activation MFA in Veeam Host Management failled

Hi and welcome to the community!

First of all, this should be the help center article you are looking for in this specific case:

https://helpcenter.veeam.com/docs/vbr/em/hmc_configure_users.html?ver=13

Basically you made the right steps from my perspective. Install the VSA, enable MFA for veeamadmin and create new users with MFA enabled. In the last step, you should disable MFA for veeamadmin.

Be aware, that you cannot remove veeamadmin, but disabling MFA should not be a problem.

If MFA fails, this is often either a NTP issue or you simple have to re-load the page and try again - I’ve seen this in some scenarios that you somehow have to re-do the process or just “try again” entering the MFA. In case this is a bug, this might be addressed in one of the following releases.

What do you mean with “MFA is send to the veeamadmin”? Basically, you are using a token, so no push should get send to anyone.

Best regards

Lukas

Hi ​@YassineN -

When you go to add a user & role based on the link Lukas shared, I assume you’re assigning the Host Admin role? If you’re assigning a new user the User role, MFA is not available and logging into the Host Management page is not possible.

Can you share the steps you’ve gone through in more detail so we can try to assist? Also, keep in mind...we are not Veeam Support here but rather just other Veeam users who try to assist people who post here. For official troubleshooting & support we always recommend contacting Veeam Support.

Best.

I have a VSA on version 13.1.1.18, and the veeamadmin/veeamso accounts constantly need to be reset/recovered and I’ve had to configure MFA more than once.  It’s becoming frustrating.

We also started to deploy the VSA for our customers backup appliances and are seeing similar issues.  It’s causing a support nightmare.  

I thought the code paths for MFA on the Web UI via port 443 and 10443 were merged?  

It’s a good thing you created that boot tool to recover these accounts. We find ourselves using it often.

I hope this is fixed.

What does the support name as issue? This would be interesting to know.

From experience, NTP is key when it comes to MFA. Can you check and verify, that - ideally - all the components are using the same NTP / NTS server and cross-check the time on the devices?

Hi ​@YassineN 

When you create a user, the wizard includes an MFA step where you can enable or disable MFA for that user. If you enable MFA, you must enter the confirmation code at first login. This means no code is “sent” via email or SMS: it is TOTP only, generated by the authenticator app.

As already written by ​@lukas.k  , the MFA problem is caused by an NTP time desync.

• On the appliance, in Host Management, verify that NTP is enabled and synchronized.
• On your phone, set the date and time to automatic.
• Try logging in again. If it works, the problem was a time offset.

• A user on the Veeam forum reports that the TOTP seed is different between the VBR console and the Host Management login, even with the same username and password. This is a user observation, not official documentation, but it explains the “validation failed” symptom well. Configuring Users - Veeam Backup & Replication User Guide
• For Security Officers, MFA is always enabled, and they can reset users’ passwords and MFA. An administrator, however, cannot reset a Security Officer. [v13] veeamadmin account and personal MFA account - R&D Forums
• The default accounts veeamadmin (Host Administrator) and veeamso (Security Officer) are created during installation. Accessing Veeam Host Management Console - Veeam Backup & Replication User Guide

Test 1, time

• On the appliance, in Host Management, verify that NTP is enabled and synchronized.
• On your phone, set the date and time to automatic.
• Try logging in again. If it works, the problem was a time offset.

Test 2, clean user with MFA disabled

1. In the web UI on port 10443, log in as veeamadmin.
2. Create admin1 with the Host Administrator role and MFA disabled in the wizard.
3. Log out, then log in as  admin1 with the password only.
4. In the user’s settings, enable MFA (Settings > Enable MFA).
5. Before scanning the QR code, rename the account field in your authenticator app (VSA admin1 10433).
6. Enter the confirmation code.

If this works, the problem lies in creating a user with MFA enabled from the wizard, which makes it a reproducible bug to report.

Test 3, browser and sessions

• Use a private (incognito) window, with only one session at a time.
• Close the veeamadmin session before configuring admin1.
• Also try a second browser to rule out cookies or cache.

Test 4, seed per port

• After enrolling on 10443, try logging in on 443 (VBR console) with the same user.
• If the code is rejected, you need a second enrollment for 443, with a separate entry in the app

Open a case with support.

Keep us updated, I’m curious.

@t7MevELx0 not sure it’s your case, but worth checking: on the VSA user passwords expire by default after 60 days, and a Host Admin can change that interval or turn expiration off in Host Management. If your veeamadmin/veeamso “keep breaking” roughly every couple of months, that could be it.

Also, if you only have veeamadmin as Host Admin, any lockout or MFA problem on it means going through recovery every time. With a second Host Admin you can unlock users and reset MFA from the web UI without touching the recovery tool. Worth making it part of your standard build for customer appliances.