You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#Customer intent: As a network administrator, I want to securely connect to Azure Files NFS v4.1 volumes using a TLS channel so that I can protect data in transit from interception. By using AZNFS mount helper package for simplified setup, I can ensure data confidentiality without needing complex setups or external authentication systems.
11
-
12
11
---
13
12
14
-
# How encryption in transit for NFS Azure file shares works (preview)
15
-
16
-
17
-
18
-
13
+
# Encryption in transit for NFS Azure file shares (preview)
19
14
20
-
This article explains how you can encrypt data in transit for NFS Azure file shares (preview).
15
+
This article explains how you can encrypt data in transit for NFS Azure file shares.
21
16
22
17
> [!IMPORTANT]
23
18
> - Encryption in transit for Azure file shares NFS v4.1 is currently in **preview**.
@@ -26,9 +21,9 @@ This article explains how you can encrypt data in transit for NFS Azure file sha
26
21
Azure Files NFS v4.1 volumes enhance network security by enabling secure TLS connections, protecting data in transit from interception, including MITM attacks.
27
22
28
23
Using [Stunnel](https://www.stunnel.org/), an open-source TLS wrapper, Azure Files encrypts the TCP stream between the NFS client and Azure Files with strong encryption using AES-GCM, without needing Kerberos. This ensures data confidentiality while eliminating the need for complex setups or external authentication systems like Active Directory.
29
-
30
-
The AZNFS utility package simplifies encrypted mounts by installing and setting up Stunnel on the client. Available on packages.microsoft.com, AZNFS creates a local secure endpoint that transparently forwards NFS client requests over an encrypted connection. The key architectural components include:
31
-
24
+
25
+
The [AZNFS](https://github.com/Azure/AZNFS-mount) utility package simplifies encrypted mounts by installing and setting up Stunnel on the client. Available on packages.microsoft.com, AZNFS creates a local secure endpoint that transparently forwards NFS client requests over an encrypted connection. The key architectural components include:
26
+
32
27
-**AZNFS Mount Helper**: A client utility package that abstracts the complexity of establishing secure tunnels for NFSv4.1 traffic.
33
28
34
29
-**Stunnel Process**: Per-storage-account client process that listens for NFS client traffic on a local port and forwards it securely over TLS to the Azure Files NFS server.
@@ -37,49 +32,55 @@ The AZNFS utility package simplifies encrypted mounts by installing and setting
37
32
38
33
## Supported regions
39
34
40
-
All regions supported by Azure Premium Files now support encryption in transit, with the exception of Korea Central, West Europe, Japan West, China North3, Israel Central, and Austria East.
41
-
35
+
All regions supported by Azure Premium Files now support encryption in transit, with the exception of Korea Central, West Europe, Japan West, China North 3, and Israel Central.
42
36
43
-
## Enforce encryption in transit
44
-
45
-
By enabling the **Secure transfer required** setting on the storage account, you can ensure that all the mounts to the NFS volumes in the storage account are encrypted.
46
-
47
-
48
-
:::image type="content" source="./media/eit-for-nfs-shares/storage-account-settings.png" alt-text="Diagram showing the Powershell screen to test if EiT is applied." lightbox="./media/eit-for-nfs-shares/storage-account-settings.png":::
49
-
50
-
However, for users who prefer to maintain flexibility between TLS and non-TLS connections on the same storage account, the 'Secure transfer' setting must remain OFF.
51
-
52
37
## Register for preview
53
38
54
39
To enable encryption in transit for your NFS shares, you must register for the preview feature.
55
40
56
41
57
42
### [Portal](#tab/azure-portal)
58
43
59
-
Azure Portal support for this feature isn't currently available. In the meantime, you can enroll in the preview using either Azure PowerShell or Azure CLI.
44
+
Register through the Azure portal by searching for "Encryption in transit for Azure NFS file shares" under Preview Features.
45
+
46
+
:::image type="content" source="./media/encryption-in-transit-nfs-shares/portal-registration-encryption-in-transit.png" alt-text="Diagram showing the Azure portal screen to test if EiT is applied." lightbox="./media/encryption-in-transit-nfs-shares/portal-registration-encryption-in-transit.png":::
47
+
60
48
49
+
For more information, see [Set up preview features in Azure subscription](/azure/azure-resource-manager/management/preview-features?tabs=azure-portal).
61
50
62
51
63
52
### [PowerShell](#tab/azure-powershell)
64
53
65
-
-Register through PowerShell using [Get-AzProviderFeature](/powershell/module/az.resources/register-azproviderfeature)
54
+
Register through PowerShell using [Register-AzProviderFeature](/powershell/module/az.resources/register-azproviderfeature)
By enabling the **Secure transfer required** setting on the storage account, you can ensure that all the mounts to the NFS volumes in the storage account are encrypted.
71
+
72
+
:::image type="content" source="./media/encryption-in-transit-nfs-shares/storage-account-settings.png" alt-text="Screenshot showing how to enable Secure transfer on a storage account." lightbox="./media/encryption-in-transit-nfs-shares/storage-account-settings.png":::
73
+
74
+
However, for users who prefer to maintain flexibility between TLS and non-TLS connections on the same storage account, the **Secure transfer** setting must remain OFF.
