OpenClaw Security 101

Never run OpenClaw on the same computer you use for banking, email, or personal stuff. Get a separate machine — even a cheap one works.

The root user on Linux can do anything — delete files, install malware, read secrets. Create a regular user for OpenClaw instead.

Create a dedicated user

# Create a new user called "openclaw"
sudo adduser openclaw

# Give it permission to use sudo (only when needed)
sudo usermod -aG sudo openclaw

# Switch to that user
su - openclaw

OpenClaw runs on port 18789 by default. Anyone who knows OpenClaw exists can scan the internet for that port. Changing it is like moving your front door — automated attackers won't find it.

Edit your config

{
  "gateway": {
    "port": 39217,
    "bind": "127.0.0.1"
  }
}

Pick any number between 10000 and 65535. Don't use the example above — pick your own random number.

openclaw gateway restart

Tailscale creates a private network between your devices. