Azure Blob JSON文件转SFTP：免密钥自动化与直传方案咨询

一、无需SSH密钥的SFTP上传方法 #

SFTP基于SSH协议，无密钥场景下仅支持密码认证，前提是你的SFTP服务器已开启密码登录功能。自动化流程中需注意密码的安全存储：

• 避免明文硬编码，可使用PowerShell的ConvertTo-SecureString将密码转为安全字符串，再通过ConvertFrom-SecureString加密存储到本地文件，或直接从Azure Key Vault读取加密后的密码。
• 调整WinSCP的SessionOptions配置，确保密码正确传入（示例中已包含密码参数，需替换为安全存储后的密码值）。

二、跳过本地文件夹直接传输 #

可以通过流处理实现Azure Blob到SFTP的直接传输，无需写入本地磁盘，节省存储资源并提升效率。

基于WinSCP的流上传实现 #

修改原脚本，移除本地下载步骤，直接读取Blob流并上传：

$containerName = ""
$sftpRemotePath = ""
$connectionString = ""
$sftpHost = ""
$sftpUser = ""
$sftpPassword = "" # 推荐使用安全字符串形式
$sftpPort = 22
$folderPath = ""

$storageContext = New-AzStorageContext -ConnectionString $connectionString
$blobs = Get-AzStorageBlob -Container $containerName -Context $storageContext -Prefix $folderPath
$jsonFiles = $blobs | Where-Object { $_.Name -like "*.json" }

$jsonFiles | ForEach-Object {
    $blobName = $_.Name
    Write-Host "Starting direct transfer: $blobName"
    try {
        # 获取Blob的只读流
        $blobStream = $_.ICloudBlob.OpenRead()
        try {
            Add-Type -Path "\WinSCPnet.dll"
            $winscpPath = "\winSCP.exe"
            
            $sessionOptions = New-Object WinSCP.SessionOptions -Property @{
                Protocol = [WinSCP.Protocol]::Sftp
                HostName = $sftpHost
                UserName = $sftpUser
                Password = $sftpPassword
                PortNumber = $sftpPort
            }

            $session = New-Object WinSCP.Session
            $session.ExecutablePath = $winscpPath
            $session.Open($sessionOptions)

            # 拼接SFTP远程文件路径
            $remoteFilePath = Join-Path -Path $sftpRemotePath -ChildPath $blobName
            # 上传流到SFTP服务器
            $session.PutFile($blobStream, $remoteFilePath).Check()
            
            Write-Host "Direct transfer completed: $blobName"
        }
        finally {
            # 确保资源释放
            $session.Dispose()
            $blobStream.Close()
        }
    }
    catch {
        Write-Error "Transfer failed for $blobName : $_"
    }
}

基于SSH.NET的轻量流上传实现 #

SSH.NET是纯.NET库，无需依赖WinSCP客户端，部署更简洁，适合自动化场景：

# 先安装SSH.NET模块：Install-Module -Name SSH.NET -Force

$containerName = ""
$sftpRemotePath = ""
$connectionString = ""
$sftpHost = ""
$sftpUser = ""
$sftpPassword = ""
$sftpPort = 22
$folderPath = ""

$storageContext = New-AzStorageContext -ConnectionString $connectionString
$blobs = Get-AzStorageBlob -Container $containerName -Context $storageContext -Prefix $folderPath
$jsonFiles = $blobs | Where-Object { $_.Name -like "*.json" }

$jsonFiles | ForEach-Object {
    $blobName = $_.Name
    Write-Host "Starting direct transfer: $blobName"
    try {
        $blobStream = $_.ICloudBlob.OpenRead()
        try {
            # 初始化SFTP客户端
            $sftpClient = New-Object Renci.SshNet.SftpClient($sftpHost, $sftpPort, $sftpUser, $sftpPassword)
            $sftpClient.Connect()

            $remoteFilePath = Join-Path -Path $sftpRemotePath -ChildPath $blobName
            $sftpClient.UploadFile($blobStream, $remoteFilePath)

            $sftpClient.Disconnect()
            Write-Host "Direct transfer completed: $blobName"
        }
        finally {
            $sftpClient.Dispose()
            $blobStream.Close()
        }
    }
    catch {
        Write-Error "Transfer failed for $blobName : $_"
    }
}

三、推荐的简便模块 #

• SSH.NET：纯.NET实现，无需额外安装外部客户端，部署成本低，支持流传输、密码/密钥双认证，是自动化脚本的首选。
• AzCopy：若SFTP服务器配置兼容，可使用AzCopy的sftp命令直接同步Blob到SFTP，但流处理灵活性不如上述库。

内容的提问来源于stack exchange，提问作者Milo_Dev