Blob Storage SFTP to Data Factory: wrong SSH fingerprint

Hi FelixDunker-5150,
Welcome to Microsoft Q&A, thanks for posting your query.

It seems you're facing an issue with the SSH fingerprint when connecting Azure Blob Storage via SFTP to Azure Data Factory. This typically happens when the SSH host key fingerprint provided by the server doesn't match the one saved in your SFTP client's known hosts file.

• Message: Host key finger-print validation failed. Expected fingerprint is '<value in linked service>', real finger-print is '<server real value>'
• Cause: Azure Data Factory now supports more secure host key algorithms in SFTP connector. For the newly added algorithms, it requires to get the corresponding fingerprint in the SFTP server. The newly supported algorithms are:
• ssh-ed25519
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• Recommendation: Get a valid fingerprint using the Host Key Name in real finger-print from the error message in the SFTP server. You can run the command to get the fingerprint on your SFTP server. For example: run ssh-keygen -E md5 -lf <keyFilePath> in Linux server to get the fingerprint. The command may vary among different server types.
• Please go through the below Microsoft Documentations  for better understanding and guidance.

Reference:

https://video2.skills-academy.com/en-us/azure/data-factory/connector-troubleshoot-ftp-sftp-http#error-code-sftpinvalidhostkeyfingerprint

Copy and transform data in SFTP server using Azure Data Factory or Azure Synapse Analytics - Azure Data Factory & Azure Synapse | Microsoft Learn
https://video2.skills-academy.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-host-keys

Please let us know if you have any further queries. I’m happy to assist you further. 

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Thanks for your answer. I can't copy the real fingerprint from the error message, that would sabotage the whole host validation. Also, I can't run ssh-keygen, since I'm not on Linux. Where would I geht the equivalent md5 key for my Azure Blob storage? As I understand it, md5 is deprecated, so why does it give back an md5 fingerprint in the first place?

You're correct that MD5 has been deprecated due to security concerns, and most modern systems and protocols have shifted to using SHA-256 for fingerprint generation.

Some older systems and libraries still default to MD5-based fingerprints due to their historical use. In the case of Azure Blob Storage, the SFTP service is likely using a backward-compatible method to ensure it works with a wide range of clients.

To retrieve the MD5 SSH host key fingerprint for your Azure Blob Storage’s SFTP connection

• From the azure portal > Go to azure blob storage account.
• navigate to  SECURITY & NETWORKING > SFTP.
• You will find the SSH host key fingerprints, which include MD5 and SHA-256 fingerprints.

Use PowerShell on windows:

• Since you're on Windows, you can retrieve the public key using ssh-keyscan .Then, you can generate the MD5 fingerprint from it.
• "ssh-keyscan storage1.blob.core.windows.net > key.pub"

For more details you can refer below Microsoft Documentation.

https://video2.skills-academy.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support.

There is no SFTP option under "Security + Networking":

Do I understand correctly that the real fingerprint given back by Azure in the error message, "cd:61:5e:c9:f2:0f:dd:84:f2:df:2a:dd:43:38:b2:94", is an MD5 fingerprint? Why would Azure even use MD5 and can't I specify this before the key like I tried to?

Edit: Removed duplicate