how to add Synology NFS Storage to Proxmox VE for VMs and Backups, and how to Setup Windows Admin Center Modern Gateway for Single Sign-On.
Request Security officer Approval
Since there is no shell or SSH access and this requires an approval from the security officer. You are also stuck and cannot do anything from inside the VM itself.
As you can see, the approval is sent. But authentication to the VSA is not possible due to Authentication failure or Invalid Credentials.
Note: Detaching or deleting unused disk or recreating new disk will also not fix this issue.
Simply reinstalling the appliance without removing the old disks does not fix authentication issues, because the appliance stores persistent configuration and cached credentials on its disks. If you reinstall but reuse the same disks, the old SSSD/local user configuration, hostname settings, and any leftover domain references remain, so the “Authentication failed” problem will persist.
Launching a new VSA from the scratch will not fix this issue. The fix has been addressed in the KB referenced in the first paragraph above.
Please, see how to Fix OneDrive Error 0x80071129: The tag present in the reparse point buffer is invalid, and how to fix “Unknown Error occurred when installing Veeam Software Appliance“.
Resolve connection failure to Veeam Software Appliance
The early-release ISO (version 13.0.0.4967) is meant for new deployments only; there is no supported in-place upgrade path from older versions yet. Although it is “the latest” in terms of release date, it’s still early in the version lifecycle, and future patches/updates (for example the full “Veeam Data Platform” version 13.0.1) are expected later to see if this issue can be addressed.
As you can see from above, I am being locked out of the Veeam Backup & Replication Software Appliance. This is because, the local account authentication fails. Since the root cause is the SSSD configuration (use_fully_qualified_names = True), the fix requires editing /etc/sssd/sssd.conf.
But without shell access, you need a different approach. The Proxmox console access is also not possible in this case.
Please, see how to “Enable or disable automatic Google Chrome Live Caption on macOS, and te steps in Troubleshooting WinRM and Kerberos Delegation for WAC.
Download Live ISO
You should download a small Linux Live ISO such as the Ubuntu Live Server or Debian Live from this link. You could also use the ISO with the generic image with (Office, a browser and the Calamares installer: GNOME KDE Cinnamon LXDE LXQt MATE XFCE).
Upon download, upload it to Proxmox as shown below.
In Proxmox, you can do this by selecting the appliance VM, navigating to the Hardware tab, and clicking Add and then CD/DVD Drive.
As you can see below, the upload completed successfully. This is necessary to avoid this kind of error ‘Unknown Error occurred when installing Veeam Software Appliance“.
Then, choose the desired Linux ISO image and boot the VM from it to perform the necessary edits.
Do not forget to alter the boot order and ensure the Live ISO is moved forward to the first position.
To fix this, boot from a Linux live ISO and mount the Veeam appliance disk to access and edit the /etc/sssd/sssd.conf file. To proceed, hit the Enter button on your keyboard.
Determine the Appliance Disk
To do this, launch the Terminal and run the command below. This command will tell you exactly which partition to mount. That will confirm whether the root filesystem ever got created or if the initialization script failed before that point.
fdisk -l
Here we have two vitual disks attached. The /dev/sda is the main system (Veeam Software Appliance OS), and /dev/sdb for additional storage. The real operating system is inside the LVM logical volume under /dev/sda3. Let me make the visual appealing as shown in the table below.
| Device | Size | Type | Purpose |
|---|
/dev/sda1 | 512 MB | EFI System | Boot partition |
/dev/sda2 | 1 GB | Linux filesystem | Likely /boot or installer environment |
/dev/sda3 | 113 GB | Linux LVM | Root OS filesystem (this is what we need) |
/dev/sda4 | 4 GB | Linux swap | Swap partition |
/dev/sda5 | 121 GB | Linux LVM | Data volume (for Veeam repository or logs) |
Next, run these command in your Debian live session or host terminal
sudo vgscan # Scan for LVM volume groups
sudo vgchange -ay # Activate all found volume groups
sudo lvs # List logical volumes
Logical Volume structure overview
The lvs output tells us the appliance’s storage layout clearly. The table below ‘Logical Volume structure overview” outlines and identify the root filesystem we need to mount. Here is the logical volume that contains the OS “/dev/systemvol/system”.
| Volume Group | Logical Volume | Size | Likely Purpose |
|---|---|---|---|
| systemvol | system | 45 GB | Root filesystem / |
home | 10 GB | /home | |
tmp | 10 GB | /tmp | |
var | 45 GB | /var | |
vartmp | 3 GB | /var/tmp | |
| datavol | audit | 3 GB | Logs/audit data |
varlog | 30 GB | /var/log or Veeam logs | |
veeamrepo | 207 GB | Repository volume | |
| dbvol | veeamdata | 116 GB | Data |
veeametc | 10 GB | Configuration / etc overlay |
Now mount the root logical volume and list using the commands below. Kindly review the output of the “ls /mnt/vsa” as well.
sudo mkdir /mnt/vsa
sudo mount /dev/systemvol/system /mnt/vsa
ls /mnt/vsa
Let us check for the Then check for SSSD configuration as shown below. This means, the Veeam Software Appliance does have /etc/sssd/sssd.conf. Meaning that, it is using SSSD internally and this is exactly the configuration the KB4648 refers to.
ls /mnt/vsa/etc/sssd/
cat /mnt/vsa/etc/sssd/sssd.conf
Edit SSSD configuration File
The sssd.conf currently shows only the [pam] section, and use_fully_qualified_names is not set. I guess this could be why the error ‘Authentication failed: invalid credentials” is prompted.
As mentioned earlier, Even though the appliance is not domain-joined. SSSD still interprets your hostname as a “domain” during initialization, which causes a collision for local accounts
Now, edit /etc/sssd/sssd.conf persistently as described in KB4648. I will use Nano, since it’s preinstalled and requires no additional setup.
Feel free to have the right settings that works for your environment entered. You can see the image below for similar examples as discussed in this kb4648.
if you already edited and saved the file inside nano or your editor, then you can run the command below.
sudo umount /mnt/vsaThe changes you wrote to the file are now physically on the disk. Next step is to boot the appliance normally, and SSSD will read the updated configuration. Your local login should now work.
Please, see How to Configure Object First OOTBI Appliance, OOTBI Security Best Practices: Enable Honeypot on Object First, and how to Resize or Expand Proxmox Hard Drive.
Alternative step (Mounting the Appliance Disk externally)
An alternative method to this would be to mount the appliance disk externally and edit the SSSD misconfiguration. Then, attach the appliance disk to a temporary Linux VM and create or use any Linux VM that can read ext4 or the appliance’s filesystem. Lastly, attach the Veeam appliance virtual disk (VMDK, VHDX, or QCOW2) as an additional disk.
Next would be to identify the new disk using lsblk command, create a mount point using sudo mkdir /mnt/appliance for example. Mount he root partition of the appliance disk. Lastly you will now have to edit the SSSD configuration and umount and detach the disk.
Now, proceed to the VM and boot the VSA and with the use_fully_qualified_names = True set, you should now be able to authenticate with local or domain accounts in the console or Veeam console.
Install Veeam Backup and Replication Console for v13
To install the VBR console as you have being family with, click on “Download Windows-based backup console for full experience”. As you can see the download is in progress.
If prerequisites are missing, you will be prompted to acknowledge to install the prerequisites as shown below.
I hope you found this blogpost on how to Fix Authentication failed: Invalid credential after installing VSA very useful. Please, feel free to leave a comment below.
