Azure Security Notes

Overview

This page covers some security related topics. SFTP Gateway has some built-in controls for securing SFTP users. Beyond this, you want to follow some best practices for restricting access to specific ports on the VM. And finally, it helps to know the services and scripts that are involved with copying files to Blob.

Securing the SFTP protocol

For SFTP Gateway, here is a list of security features that are implemented:

• We rely on OpenSSH's default SFTP implementation, so traffic is encrypted in transit via OpenSSH.
• There's a few default customizations in the configuration file /etc/ssh/sshd_config:
  • One such configuration is that SFTP users are restricted to the SFTP protocol, denying them SSH access
  • Another configuration is that SFTP users are chrooted into a folder nested within their Linux home directory, as an added measure to prevent traversal
  • Another configuration is that SFTP users log in with key based authentication by default. This is to address issues inherent with passwords (complexity requirements, and that fact that they are sent over the wire)
• SFTP users have their default shell removed, which is another measure to prevent SSH

Securing VM ports in Azure

Other features are inherent to Azure in general, and not specific to SFTP Gateway:

• When moving files to Blob, this layer of traffic is encrypted in transit using HTTPS. This is because we use the Azure CLI, which behind the scenes uses a REST API.
• When files are stored in Blob, they are encrypted at rest by default.
• I will mention that the files are not encrypted at rest when they are stored temporarily on the Linux file system. This is up to the SysAdmin managing the VM to make sure that this is done.
• As a best practice, VMs should be protected by the NSG, which acts as a host based firewall. Traffic on port 80 and 443 should be restricted to the SysAdmins who are managing users. Traffic on port 22 should be restricted to SFTP users.
• Since we're using the default OpenSSH implementation, you should consider moving SSH traffic to port 2222, and leave SFTP traffic on port 22. This way, you can further restrict port 2222 to your SysAdmins. And then leave port 22 (SFTP only) to a whiltelist of SFTP users.

Moving files to Blob and the incron service

There's a service we use called incron. This operates like cron, but instead of emitting events based on time, it emits events based on file events. When a file is saved and closed, we look for this event and use this as an indication that a file is ready to be uploaded to Blob.

The incron service triggers a script (written in Bash, but compiled) called movetos3 (the naming convention is a carry-over from our original product on AWS). The movetos3 script performs a number of checks, and then runs the following command:

az storage blob --container-name ${container} --file "${fullpath}" --name "${destinationpath}" --account-name ${accountname} --account-key ${accountkey}

Here is the Azure documentation for using the Azure CLI syntax for this command: https://docs.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest