- name
- vps-openclaw-security-hardening
- description
- Production-ready security hardening for VPS running OpenClaw AI agents. Includes SSH hardening (custom port), firewall, audit logging, credential management, and intelligent alerting. Follows BSI IT-Grundschutz and NIST guidelines with minimal resource overhead.
- version
- 1.0.6
- author
- OpenClaw Community
- homepage
- https://github.com/MarcusGraetsch/vps-openclaw-security-hardening
- metadata
- openclaw
- emoji
- 🛡️
- requires
- bins
- ["ssh", "ufw", "auditd", "systemctl", "apt-get"]
- optional
- ["fail2ban"]
- os
- ["ubuntu", "debian"]
- tags
- ["security", "hardening", "vps", "audit", "monitoring", "firewall", "ssh", "fail2ban"]
- install
- SSH_PORT=4848 ./scripts/install.sh
- verify
- ./scripts/verify.sh
- warning
- DO NOT use on machines with sensitive personal data. Use dedicated VPS only. Test in VM first.
VPS Security Hardening for OpenClaw
Production-ready security hardening for AI agent deployments on VPS.
⚠️ CRITICAL WARNINGS
DO NOT run OpenClaw on servers/machines with sensitive personal data. Use a dedicated machine (VPS, bare-metal, or on-premise server dedicated to OpenClaw).
Supported OS: Ubuntu 20.04+, Debian 11+. Not for Windows (use WSL2) or macOS.
⚠️ Choose Your SSH Port First
You must choose a custom SSH port (1024-65535) before installing. This makes you conscious of the security decision.
# Choose your port (example: 4848)
export SSH_PORT=4848
# Install
cd ~/.openclaw/skills/vps-openclaw-security-hardening
sudo ./scripts/install.sh
# Verify
./scripts/verify.sh
# Test SSH (new terminal)
ssh -p ${SSH_PORT} root@your-vps-ipWhat It Does
| Layer | Protection | Implementation |
|---|---|---|
| Network | Firewall, SSH hardening | UFW, custom port (your choice), key-only |
| System | Auto-updates, monitoring | unattended-upgrades, auditd |
| Secrets | Credential management | Centralized .env, 600 permissions |
| Monitoring | Audit logging, alerting | Kernel-level audit, multi-channel alerts |
Requirements
- OS: Ubuntu 20.04+ or Debian 11+ (Linux only)
- NOT supported: Windows (use WSL2), macOS
- Root access
- Existing SSH key authentication
- Alert channel (optional): Telegram, Discord, Slack, Email, or Webhook
- Custom SSH port of your choice (1024-65535)
Security Changes
SSH
- Port: 22 → ${SSH_PORT} (your choice, 1024-65535)
- Auth: Keys only (no passwords)
- Root login: Disabled
- Max retries: 3
- Fail2ban: Brute-force protection
Firewall
- Default: Deny incoming
- Allow: Your chosen SSH port only
Services
- CUPS (printing): Stopped & disabled
- Fail2ban: Intrusion detection enabled
- Auto-updates: Security patches automatic
Monitoring
- Credential file access tracking
- SSH config change detection
- Privilege escalation alerts
- Daily security briefing
Resource Usage
| Component | RAM | Disk |
|---|---|---|
| Auditd | ~2 MB | 40 MB max |
| UFW | ~1 MB | Negligible |
| Scripts | ~5 MB | Negligible |
| Total | <10 MB | <50 MB |
Files
scripts/install.sh- Main installationscripts/verify.sh- Verify installationscripts/rollback-ssh.sh- Emergency rollbackscripts/critical-alert.sh- Telegram alertsscripts/daily-briefing.sh- Daily reportsrules/audit.rules- Audit configuration
Documentation
See README.md for full documentation.
License
MIT - See LICENSE file