Change the default remote port-Elastic Compute Service(ECS)-阿里云帮助中心

Changing default remote access ports, such as port 3389 for Remote Desktop Protocol (RDP) on Windows and port 22 for Secure Shell (SSH) on Linux, enhances system security. This practice helps protect your server or service from unauthorized access by preventing automated attacks and malicious scans that target well-known ports. This topic explains how to change the default remote port of an ECS instance.

Changing the port for Windows instances

This section explains how to change the default remote port of a Windows instance, using Windows Server 2022 as an example.

Important

When you use Microsoft Remote Desktop for Mac to connect to a Windows ECS instance, only the default port 3389 is supported.

Connect to the Windows instance.

For more information, see Connect to a Windows instance by using Workbench.
Modify the PortNumber registry value.
1. Press Win+R to open the Run window.
2. Enter regedit.exe and press Enter to open the Registry Editor.
3. In the navigation pane, navigate to HKEY_LOCAL_MACHINE > \System > \CurrentControlSet > \Control > \Terminal Server > \Wds > \rdpwd > \Tds > \tcp.
4. In the right pane, find and right-click the PortNumber registry value, and then select Modify.
5. In the dialog box, enter the new port number, 3399, in the Value data text box. Under Base, select Decimal and click OK.
6. In the navigation pane, navigate to HKEY_LOCAL_MACHINE > \System > \CurrentControlSet > \Control > \Terminal Server > \WinStations > \RDP-Tcp.
7. In the right pane, find and right-click the PortNumber registry value, and then select Modify.
8. In the dialog box, enter the new port number, 3399, in the Value data text box. Under Base, select Decimal and click OK.
In the ECS console, restart the ECS instance.

For more information, see Restart an instance.
Configure the Windows firewall to allow traffic on the new port.

For more information, see Manage the Windows firewall.
Add a security group rule for the instance to allow inbound traffic on the new port.

For more information, see Add a security group rule.
Connect to the instance by appending the new port number to its IP address or domain name.

For example, in the Remote Desktop Connection dialog box, enter IP_address:3399 in the Computer text box, and then click Connect.

Changing the port for Linux instances

This section explains how to change the default remote port of a Linux instance, using Alibaba Cloud Linux 3 as an example.

Important

After you complete these steps, you can no longer use port 22 to connect to the ECS instance.

Connect to the Linux instance.

For more information, see Connect to a Linux instance by using Workbench.
Run the following command to back up the sshd service configuration file:
```
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_bak
```

Modify the port number for the sshd service.

Run the following command to edit the sshd_config file:
```
sudo vim /etc/ssh/sshd_config
```
Press the i key to enter Insert mode.

Add the new remote service port.

This example uses port 1022. Add the Port 1022 line below the #Port 22 line.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

After you add the line, the configuration looks like this:

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
Port 1022
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Press the Esc key, enter :wq, and then press Enter to save the changes and exit.

Run the following command to restart the sshd service. After the service restarts, you can connect to the Linux instance by using SSH on port 1022.
```
sudo systemctl restart sshd
```
Configure the Linux firewall to allow traffic on the new port.

For more information, see Manage the Linux firewall.
Add a security group rule for the instance to allow inbound traffic on TCP port 1022.

For more information, see Add a security group rule.
Verify the configuration by connecting to the new port with an SSH client.

When connecting with an SSH client, you must specify the new Port. For example, in PuTTY, enter the instance's IP address in the Host Name (or IP address) field, enter 1022 in the Port field, select SSH as the Connection type, and then click Open.