OpenClaw SecurityHardening Guide

version: '3.8'
services:
  openclaw:
    image: openclaw/gateway:latest
    user: "1000:1000"  # Non-root user
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Only if binding to ports < 1024
    tmpfs:
      - /tmp:noexec,nosuid,nodev
    volumes:
      - openclaw_data:/app/data:rw
      - ./config.yaml:/app/config.yaml:ro
    environment:
      - NODE_ENV=production
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 1G

volumes:
  openclaw_data:

# config.yaml - Agency Risk Mitigation
agents:
  defaults:
    sandbox:
      mode: "non-main"  # Sandbox non-main sessions
    tools:
      allowlist:
        - bash
        - read
        - write
        - edit
        - sessions_list
        - sessions_history
      denylist:
        - browser
        - web_fetch
        - web_search
        - canvas
        - nodes
        - cron

tools:
  exec:
    safeBins:
      - /usr/bin/git
      - /usr/bin/npm
      - /usr/bin/node
    requireApproval:
      - rm
      - curl
      - wget

# Human-in-the-loop for sensitive actions
approvalRequired:
  - tool: email_send
    threshold: always
  - tool: payment_process
    threshold: always
  - tool: file_delete
    threshold: always

# Instead of storing in plaintext files, use env vars
# .env file (add to .gitignore!)
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
GOOGLE_API_KEY=...

# Or use a secrets manager CLI
# Example with 1Password:
export OPENAI_API_KEY=$(op read "op://Private/OpenAI/api-key")

# Docker Compose with secrets
docker-compose --env-file .env up -d

# Better: Use Docker secrets for production
docker secret create openai_api_key ./openai_key.txt
# Then reference in compose as:
# secrets:
#   - openai_api_key

docker run -d \
  --name openclaw \
  --user 1000:1000 \
  --read-only \
  --security-opt no-new-privileges:true \
  --cap-drop ALL \
  --tmpfs /tmp:noexec,nosuid,nodev,size=100m \
  --memory 4g \
  --cpus 2 \
  --pids-limit 100 \
  --network openclaw-network \
  -v openclaw_data:/app/data:rw \
  -v ./config.yaml:/app/config.yaml:ro \
  -p 127.0.0.1:18789:18789 \
  --env-file .env \
  --restart unless-stopped \
  openclaw/gateway:latest

#!/bin/bash
# VPS Security Hardening Script

# Update system
apt update && apt upgrade -y

# Install security tools
apt install -y ufw fail2ban unattended-upgrades

# Configure UFW firewall
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp  # HTTPS only
ufw --force enable

# Configure Fail2Ban
cat > /etc/fail2ban/jail.local << 'EOF'
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
EOF

systemctl enable fail2ban
systemctl start fail2ban

# Disable password authentication
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl restart sshd

# Enable automatic security updates
dpkg-reconfigure -plow unattended-upgrades

echo "✅ Basic VPS hardening complete"
echo "⚠️  Make sure you have SSH key access before closing this session!"

# config.yaml - Gateway Security

gateway:
  bind: "127.0.0.1"  # Localhost only - use reverse proxy for external
  port: 18789

  auth:
    enabled: true
    mode: "token"
    token: "${OPENCLAW_AUTH_TOKEN}"  # Set via environment variable
    # Generate with: openssl rand -hex 32

    # If using Tailscale
    allowTailscale: true

  # Trusted proxies for proper IP detection
  trustedProxies:
    - "127.0.0.1"
    - "10.0.0.0/8"      # If using internal network
    - "172.16.0.0/12"   # Docker networks

  # Rate limiting
  rateLimit:
    enabled: true
    maxRequests: 100
    windowMs: 60000  # 1 minute

  # Session settings
  session:
    timeout: 3600000  # 1 hour
    maxConcurrent: 5

# Security audit settings
security:
  audit:
    enabled: true
    logPath: "/app/logs/audit.log"
    retention: "90d"

  # Skill verification
  skills:
    allowUnsigned: false
    trustedSources:
      - "https://clawhub.com/verified"

# Model selection (use instruction-hardened models)
models:
  default: "claude-opus-4-5-20251101"  # More robust against prompt injection
  fallback: "gpt-4-turbo"

# Always run the security doctor before starting
openclaw doctor

# Example output:
# ✓ Gateway authentication enabled
# ✓ Sandbox mode configured
# ⚠ Warning: DM access enabled - ensure you trust DM senders
# ✓ Tool allowlist configured
# ✓ No high-risk tools in allowlist
# ⚠ Warning: browser tool in allowlist - potential prompt injection vector

#!/bin/bash
# OpenClaw Security Audit Script by Cognio Labs
# Version: 1.0.0 | Last Updated: February 2026
# Usage: bash openclaw-security-audit.sh

set -e

echo "OpenClaw Security Audit"
echo "=========================="
echo ""

ISSUES=0
WARNINGS=0

# Helper functions
pass() { echo "  [PASS] $1"; }
fail() { echo "  [FAIL] $1"; ((ISSUES++)); }
warn() { echo "  [WARN] $1"; ((WARNINGS++)); }
info() { echo "  [INFO] $1"; }

# 1. Check if running as root
echo "Checking Process Security..."
if [ "$(docker exec openclaw id -u 2>/dev/null)" = "0" ]; then
    fail "Container running as root user"
else
    pass "Container running as non-root user"
fi

# 2. Check exposed ports
echo ""
echo "Checking Network Security..."
EXPOSED=$(docker port openclaw 2>/dev/null | grep -v "127.0.0.1" | wc -l)
if [ "$EXPOSED" -gt 0 ]; then
    fail "Ports exposed to 0.0.0.0 (should be localhost only)"
else
    pass "No ports exposed to 0.0.0.0"
fi

# 3. Check for public gateway
if curl -s --max-time 5 "http://localhost:18789/health" > /dev/null 2>&1; then
    RESPONSE=$(curl -s --max-time 5 "http://localhost:18789/api/status" 2>/dev/null)
    if echo "$RESPONSE" | grep -q "unauthorized"; then
        pass "Gateway authentication enabled"
    else
        fail "Gateway authentication NOT enabled"
    fi
else
    info "Gateway not accessible on localhost:18789"
fi

# 4. Check Docker security options
echo ""
echo "Checking Docker Security..."
INSPECT=$(docker inspect openclaw 2>/dev/null)

if echo "$INSPECT" | grep -q '"ReadonlyRootfs": true'; then
    pass "Read-only root filesystem enabled"
else
    fail "Read-only root filesystem NOT enabled"
fi

if echo "$INSPECT" | grep -q '"NoNewPrivileges": true'; then
    pass "No-new-privileges security option"
else
    fail "No-new-privileges NOT enabled"
fi

# Summary
echo ""
echo "=========================="
echo "Audit Summary"
echo "Issues found: $ISSUES"
echo "Warnings: $WARNINGS"
echo ""
echo "Run 'openclaw doctor' for additional checks"