75
75
76
76
## How to encrypt data in transit for NFS shares (preview)
77
77
78
78
Follow these steps to encrypt data in transit:
79
79
80
80
1. Ensure the required AZNFS mount helper package is installed on the client.
81
-
2. Mount the NFS file share with TLS encryption.
82
-
3. Verify that the encryption of data succeeded.
81
+
1. Mount the NFS file share with TLS encryption.
82
+
1. Verify that the encryption of data succeeded.
83
+
83
84
### Step 1: Check AZNFS mount helper package installation
84
85
85
86
To check if the AZNFS mount helper package is installed on your client, run the following command:
@@ -90,52 +91,51 @@ If the package is installed, you'll see the message `AZNFS mounthelper is instal
2. Mount the NFS share by using the following cmdlet. Replace `<storage-account-name>` with the name of your storage account and replace `<share-name>` with the name of your file share.
159
+
160
+
1. Mount the NFS share by using the following cmdlet. Replace `<storage-account-name>` with the name of your storage account and replace `<share-name>` with the name of your file share.
164
161
165
162
```bash
166
163
sudo mount -t aznfs <storage-account-name>.file.core.windows.net:/<storage-account-name>/<share-name> /mount/<storage-account-name>/<share-name> -o vers=4,minorversion=1,sec=sys,nconnect=4
167
164
```
168
165
169
-
170
-
171
166
To mount the NFS share **without TLS encryption**:
167
+
172
168
```bash
173
169
sudo mount -t aznfs <storage-account-name>.file.core.windows.net:/<storage-account-name>/<share-name> /mount/<storage-account-name>/<share-name> -o vers=4,minorversion=1,sec=sys,nconnect=4,notls
174
170
```
175
-
> [!NOTE]
176
-
> Before running the mount command, ensure that the environment variable AZURE_ENDPOINT_OVERRIDE is set. This is required when mounting file shares in non-public Azure cloud regions or when using custom DNS configurations.
177
-
> For example, for Azure China Cloud: `export AZURE_ENDPOINT_OVERRIDE="chinacloudapi.cn"`
178
171
172
+
To have the share **mounted automatically on reboot**, create an entry in the `/etc/fstab` file by adding the following line:
> Before running the mount command, ensure that the environment variable AZURE_ENDPOINT_OVERRIDE is set. This is required when mounting file shares in non-public Azure cloud regions or when using custom DNS configurations.
180
+
> For example, for Azure China Cloud: `export AZURE_ENDPOINT_OVERRIDE="chinacloudapi.cn"`
181
181
182
182
### Step 3: Verify that the in-transit data encryption succeeded
183
183
184
184
Run the command `df -Th`.
185
185
186
-
187
-
:::image type="content" source="./media/eit-for-nfs-shares/powershell-capture.png" alt-text="Diagram showing the Powershell screen to test if EiT is applied." lightbox="./media/eit-for-nfs-shares/powershell-capture.png":::
186
+
:::image type="content" source="./media/encryption-in-transit-nfs-shares/powershell-capture.png" alt-text="Diagram showing the Powershell screen to test if EiT is applied." lightbox="./media/encryption-in-transit-nfs-shares/powershell-capture.png":::
188
187
189
188
It indicates that the client is connected through the local port 127.0.0.1, not an external network. The **stunnel** process listens on 127.0.0.1 (localhost) for incoming NFS traffic from the NFS client. Stunnel then **intercepts** this traffic and securely forwards it over **TLS** to the Azure Files NFS server on Azure.
190
189
@@ -196,7 +195,7 @@ sudo tcpdump -i any port 2049 -w nfs_traffic.pcap
196
195
```
197
196
When you open the capture in Wireshark, the payload will appear as "Application Data" instead of readable text.
198
197
199
-
:::image type="content" source="./media/eit-for-nfs-shares/wireshark-capture.png" alt-text="Diagram showing the Wireshark screen to test if EiT is applied." lightbox="./media/eit-for-nfs-shares/wireshark-capture.png":::
198
+
:::image type="content" source="./media/encryption-in-transit-nfs-shares/wireshark-capture.png" alt-text="Diagram showing the Wireshark screen to test if EiT is applied." lightbox="./media/encryption-in-transit-nfs-shares/wireshark-capture.png":::
200
199
201
200
> [!NOTE]
202
201
> All traffic from a virtual machine to the same server endpoint uses a single connection. The AZNFS mount helper ensures that you can't mix TLS and non-TLS configurations when mounting shares to that server. This rule applies to shares from the same storage account and different storage accounts that resolve to the same IP address.
@@ -205,7 +204,6 @@ When you open the capture in Wireshark, the payload will appear as "Application
205
204
206
205
A **non-TLS (notls) mount** operation might fail if a previous **TLS-encrypted** mount to the same server was terminated before completing successfully. Although the *aznfswatchdog* service automatically cleans up stale entries after a timeout, attempting a new non-TLS mount before cleanup completes can fail.
207
206
208
-
209
207
To resolve this issue, remount the share using the clean option, which immediately clears any stale entries:
210
208
```bash
211
209
sudo mount -t aznfs <storage-account-name>.file.core.windows.net:/<storage-account-name>/<share-name> /mount/<storage-account-name>/<share-name> -o vers=4,minorversion=1,sec=sys,nconnect=4,notls,clean
@@ -217,4 +215,4 @@ If mounting issues continue, check the log files for more troubleshooting detail
217
215
218
216
## See also
219
217
220
-
-[Azure Storage encryption for data at rest | Microsoft Learn](/azure/storage/common/storage-service-encryption)
218
+
-[Azure Storage encryption for data at rest](/azure/storage/common/storage-service-encryption)
0 commit comments