Authentication issues when opening an SFTP connection to a blob storage from a cloud environment

Hi Joël Goossens,

It seems that the issue you're experiencing with SFTP authentication when connecting from a cloud environment may be related to network access settings. Since you mentioned that changing the public network access to 'Enabled from all networks' allows the connection but poses a security risk, you may want to ensure that the following prerequisites are met for SFTP access:

1. Public Network Access: Ensure that public network access is set to 'Enabled from selected virtual networks and IP addresses' and that the client IP address is allowed by the firewall.
2. Permissions: Verify that the user has been assigned appropriate permissions to the container in Azure Blob Storage.
3. Home Directory: Check that the home directory is correctly specified in the connection string for local users, especially if they don't have a home directory.
4. Firewall and Network Configuration: Make sure that the networking configuration allows access from the cloud environment. This may involve configuring the firewall or using a private endpoint.

If the authentication is successful from a local environment but fails from the cloud, it could indicate that the cloud environment's IP addresses are not whitelisted.

Based on the anonymized session log from WinSCP, it appears that the root cause of the issue is related to IP authorization and network configuration.

1. Verify External IP Address:
   • Ensure that the external IP address seen by the client is correctly identified. The client can use online tools like whatismyip.com to verify their external IP address.
2. Update IP Whitelisting:
   • Add the verified external IP address to the list of allowed IP addresses in the Azure Blob Storage network settings.
   • Ensure that any intermediate devices (e.g., firewalls, proxies) are not altering the IP address seen by Azure.
3. Check Network Configuration:
   • Verify that the network configuration on the client's end is not causing the IP address to be masked or altered.
   • Ensure that the client's network is configured to use the correct external IP address when making outbound connections.
4. Enable Trusted Services:
   • Ensure that the 'Allow Azure services on the trusted services list to access this storage account' option is active 
   • This allows Azure services to bypass the IP restrictions and access the storage account.

Limitations and known issues with SSH File Transfer Protocol (SFTP) support for Azure Blob Storage
Authorize access to Azure Blob Storage for an SSH File Transfer Protocol (SFTP) client

Hope the above suggestion helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

Hi Vinod,

Thank you for your suggestions. As per your first 4 points:

• Public network access is indeed set to ' Enabled from selected virtual networks and IP addresses'
• User has the necessary permissions, as otherwise they would also be unable to access it if public network access was allowed.
• Home directory has been set and does not cause issues when using public network access
• There should be no firewall affecting this specific storage account, so on that front I do not expect any issues. I have set up a private endpoint using the default settings, but that so far also does not seem to have an effect.

For your next 4 points:

• IP address is the same as what appears in whatismyip.com. However, as mentioned in the linked question, in the diagnostic logs of the storage account this is not the IP address that appears. The IP address that gets shown in the log is a local IP address when the connection is attempted from a cloud environment. When the connection is made locally, the IP address is indeed the external IP address that shows up on whatismyip.com
• IP address is included in the list of allowed IP addresses
• I will ask for a verification of this on the side of the client. They are in an Azure cloud environment as well, so if you already happen to know of any default settings or configurations that could cause this to be affected please let me know!
  • Note that when I personally try to make a connection from a VM on my own tenant that this issue also exists, and to my knowledge there is no IP address masking or alteration taking place there. The VM has a set external IP address attached to it, which was added to the permitted IP addresses list of the SFTP storage account, but this one is not able to make a connection either.
• The 'Allow Azure services on the trusted services list to access this storage account'  option is enabled.

Hopefully this provides you with some additional input and ideas for other aspects to check!

Kind regards,

Joël

Hi Joël Goossens

In my environment, I created Virtual machine with name vm326

Portal:

I have now created an outbound rule in VM to securely connect the VM to the storage account.

Portal:

To securely enable SFTP access from an Azure virtual machine to Azure Blob Storage, I created an outbound rule that governs traffic leaving the VM.

• The source of the traffic is defined by IP addresses, specifically the private IP address of the virtual machine (e.g., 10.xxxx).
• The source port range is set to 22, although it is generally recommended to use * (Any) here, since source port filtering is uncommon and most filtering is typically done on the destination port.
• For the destination, I used the "Storage" service tag, which represents all Azure Storage services. T
• The destination port range is also set to 22, which is the port used for SFTP traffic.
• The protocol is set to Any, which includes TCP, UDP, and ICMPv4, although in this case, TCP is primarily used for SFTP connections.
• The action for this rule is Allow, meaning any traffic that matches the above criteria will be permitted. The rule has a priority of 100, ensuring it is evaluated before other rules with a higher priority number. I named the rule "AllowCidrBlockCustom22Outbound" to clearly indicate its purpose: allowing outbound traffic from a specific CIDR block on port 22.
• The description of the rule includes a note that the recommended value for source port ranges is *, since destination port filtering is more relevant for managing network traffic securely and effectively.

Now, I created a storage account and, in the Networking section, selected 'Enabled from selected virtual networks and IP addresses' to securely connect the virtual machine with SFTP.

Portal:

I tried accessing the SFTP connection to Azure Blob Storage from an Azure virtual machine, and it connected successfully.

Virtual machine:

The above process will establish a secure SFTP connection to Blob Storage from the cloud environment.

Reference:
Configure Azure Storage firewalls and virtual networks | Microsoft Learn

Hope the above suggestion helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Hi @Joël Goossens

Just checking to see if the suggestion provided helped you to solve your issue, please let us know if you have any further queries. If the above suggestion helps you to solve your issue, please Upvote, this can be beneficial to other community members. 

Hi @Joël Goossens

I would like to inquire whether the provided response was beneficial to you. Please let us know do you have any further queries. We are here to assist you. Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.