openclaw-server-secure-skill_skill

This skill guides secure OpenClaw server setup, enabling SSH hardening, firewall, Tailscale VPN, and agent installation for safe remote management.

Python

2.5k

GitHub Stars

2

Bundled Files

2 months ago

Catalog Refreshed

4 months ago

First Indexed

Readme & install

Copy the install command, review bundled files from the catalogue, and read any extended description pulled from the listing source.

Installation

Preview and clipboard use veilstrat where the catalogue uses aiagentskills.

npx veilstrat add skill openclaw/skills --skill openclaw-server-secure-skill

_meta.json312 B
SKILL.md4.0 KB

Overview

This skill provides a practical, step-by-step hardening and installation guide for a self-hosted OpenClaw server. It focuses on SSH lockdown, a default-deny firewall, brute-force protection, Tailscale VPN for private access, and the OpenClaw agent installation and configuration. The goal is to minimize public exposure while keeping remote admin access reliable.

How this skill works

The skill walks through system hardening (SSH config changes, UFW policy, and Fail2ban), then sets up Tailscale to move management into a private mesh network. After network privacy is established, it installs and configures the OpenClaw agent, secures credentials, and runs a final security audit. Verification commands are provided to confirm firewall rules, open sockets, Tailscale status, and OpenClaw health.

When to use it

Setting up a new server to host OpenClaw with a secure baseline.
Migrating an exposed OpenClaw instance to a private Tailscale-only access model.
Hardening remote admin access before installing production agents.
Auditing and tightening existing OpenClaw installations.
Preparing a backup or archive host that should not be publicly reachable.

Best practices

Require SSH key authentication and disable password and root login before enabling the firewall.
Enable a default-deny UFW policy then explicitly allow only required traffic (prefer Tailscale subnets).
Install and enable Fail2ban to reduce brute-force risk against any remaining public services.
Use Tailscale to restrict SSH and web ports to the 100.64.0.0/10 mesh, removing public access rules.
Restrict credential files with strict filesystem permissions and run the OpenClaw security audit after setup.

Example use cases

Install OpenClaw on a VPS and restrict management to your laptop via Tailscale.
Convert an older, publicly exposed bot host into a private, audited archive server.
Deploy a secure test environment for OpenClaw where only team members can access services.
Lock down an off-site backup node used for archives and automated tasks.

FAQ

Yes. Ensure you have an out-of-band console or another reachable interface in case SSH rules accidentally lock you out.

Can I keep public web access while using Tailscale?

You can, but the recommendation is to restrict web ports to Tailscale and only expose public ports if absolutely necessary with additional web hardening.