diff --git a/_toc.yml b/_toc.yml
index a1b279d2..bbda2e11 100644
--- a/_toc.yml
+++ b/_toc.yml
@@ -68,6 +68,7 @@ chapters:
               - file: admin-guide/configuration/basic/verbose_boot
               - file: admin-guide/configuration/basic/sysctl
               - file: admin-guide/configuration/basic/gssproxy_with_keytab
+              - file: admin-guide/configuration/basic/kerberos
           - file: admin-guide/configuration/access
             sections:
               - file: admin-guide/configuration/access/system_access
diff --git a/admin-guide/configuration/basic/kerberos.md b/admin-guide/configuration/basic/kerberos.md
new file mode 100644
index 00000000..61ce2b7c
--- /dev/null
+++ b/admin-guide/configuration/basic/kerberos.md
@@ -0,0 +1,26 @@
+# Additional Kerberos Aliases and Services
+
+It is possible to extend the system keytab `/etc/krb5.keytab` with additional aliases and services.
+
+## Additional Kerberos Aliases
+
+By default only the real hostname is known to the AD and the system keytab.
+If a host is known in DNS with additional hostnames, then Kerberos does not work if these are used.
+
+Below configuration will add the respective aliases to the AD and the system keytab:
+```
+kerberos::aliases:
+  - 'login.psi.ch'
+  - 'llc.psi.ch'
+```
+Note that the short name without the domain part is automatically added.
+
+
+## Additional Kerberos Services
+
+Also additional Kerberos Services might be introduced with the Hiera key `kerberos::additional_services`:
+
+```
+kerberos::additional_services:
+  - 'http'
+```