How to isolate SFTP home directories with Azure Blob Storage

The key is to set the home directory scope when creating each SFTP local user. This scope limits the user's access strictly to their designated home directory, effectively isolating them from other directories and the container root.

1. Enable SFTP Support on Your Storage Account:
   • In the Azure Portal, navigate to your storage account.
   • Under Settings, select SFTP.
   • Enable SFTP support.
2. Create a Container for User Home Directories:
   • Go to Blob Service > Containers.
   • Create a new container (e.g., users-container) that will hold all user directories.
3. Create Home Directories for Each User:
   • Within the container, create a directory for each user (e.g., user1, user2).
   • Set the Access Control Lists (ACLs) on each directory to grant the specific user the necessary permissions (read, write, execute).
4. Create SFTP Local Users with Home Directory Scope:
   • In the storage account, go to Security + networking > SFTP > Local users.
   • Click on Add local user.
     • Username: Enter a username (e.g., user1).
     • Authentication Method: Choose password or SSH key authentication.
     • Home Directory: Specify the path to the user's home directory (e.g., /users-container/user1).
     • Permission Scopes: Here is the crucial part—set the Home directory scope option. This ensures the user cannot navigate outside their home directory.
     • Permissions: Assign the necessary permissions (read, write, list, create, delete) for the user on their home directory.
5. Adjust Container Root Permissions (If Necessary):
   • Ensure the container root has minimal permissions required for users to authenticate. Typically, users need only traverse (execute) permissions on the container root to access their home directories.
   • Avoid granting unnecessary permissions at the container root level to prevent users from accessing other directories.
6. Test SFTP Access:
   • Use an SFTP client like WinSCP to log in with the user's credentials.
   • Verify that the user is restricted to their home directory and cannot navigate to other directories or the container root.

Example Using Azure CLI:

# Create a home directory for user1

az storage fs directory create \

    --account-name <storage_account_name> \

    --file-system users-container \

    --name user1

# Set ACLs for user1's directory

az storage fs access set \

    --account-name <storage_account_name> \

    --file-system users-container \

    --path user1 \

    --acl "user:<user1_object_id>:rwx"

# Create SFTP local user with home directory scope

az storage account local-user create \

    --account-name <storage_account_name> \

    --username user1 \

    --home-directory "users-container/user1" \

    --has-ssh-key false \

    --permission-scope sshPermissionScope=@permission.json

Content of permission.json:

[
  {

    "permissions": "rwx",

    "service": "blob",

    "resourceName": "users-container",

    "containerName": "users-container",

    "directoryPath": "user1",

    "isHomeDirectory": true

  }
]