Scan-to-FTP deprecated — safer SFTP alternatives on legacy MFPs

Joe B.

Reviewed for technical accuracy

Specialities: Linux (CUPS/Avahi), Windows Server/SMB, Microsoft 365/Exchange Online, Network Security, Enterprise MFPs

Replace scan-to-FTP with SFTP/FTPS/SMBv3 — HP, Canon, Ricoh, Xerox, Kyocera

Technician

Hey! You mentioned scan-to-FTP is failing since your security hardening. That’s expected — plain FTP is deprecated, unencrypted and often blocked by next-gen firewalls and TLS-only policies.
We’ll move your MFP to a secure scan destination: SFTP (SSH), FTPS (FTP over TLS), SMBv3 scan to network folder, or secure scan-to-email via Microsoft 365.
Tell me the MFP brand/model (HP/Canon/Ricoh/Xerox/Kyocera/Toshiba), firmware age, and which option you prefer: SFTP, FTPS, SMBv3, or M365 email.

Customer

We have a Ricoh MP C3003 and a couple of older HP LaserJet MFPs. Scan-to-FTP stopped after our SOC disabled legacy protocols. What’s the most reliable FTP replacement?

Technician

Great question. In 2025 most orgs retire FTP and pick one of these secure scan workflows:
• SFTP (SSH on port 22) — simplest, single port, strong ciphers; supported by Ricoh “Network TWAIN/SFTP” option and newer HP FutureSmart.
• FTPS (explicit TLS, 21 + passive ports) — works when MFP supports TLS 1.2+, but needs a wider firewall range.
• SMBv3 scan to network folder — uses Kerberos/NTLMv2, encryption on wire; easiest for Windows Server/NAS shares.
• Secure scan-to-email — via Exchange Online connector or an SMTP relay; good for outward workflows.
For your Ricoh, SFTP or SMBv3 are the most stable; on older HP, SMBv3 tends to be the least fussy.

Customer

Let’s try SFTP scanning. We have an Ubuntu server available. What’s the setup?

Technician

Set up SFTP for MFP scan (SEO: scan to SFTP, SFTP destination, SSH file transfer):
1) On Ubuntu/Debian, enable OpenSSH and create a locked-down sftp-only user with a home folder such as /srv/scans (chroot + write-only subfolder).
2) Require SSH key or strong password, disable legacy ciphers, keep port 22 open internally only.
3) On the MFP, add a new SFTP destination: server IP/hostname, port 22, path /incoming, auth = dedicated scan account.
4) Test with a small PDF; verify permissions, disk quotas, and filename auto-increment to avoid collisions.

Customer

Our firewall is strict. Any special ports or TLS settings to allow?

Technician

• SFTP uses only TCP/22 — allow from MFPs to the SFTP host.
• FTPS (if you ever choose it) needs 21 plus a passive range; many admins avoid it inside zero-trust networks.
• For SMBv3 scanning, allow TCP/445 to your file server; enforce SMB signing and NTLMv2/Kerberos only.
• Make sure the MFP supports at least TLS 1.2 for FTPS/SMTP; older firmware may need an update.

Customer

We still have one legacy Xerox that can’t do SFTP. Can we use SMBv3 scan to folder instead?

Technician

Absolutely. Scan to SMBv3 is a great scan-to-FTP alternative:
• Create a shared folder with modify rights for a dedicated service account (no interactive logon).
• Force SMBv3, NTLMv2/Kerberos, and enable encryption in transit on the share or server.
• On the MFP, set the destination as \\fileserver\scans, username svc_scans, and test. For NAS (Synology/QNAP), turn on SMB3 + signing and disable SMB1/NTLMv1.

Customer

We also email invoices. Is scan-to-email via Microsoft 365 safer than FTP?

Technician

Yes. With Exchange Online you can use an SMTP relay connector from a static IP, or SMTP AUTH with OAuth2 on newer devices. Benefits: TLS, DKIM/DMARC, audit trails and anti-malware scanning. Many teams combine SFTP/SMBv3 for archiving plus secure email for outward delivery.

Customer

What are common errors when migrating off FTP?

Technician

Top issues we see during a scan-to-FTP migration:
• Wrong path or permissions on the SFTP/SMB share (write-only needed).
• Outdated firmware with no TLS 1.2 or weak cipher suites.
• FTPS passive port range blocked by the firewall.
• Using a normal user instead of a least-privilege service account.
• Certificates not trusted on FTPS/SMTP — use a public CA or your enterprise CA.

Customer

Can you give a quick hardening checklist once we switch to SFTP/SMBv3?

Technician

Post-migration hardening (SEO: MFP security, disable FTP):
1) Disable FTP and Telnet/HTTP on all MFPs; require HTTPS and admin password policies.
2) Patch MFP firmware; enable TLS 1.2+ only.
3) Use dedicated service accounts with rotating credentials or SSH keys; restrict to scan folders.
4) Limit network access: allow MFPs to SFTP/SMB servers only; no outbound internet.
5) Set retention/cleanup on /incoming to prevent storage overrun; enable content AV on the server.

Customer

We’ll go SFTP for Ricoh and SMBv3 for HP/Xerox. Could you summarize the accepted fix?

Technician

Summary: Scan-to-FTP is deprecated. Migrate to SFTP (port 22) or SMBv3 scan to folder for legacy MFPs; use FTPS or secure scan-to-email (Microsoft 365) as needed. Lock down accounts, enforce TLS 1.2+, and update firmware. Need hands-on help? Open the chat and we’ll build your secure connector end-to-end.

Customer

Perfect — let’s proceed with the migration plan.

Quick answer: the accepted fix

Accepted fix when scan-to-FTP is deprecated or blocked: migrate to SFTP (SSH) or SMBv3 scan to network folder. Optionally use FTPS or Exchange Online secure scan-to-email. Enforce TLS 1.2+, restrict ports (22/445), use least-privilege service accounts, and disable FTP on the MFP.

FAQ

Step-by-step (SFTP path)

1. Provision OpenSSH/SFTP on a server; create sftp-only account and folder.
2. Open TCP/22 from MFP VLANs; restrict with ACLs.
3. On each MFP, add an SFTP destination (host, port, path, credentials/key).
4. Test, log, then disable FTP and Telnet on every device.

Step-by-step (SMBv3 path)

1. Create a secure SMB share (encryption/signing enabled) and service account.
2. Grant modify rights to the scan folder; deny interactive logon.
3. Configure the MFP with \\server\\scans and the service account.
4. Verify uploads, then document the new workflow for users.

Sources

• Microsoft — SMB security overview
• Microsoft — Set up multifunction devices to send mail
• OpenSSH — Project overview
• HP — FutureSmart security & scanning
• Ricoh — SFTP/SMB scanning documentation
• Xerox — SMB scan configuration

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.