Unable to connect to the AVE when deploying Avamar with Metadata v2 (IMDSV2) only in AWS

Summary: When Avamar is deployed with only the IMDSV2 option (and not with IMDSV1), connection to the Avamar server by SSH fails.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

The Avamar deployment completes successfully, however the SSH connection reports the following: "No Supported authentication methods available (server sent: publickey). Server refused our key".

Unsuccessful connection

 
 

Cause

IMDSv2 uses session-oriented requests. This does not work "out of the box" with Avamar.

Resolution

1. Deploy the Avamar instance using both Metadata v1 and v2 enabled.
2. Launch the AWS CLI and run the following command, substituting the instance-id with the instance id of the newly deployed Avamar server.

aws ec2 describe-instances --instance-ids <instance-id>
 
The instance definition should contain the "HttpTokens" setting set to "optional". Example:

 

Metadata config options


3. Run the following command to enable the HttpTokens and convert the instance to IMDSv2. Again, substitute the instance-id with the instance id of the Avamar server.

aws ec2 modify-instance-metadata-options --instance-id <instanced-id> --http-tokens required --http-endpoint enabled --http-put-response-hop-limit 1

The following parameter can be adjusted, depending on specific needs:

http-put-reponse-hop-limit: "The desired HTTP PUT response hop limit for instance metadata requests."

4. Verify that the parameters have been accepted by repeating the command from step 2. Sample output:
 

image.png


5. Test the SSH connection and verify that IMDSv2 is now enabled. Run the following curl command to confirm:
 

curl http://169.254.169.254/latest/meta
Note the "Unauthorized" tile and header. They indicate that the IMDSv2 is enabled and the token is required. There would not be any unauthorized errors if the instance metadata service was in version 1. Sample output:

Curl command

References: 
https://aws.amazon.com/cli/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

Affected Products

Avamar Server, Avamar Virtual Edition
Article Properties
Article Number: 000206930
Article Type: Solution
Last Modified: 01 Aug 2025
Version:  3
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.