SFTP in Azure Storage
I received a request for a hosted SFTP solution for one of the clients I work with.
Currently, there are some recommended templates from Microsoft [A] that include Blob storage and a Debian container that serves up the SFTP service. While this solution will work, I'm looking for a solution that's easier to manage.
Recently in Preview, Azure now has the ability to add the SFTP endpoint and features to a Storage Account.
Here's how you do it.
Open the Azure Portal and create a new Storage Account. You should be able to add this feature to existing Storage Accounts, as long as they are StorageV2 (general purpose v2) of Block Blob.
On the Advanced tab, check the boxes for “Enable hierarchical namespace” and “Enable SFTP (preview)”:
Leave the rest of the options as defaults.
After creating the resource, navigate to the “SFTP (Preview)” blade under the Settings header. From there, click “Add local user”. Type the name for the user and check the box to use an SSH Password:
Still in the “Add local user” side menu, click on the “Container permissions” tab and add a new container that you plan to use for storage. Change the permissions to fit what kind of access you need, then set the “Home directory” to the virtual folder you want to use. If this value is not set correctly, you'll have connection/mounting issues later on. To keep things simple, I set it to the Container that I set in the top row:
Copy the SFTP user password somewhere like Notepad and return to the SFTP blade.
After getting the SFTP features set up, you can connect to your container using the connection information in the “Connection string” option. Click on the Copy icon:
Next, get an SFTP app like Filezilla to setup the connection. Paste the “Connection string” into Filezilla's “Host” field. The username will populate from this information. Paste in the password that you saved from earlier, then click “Quickconnect”:
And that's it!
For it to be fully featured, there are a few things that I would like to see added (the ability to use Azure AD accounts and Managed Identities). Right now, it's working great as a fully managed SFTP endpoint that you can use for a few dollars per month: It supports regular Blob features (Soft Delete, Azure Monitoring and Firewalls, etc.) and can hook into a vNet using a Service Endpoint.
Additional resources:
- https://docs.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support
- https://docs.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-known-issues
