Update host keys to use SFTP on Azure Blob Storage

Some Azure Storage users may receive periodically an alert informing to update host keys to use SFTP on Azure Blob Storage.

This article describes the impact this will have on the SFTP blob service and what are the changes needed.

Table of Content

• What are SFTP host keys and what this alert means 

• What actions you need to take

• How to list all your storage accounts with SFTP enabled

• Which client systems or applications are currently connecting to the storage account via SFTP

• FAQs to Host keys for SSH File Transfer Protocol (SFTP) support for Azure Blob Storage

What are SFTP host keys and what this alert means

SSH host keys are public/private key pairs that belong to SSH and SFTP servers. They are used by clients to verify the identity of the server when connecting. The private key is stored server side, while the public key is presented to the client during the connection operation.

The private/public key pair used for login is completely separate and managed by the user. Host key rotation has no impact on the user's SSH keys.

More details can be found here: SSH Host Key Management Demystified

Most clients will present the user with an option to verify the key and accept it, which will allow the connection to proceed.

Users connecting to SFTP service on Azure Storage may have currently the host keys on their list of trusted hosts.

In that case, they may need to update their list of trusted hosts, with the new valid host keys described on this list, based on the expiry date and region of the storage account: https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-host-keys#valid-host-keys

The list of trusted hosts is usually located on ~/.ssh/known_hosts), or on ssh_known_hosts file (system-wide trusted hosts, less common, usually located on /etc/ssh). The file names and locations may vary, depending on the Linux distro and version you are using.

What actions you need to take

To help customers prepare for SFTP host key rotation and avoid or quickly recover from connection interruptions, one or more of the following actions may be applicable depending on your scenario.

1. Pre-load both host keys. The host key table on Microsoft Learn publishes both the current and next key. The customer can add the new key to their known hosts now, before expiration. This ensures a seamless transition with no downtime.
2. Accept the new key after rotation. If you miss the window, the client will disconnect on first connection with the new key. You just need to:
   • Remove the old entry from known hosts.
   • Reconnect and verify/accept the new key's SHA256 fingerprint against the published table.
3. Automate key updates. For automated/scheduled SFTP workflows, you can script periodic checks of the published host key page and update known hosts programmatically.

The best workaround is to proactively add both the current and next host keys to the client's trusted hosts list. The rotation is gradual (can take multiple weeks), and having both keys pre-loaded eliminates any disruption.

How to list all your storage accounts with SFTP enabled

You can use Azure Resource Graph available on Azure portal, and the query below to get the list of storage accounts with SFTP enabled.

You can list that at your Subscription, Directory or Management Group level.

Please see how to easily do that: https://learn.microsoft.com/en-us/azure/governance/resource-graph/first-query-portal

Query to list all Storage accounts with SFTP enabled:

resources
| where type == "microsoft.storage/storageaccounts"
| extend sftpEnabled = properties.isSftpEnabled
| where sftpEnabled == true
| project
   subscriptionId,
   resourceGroup,
   name,
   location,
   kind,
   sku = sku.name,
   sftpEnabled
| order by subscriptionId, resourceGroup, name

Which client systems or applications are currently connecting to the storage account via SFTP

To verify which users or applications are currently connecting to the storage account via SFTP, you may need to enable Blob Storage Diagnostic Logs (*), and sent that logs to some Log Analytic workplace, if not enabled yet.

In that case you can query that logs and check some details from the requests querying you Log Analytic workspace, or using “Logs” option, under “Monitoring” section, on the storage account blade, on Azure Portal.

You can use this Kusto query to query Storage Diagnostic Logs:

StorageBlobLogs
| where AccountName in ("xxxxxxxxxxxxxxxxxxxx")
| where Protocol == "SFTP"
| where OperationName == "SftpConnect"
| where TimeGenerated > ago(7d)
| project TimeGenerated, AuthenticationType, CallerIpAddress, RequesterObjectId, UserAgentHeader
| summarize NrRequests=count() by RequesterObjectId, AuthenticationType //, UserAgentHeader, CallerIpAddress
| order by AuthenticationType

(*) See more details about how to enable and query Storage Diagnostic Logs, ate the end of this article.

The output should be something like this:

The first four users are authenticating on Azure Blob Storage SFTP service using SSH Key (LocalUserPublicKey), and that are the users that may be affected by this SFTP keys update alert.

They need to accept the new keys, when prompted to that after April 30th, or

You can update your trusted hosts on known_hosts file in advance, to avoid users to be prompted to accept the new keys.

FAQs to Host keys for SSH File Transfer Protocol (SFTP) support for Azure Blob Storage

Also, see our FAQs to Host keys for SSH File Transfer Protocol (SFTP) support for Azure Blob Storage:

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-host-keys#frequently-asked-questions

(*) Storage Diagnostic Logs:
Create diagnostic settings: https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings?tabs=portal#create-a-diagnostic-setting

Destinations: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal#destinations
Log Analytics tutorial: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial

Log Analytic workspace - Sample Kusto queries: https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#kusto-queries

Log Format and information available: https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage-reference#azure-monitor-logs-tables

Additional charges:

Storage Diagnostic Logs may incur in some additional charges - the most significant charges for most Azure Monitor implementations will typically be ingestion and retention of data in your Log Analytics workspaces; you can disable Storage Diagnostic Logs anytime, once you don’t need that anymore.

Logs cost calculation: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs

Analytic logs pricing: https://azure.microsoft.com/en-us/pricing/details/monitor/

I hope this can help and clarify any doubts on this update host keys to use SFTP on Azure Blob Storage alert.