OpenClaw VPS Security Checklist

Yeh checklist mandatory kyun hai

Jab aap OpenClaw install karte hain, toh aap ek aisa agent deploy kar rahe hain jo files read kar sakta hai, code execute kar sakta hai, aur aapke API credits spend kar sakta hai. Yeh external messaging channels se connect hota hai. Agar koi bot ya automated scanner aapke VPS ko compromise karta hai, toh unhe sirf ek khali server nahi milta — unhe aapke AI infrastructure, aapke bot tokens, aur aapke billing accounts ka access mil jata hai.

Yeh checklist internet ko face karne wale kisi bhi OpenClaw server ke liye absolute minimum hardening cover karti hai.

---

Phase 1: Access Control

1. Root Login Disable Karein

Aapko kabhi bhi root ke roop mein log in nahi karna chahiye. Aapko sudo privileges wale ek standard user ke roop mein log in karna chahiye.

• /etc/ssh/sshd_config open karein
• PermitRootLogin no set karein
• SSH restart karein: sudo systemctl restart ssh

2. Password Authentication Disable Karein

Passwords ko brute-force kiya ja sakta hai. SSH keys ko nahi.

• Ensure karein ki aapka SSH public key aapke non-root user ke liye ~/.ssh/authorized_keys mein maujood hai.
• /etc/ssh/sshd_config open karein
• PasswordAuthentication no set karein
• SSH restart karein: sudo systemctl restart ssh

---

Phase 2: Firewall (UFW)

Aapke server ko default roop se SSH ke alawa saara incoming traffic drop kar dena chahiye.

3. UFW Rules Configure Karein

Current status check karein:

1 sudo ufw status

Agar yeh inactive hai, toh default policies set karein aur SSH ko allow karein:

1 sudo ufw default deny incoming && sudo ufw default allow outgoing

1 sudo ufw allow OpenSSH

Aapke config ke hisaab se 'sudo ufw allow 22/tcp' bhi ho sakta hai.

Firewall enable karein:

1 sudo ufw enable

4. Gateway Binding Verify Karein

Firewall hone ke bawajood, defense-in-depth kehta hai ki Gateway process khud public network interface par listen nahi karna chahiye.

Run karein:

1 sudo ss -tulpn | grep 18789

Ensure karein ki output 127.0.0.1:18789 (ya koi Tailscale IP) dikhata hai, aur nahi 0.0.0.0:18789. Agar yeh 0.0.0.0 kehta hai, toh apni .env file open karein, OPENCLAW_HOST=127.0.0.1 set karein, aur Gateway restart karein.

---

Phase 3: Secret Management

5. .env File ko Protect Karein

Aapki .env file mein aapke AI model API keys aur channel tokens hote hain. Ise lock down kiya jana chahiye.

Apne workspace mein navigate karein aur permissions restrict karein:

1 chmod 600 .env

Yeh ensure karta hai ki sirf file ka owner isko read ya write kar sakta hai. Group aur global permissions remove kar di jati hain.

6. Secrets ko Commit Mat Karein

Agar aap apne workspace ka backup lene ya version control karne ke liye Git ka use karte hain, toh ensure karein ki .env aapki .gitignore file mein ho. Agar aap galti se kisi public GitHub repo par API key commit kar dete hain, toh usko seconds mein scrape aur use kar liya jayega.

---

Phase 4: System Hygiene

7. Fail2Ban Install Karein (Optional but Recommended)

Fail2Ban un IP addresses ko automatically block kar deta hai jo baar-baar SSH login mein fail hote hain.

1 sudo apt install fail2ban -y

1 sudo systemctl enable --now fail2ban

8. Unattended Upgrades Enable Karein

Apne Ubuntu server ko security updates ke liye automatically patch karte rahein.

1 sudo apt install unattended-upgrades -y

1 sudo dpkg-reconfigure --priority=low unattended-upgrades

---

Phase 5: OpenClaw Specifics

9. Channel Allowlists Configure Karein

Apne Telegram ya WhatsApp bots ko public ke liye open mat chhodein jab tak ki explicitly wahi aapka product na ho. Apne .env file mein apna numeric User ID use karke TELEGRAM_ALLOWLIST configure karein.

10. Tool Permissions Audit Karein

Agar aapke agent ko shell commands execute karne ki zaroorat nahi hai, toh shell execution tool enable mat karein. Agar usko files write karne ki zaroorat nahi hai, toh use read-only tak restrict karein. Principle of least privilege grant karein.

---

Monthly Maintenance Checklist

Isse mahine mein ek baar karne ke liye calendar reminder set karein:

• Server mein SSH karein aur sudo apt update && sudo apt upgrade -y run karein
• Unusual activity ke liye Gateway logs check karein (pm2 logs openclaw)
• Server ko reboot karein (sudo reboot) yeh ensure karne ke liye ki PM2 aur Gateway automatically recover hote hain.
• Apne Anthropic/OpenAI accounts par billing limits check karein taaki koi unexpected spikes na aayen.

Kya NAHI karna hai

• “Permission denied” errors fix karne ke liye apne workspace folder par chmod 777 ka use mat karein. Iske bajaye owner ko fix karne ke liye chown ka use karein.
• Unredacted logs post mat karein. Agar aap madad maangte hain, toh IPs aur tokens ko XXX se replace karein.
• Kisi aise vyakti ke saath apna root password share mat karein jo “aapke liye isko fix karne” ka offer de raha ho.

Madad kab maangein

Agar aap sure nahi hain ki aapka firewall sahi se configured hai ya nahi, ya agar aapko shak hai ki aapka server compromise ho gaya hai, toh Setup Help service ke through Security Audit request karein. Hum aapke posture ko verify karne ke liye redacted ss aur ufw outputs ka review kar sakte hain.