SFTP connection problem from Azure Data Factory to a server that only supports rsa-sha2-256/512

Hello Luigia Costabile,

Thank you for asking your question on the Microsoft Q&A portal. Also, I appreciate the response correctly mentioned by our community champion Amira Bedhiafi, ADF’s underlying SSH client does not currently support the rsa-sha2-256 and rsa-sha2-512 host key algorithms required by the server, leading to failed key exchange during connection negotiation.

The SFTP connector in Azure Data Factory uses SSH libraries that, as of now, do not support the rsa-sha2-256 and rsa-sha2-512 host key signature algorithms. Instead, it offers legacy algorithms like ssh-rsa (which uses SHA-1), now considered weak and often disabled on secure servers.

Even though ssh-rsa appears in the client list, many modern OpenSSH servers disable it by default due to security concerns and require rsa-sha2-256/512. Unfortunately, ADF does not yet support these stronger variants. This is a known limitation of the ADF SFTP connector.

I would like to add some possible workarounds which could be as follows on top of our community champion's response.

1. Use a Self-Hosted Integration Runtime with a Custom Script (Recommended) Since the managed IR has no control over SSH stack, deploy a Self-Hosted IR on a Windows or Linux machine where you have full control, and use a custom activity (e.g., via PowerShell, Python, or command-line sftp/scp) that supports rsa-sha2-256/512. Example using OpenSSH in PowerShell:

      sftp -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=rsa-sha2-256,rsa-sha2-512 user@hostname
      
   

   Or use tools like WinSCP, PSFTP, or OpenSSH Client with explicit algorithm support. Then orchestrate this script via ADF using a Custom Activity or Azure Batch.
2. Ask Supplier to Temporarily Re-enable ssh-rsa (Not Recommended Long-Term) If allowed by their security policy, request the supplier to re-enable the ssh-rsa algorithm on their server. Based on my research and findings, Add this line to their sshd_config:

      HostKeyAlgorithms +ssh-rsa
      PubkeyAcceptedKeyTypes +ssh-rsa
   

   Restart sshd after change. Note: This weakens security and should only be used temporarily for testing. Note
3. Use Azure Logic Apps (with Custom Connector or Code) Logic Apps has more flexibility with connectors and can run custom code. You can invoke an Azure Function or container that handles the SFTP connection with proper SSH configuration.
4. Engage Microsoft Support Community to provide feedback and to Confirm Roadmap This capability could be under development. You can provide feedback here on ideas community so that this feature can be worked upon by Microsoft.

Useful links:

• SFTP connector in Azure Data Factory
• SSH host key algorithm compatibility in OpenSSH

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Hello Luigia !

Thank you for posting on Microsoft Learn Q&A.

Based on this old thread, the SSH key exchange algorithm is not supported by the server.

ADF leverages SSH.NET to connect SFTP server, the nuget version is 2016.1.0, the supported key exchange algorithms include:

• diffie-hellman-group-exchange-sha256
• diffie-hellman-group-exchange-sha1
• diffie-hellman-group14-sha1
• diffie-hellman-group1-sha1

https://feedback.azure.com/d365community/idea/7258b19f-1b89-ec11-a81b-0022484bfd94

https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-ftp-sftp-http

https://stackoverflow.com/questions/71299696/forming-sftp-connection-in-azure-data-factory-failed-to-negotiate-key-exchange