Harden Linux for OpenClaw

VPS & server hardening guide covering all 9 Clawkeeper Linux security checks (7 host hardening + 2 network).

User Account Security

Create a dedicated non-root user

$ adduser openclaw && usermod -aG sudo openclaw

Never run OpenClaw as root. A dedicated user limits blast radius if a skill is compromised.

linux_user_account

Verifies a non-root user account is in use

SSH Hardening

Disable password authentication

Edit /etc/ssh/sshd_config:

/etc/ssh/sshd_config

PermitRootLogin prohibit-password
PasswordAuthentication no
X11Forwarding no
MaxAuthTries 3
AllowAgentForwarding no

$ sudo sshd -t && sudo systemctl reload sshd

linux_ssh_hardening

Audits SSH config: key auth, root login, X11, agent forwarding

Don't lock yourself out

Before restarting sshd, open a second SSH session as a backup. Verify your key works before closing the original.

Cloud Deploy does this automatically

Clawkeeper Cloud Deploy applies all 5 SSH hardening directives during provisioning. Cloud instances get an A grade out of the box.

Firewall Configuration

Enable UFW with minimal rules

$ sudo ufw default deny incoming && sudo ufw default allow outgoing

$ sudo ufw allow 22/tcp comment 'SSH'

$ sudo ufw allow 443/tcp comment 'HTTPS'

$ sudo ufw enable

linux_firewall

Ensures UFW/firewalld is active with sensible rules

Alternative: firewalld

On RHEL/Fedora, use firewall-cmd instead. Clawkeeper detects both UFW and firewalld.

Automatic Security Updates

Enable unattended upgrades

Ubuntu / Debian

$ sudo apt install -y unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades

Fedora / RHEL

$ sudo dnf install -y dnf-automatic && sudo systemctl enable --now dnf-automatic-install.timer

linux_auto_updates

Checks that automatic security updates are enabled

Intrusion Prevention

Install and configure fail2ban

$ sudo apt install -y fail2ban

/etc/fail2ban/jail.local

[sshd]
enabled = true
port = ssh
maxretry = 5
bantime = 3600
findtime = 600

$ sudo systemctl enable --now fail2ban

linux_fail2ban

Verifies fail2ban is installed and protecting SSH

Unnecessary Services

Audit and disable unused services

$ sudo systemctl list-unit-files --type=service --state=enabled

Review the list and disable anything you don't need. Common candidates: cups, avahi-daemon, bluetooth.

$ sudo systemctl disable --now cups avahi-daemon bluetooth

linux_unnecessary_services

Flags unnecessary services that increase attack surface

Disk Encryption

Verify LUKS encryption

$ sudo lsblk -f | grep -i luks

Full disk encryption should be enabled during OS installation. If you see LUKS partitions, you're covered.

linux_disk_encryption

Checks for LUKS full-disk encryption

VPS providers

Most VPS providers don't support LUKS out of the box. If your provider offers encrypted volumes, enable them. Otherwise, this check will be skipped.

Network Security

Harden network settings

/etc/sysctl.d/99-hardening.conf

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

$ sudo sysctl --system

linux_network

Audits kernel network parameters for hardening

Audit open ports

$ sudo ss -tlnp

Every listening port is a potential entry point. Close ports you don't recognize, and bind services to 127.0.0.1 when they only need local access.

linux_open_ports

Lists open ports and flags unexpected listeners

Complete 9-Check Checklist

clawkeeper — Linux checks

$ npx clawkeeper scan --phase linux

PASS linux_user_accountPASS linux_ssh_hardeningPASS linux_firewallPASS linux_auto_updatesPASS linux_fail2banPASS linux_unnecessary_servicesPASS linux_disk_encryptionPASS linux_networkPASS linux_open_ports

─────────────────────────────────

9/9 checks passed. Grade: A

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.