如何在Azure ACI中安全加固SFTP：VNet还是IPTables？

Great question—securing exposed SFTP services is critical, and you’re on the right track considering both network and host-level controls. Let’s break this down clearly:

a) Which Solution is the Best Practice? #

Azure VNet + NSG is unequivocally the recommended best practice for securing your ACI-hosted SFTP service, and here’s why:

• Network-level defense in depth: NSGs act as a firewall at the VNet/subnet level, decoupling security from the container’s OS. Even if there’s a misconfiguration in your SFTP container (like a forgotten IPTables rule), the NSG will still block unauthorized traffic.
• Centralized, easy management: NSG rules can be viewed, edited, and audited directly in the Azure Portal, CLI, or ARM templates—no need to SSH into individual containers to check firewall rules. This scales much better if you ever deploy multiple SFTP containers.
• Integration with Azure’s ecosystem: Deploying ACI into a VNet lets you pair it with other Azure security tools (like Azure Firewall, VPN Gateway, or ExpressRoute) if you need to extend access to on-premises networks later.

ACI VNet Deployment Limitations to Note #

While VNet integration is straightforward, there are a few small constraints to keep in mind:

• Ensure your Azure region supports ACI VNet integration (most regions do now, but double-check if you’re using a less common region).
• The subnet you use for ACI must not contain other Azure resources (like VMs or VM Scale Sets)—ACI needs exclusive use of the subnet’s IP addresses.
• The subnet should have an address space of at least /27 (32 IPs) to accommodate ACI’s internal networking needs.

As for IPTables: it works, but it’s a host-level control that’s far less robust. Rules are tied to the container’s lifecycle (they’ll reset if the container restarts unless you persist them), troubleshooting requires accessing the container itself, and it doesn’t scale well for multiple instances.

b) How to Configure IPTables in an ARM Template (And Yes, It’s Possible!) #

Since your SFTP uses the atmoz/sftp image (based on Debian/Ubuntu, which includes IPTables by default), you can embed IPTables rules directly into the container’s startup command in your ARM template. Here’s how to do it:

Step 1: Modify the Container Command in Your ARM Template #

The atmoz/sftp image runs /usr/sbin/sshd -D to start the SFTP service. We’ll prepend the IPTables rule to block all traffic except your allowed IP on port 22.

Basic Static IP Example

Add this to your container’s properties in the ARM template:

"containers": [
  {
    "name": "sftp-container",
    "properties": {
      "image": "atmoz/sftp",
      "command": [
        "/bin/sh",
        "-c",
        "iptables -A INPUT -p tcp --dport 22 ! -s YOUR_ALLOWED_IP -j DROP && /usr/sbin/sshd -D"
      ],
      // ... rest of your container config (ports, volume mounts, etc.)
    }
  }
]

Replace YOUR_ALLOWED_IP with the single IP you want to whitelist (e.g., 192.168.1.100).

Flexible Parameterized Example

To make the template reusable, add a parameter for the allowed IP:

"parameters": {
  "allowedSftpIp": {
    "type": "string",
    "defaultValue": "192.168.1.100",
    "metadata": {
      "description": "Single IP address allowed to access the SFTP service"
    }
  }
},
// ...
"containers": [
  {
    "name": "sftp-container",
    "properties": {
      "image": "atmoz/sftp",
      "command": [
        "/bin/sh",
        "-c",
        "[concat('iptables -A INPUT -p tcp --dport 22 ! -s ', parameters('allowedSftpIp'), ' -j DROP && /usr/sbin/sshd -D')]"
      ],
      // ... rest of config
    }
  }
]

Now you can specify the allowed IP during deployment without editing the template directly.

Step 2: Verify the Rules After Deployment #

Once the ACI instance is running, you can check if the IPTables rule is active by SSHing into the container:

az container exec --resource-group YOUR_RG_NAME --name YOUR_ACI_NAME --exec-command "/bin/sh"
# Inside the container:
iptables -L INPUT --line-numbers

You should see your rule listed at the top of the INPUT chain.

Key Note on Persistence #

Since IPTables rules aren’t saved across container restarts, embedding the rule in the startup command ensures it runs every time the container starts—no extra work needed to persist rules.

内容的提问来源于stack exchange，提问作者SaaSGuy33