Docs

Elastic Compute Service

Security

Changing default ports for logging in to ECS instances remotely

When you use ECS Terminal or a third-party tool to log in to an instance via remote desktop, a Linux instance defaults to the TCP protocol and port 22, and a Windows instance defaults to the TCP protocol and port 3389.

If you need to change the default remote login ports to reduce the risk of scanning and attacks by malicious software and improve instance security, this topic is for your reference.

warning

After the change, you can no longer access the ECS instance using the original default port.

If you need to change the port again or reuse the original default port, perform as instructed in this topic again.

If you cannot remotely log in to the instance after changing the port, log in via VNC tools, and then perform as instructed in this topic for changes.

Procedure

Linux operating system

Windows operating system

CentOS is used as an example.

You can change the default login port only after logging in as the root account.

Execute the following command to back up the configuration file of the sshd service.

Execute the following command to modify the sshd_config configuration file.

Press the i key to enter edit mode. Then, under the #Port 22 line, add a new line with the new port in the format Port [new port number], for example, Port 1122.

Press the Esc key, enter :wq, and then press Enter to save and exit the sshd_config configuration file.

Execute the following command to restart the sshd service. After the restart, you can log in to the Linux instance via SSH on port 1122.

Configure the security group rule of the instance 1122 as follows.

This allows TCP requests from any address to connect to the ECS instance on port 1122. You can also specify a source address range to control where requests come from.

Click "Confirm". If you can log in to the instance, the port is configured successfully.

Last updated: 2026.06.18 17:49:50