Is exposing a sftp storage to selected internet users ip address secure ?

Wasip J 20 Reputation points
2024-03-06T18:42:53.76+00:00

I am looking for a secure sftp solution in azure.

I understand we can enable sftp on data lake storage account and also enable TLS 1.2 and secure access feature for https only.

additionally I am aware we can limit the ip address to specific range of subnet or ips.

however the traffic from allowed inbound internet users are not filtered by any l4 firewall devices. Considering this how secure to use azure sftp?

Usually for web app or vm which needs internet access will be protected by application gateway , waf and layer 4 traffic filtering.

kindly help me to advise on the network traffic security for internet allowed azure sftp storage account .

Azure Data Lake Storage
Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,348 questions
Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,714 questions
Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,436 questions
0 comments
Accepted answer
  1. Anand Prakash Yadav 6,005 Reputation points Microsoft Vendor
    2024-03-07T10:54:06.9833333+00:00

    Hello Wasip J,

    Thank you for posting your query here!

    Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), which allows you to securely connect to Blob Storage via an SFTP endpoint for file access, transfer, and management. https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support This support includes several security features:

    · Azure Blob Storage supports Transport Layer Security (TLS) 1.2 for secure data transfer. Additionally, you can enable secure access features for HTTPS only, ensuring that all data transfer occurs over a secure, encrypted connection.

    · You can limit the IP addresses that have access to your Azure Blob Storage account. This means you can restrict access to specific ranges of subnet or IPs, adding an additional layer of security.

    · Azure Blob Storage doesn’t support shared access signature (SAS), or Microsoft Entra authentication for accessing the SFTP endpoint. Instead, you must use an identity called local user that can be secured with an Azure generated password or a secure shell (SSH) key pair. https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-how-to?tabs=azure-portal

    But as you mentioned when you allow specific IP addresses to access your SFTP storage account, the network traffic between the users and the SFTP storage account will not be inspected by a Layer 4 firewall. However, the security implications depend on your specific use case and security requirements.

    Allowing specific IP addresses can be a part of a defense-in-depth strategy. It reduces the attack surface by ensuring only known and trusted IP addresses can access your SFTP storage account. This is a common practice and can significantly enhance security.

    However, the traffic itself is not inspected for malicious content with this method.

    SFTP itself provides a level of security as it operates over SSH, which provides secure, encrypted communications between two untrusted hosts over an insecure network.

    If your security requirements demand inspection of the actual data being transferred, you might need to consider additional security measures. This could include using a data loss prevention (DLP) solution, or a more advanced firewall solution that can inspect SFTP traffic.

    Do let us know if you have any further queries. I’m happy to assist you further.

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amrinder Singh 2,195 Reputation points Microsoft Employee
    2024-03-06T18:56:05.46+00:00

    Hi @Wasip J - Thanks for reaching out.

    Azure Storage SFTP allows you to securely connect to Blob Storage via an SFTP endpoint, allowing you to use SFTP for file access, file transfer, and file management.

    For connecting to Azure SFTP storage, we need connectivity over port 22. Further, when using SFTP, you may want to limit public access through configuration of a firewall, virtual network, or private endpoint. These settings are enforced at the application layer, which means they aren't specific to SFTP and will impact connectivity to all Azure Storage Endpoints.

    So, for the networking part, as you mentioned, you can control this by whitelisting only those IP on the account restricting other.
    https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-how-to?tabs=azure-portal