Host Hardening

OpenClaw should run under a non-root user to limit blast radius.

Siri indexes files, contacts, and app activity locally.

SSH is the primary attack surface on a VPS. Hardening is critical.

Location data embeds in file metadata that OpenClaw might process or transmit.

Unnecessary radio interface. Exposes the machine to proximity-based attacks.

A firewall limits inbound access to only the ports you need.

Both create network-discoverable services. AirDrop makes this machine visible nearby.

Servers should auto-install security patches to prevent known exploits.

Diagnostic data from this machine shouldn't go to Apple or third parties.

Blocks IPs after repeated failed login attempts.

Reducing running services minimizes the attack surface.

Spotlight indexes file contents and metadata. Reduces what's queryable by a compromised agent.

Host-level firewall provides defense in depth beyond network isolation.

Protects data at rest if the server disk is accessed outside the VM.

Protects data at rest if the machine is physically compromised.

OpenClaw should run under a standard (non-admin) user to limit blast radius.

iCloud syncs data off-device. A compromised agent's files shouldn't trigger cloud uploads.

Automatic login bypasses the login screen — anyone with physical access gets in.