gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #320 from JaimePolop/master

Browse Source 
Update Azure Storage SFTP RBAC support
This commit is contained in:
SirBroccoli
2026-07-09 18:55:15 +02:00
committed by GitHub
parent 5c1a25db1d 114f5e563c
commit 396c6dd189
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-services/az-storage.md
+4 -5
View File
@@ -238,7 +238,7 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
### Key Features
- Protocol Support: SFTP works with Blob Storage accounts configured with hierarchical namespace (HNS). This organizes blobs into directories and subdirectories for easier navigation.
- Security: SFTP uses local user identities for authentication and does not integrate with RBAC or ABAC. Each local user can authenticate via:
- Security: SFTP can use local user identities, but it also supports Microsoft Entra ID-based access with Azure RBAC for authorization. This means access can be granted with the usual Blob Storage data-plane roles instead of creating local SFTP users. Local users can authenticate via:
- Azure-generated passwords
- Public-private SSH key pairs
- Granular Permissions: Permissions such as Read, Write, Delete, and List can be assigned to local users for up to 100 containers.
@@ -250,8 +250,8 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
- Supported Encryption: Requires Microsoft Security Development Lifecycle (SDL)-approved cryptographic algorithms (e.g., rsa-sha2-256, ecdsa-sha2-nistp256).
- SFTP Configuration:
- Enable SFTP on the storage account.
- Create local user identities with appropriate permissions.
- Configure home directories for users to define their starting location within the container.
- For local-user access, create local user identities with appropriate permissions.
- For local users, configure home directories to define their starting location within the container.
### Permissions
@@ -491,6 +491,7 @@ az-file-shares.md
- [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)
- [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access)
- [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key)
- [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage)
- [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account)
@@ -498,5 +499,3 @@ az-file-shares.md
- [https://learn.microsoft.com/en-us/cli/azure/storage/blob](https://learn.microsoft.com/en-us/cli/azure/storage/blob)
{{#include ../../../banners/hacktricks-training.md}}