Issues Azure data Factory SFTP connection ( SSH client)

Question

Issues Azure data Factory SFTP connection ( SSH client)

Shivata Tikoo 0

HI MS Team,

We encounter some issues with connecting a SFTP server of one of our financial counter parties.

The issue is due to security level that they do not support rsa-sha but only the rsa-sha2 version for host key exchange.

If i look at the error when we connect it immediately tell us it fails due to protocol error.

The following article tells me that Azure data factory does not support rsa-sha2 algorithm last year.

https://learn.microsoft.com/en-us/answers/questions/5552230/sftp-connection-problem-from-azure-data-factory-to

Is there any progress of Microsoft Azure Data Factory development team to support rsa-sha2 soon ?

supported Algorithms tested via a ssh session of the remote sftp server :
User's image

0 comments

1 answer

Your answer

Answer 1

tldr: Based on the currently published ADF SFTP connector capabilities, there is no documented indication that RSA-SHA2 host-key signature support is available today or that a release date has been announced. If the counterparty permits only RSA-SHA2 host-key signatures, an intermediary transfer mechanism is likely the most practical approach at present.

Based on the information provided, this appears to be related to the SSH host-key signature algorithm negotiation rather than the SFTP protocol itself.

The key point is that rsa-sha2-256 and rsa-sha2-512 are host-key signature algorithms, while items such as diffie-hellman-group14-sha256 are key-exchange algorithms. These are separate parts of the SSH handshake, and it is worth confirming which stage is actually failing.

From the ADF SFTP connector documentation, the supported SSH algorithms are documented, and RSA-SHA2 host-key signatures are not currently listed among the supported algorithms. If the counterparty server has disabled all alternatives and only allows RSA-SHA2 host-key signatures, ADF may be unable to complete the SSH negotiation and can fail with a protocol-related error.

At the moment, I am not aware of any publicly published Microsoft documentation, release note, or roadmap item that provides an ETA for RSA-SHA2 host-key signature support in the native ADF SFTP connector. Therefore it would be difficult to plan an integration based on the assumption that support will be added in the near term.

One additional validation step that may help is to compare the SSH negotiation from:

ADF SFTP connector
A modern OpenSSH client (ssh -vvv)

If the OpenSSH client succeeds while reporting selection of rsa-sha2-256 or rsa-sha2-512, and ADF fails before authentication begins, that would further indicate an SSH algorithm compatibility issue rather than a credential, network, firewall, or SFTP configuration problem.

For production integrations where the trading partner requires RSA-SHA2-only SSH configurations, a common workaround is to use a modern SFTP client running on a Self-hosted Integration Runtime, Azure VM, container, or other intermediary component, and then land the files in ADLS/Blob Storage for downstream ADF processing.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.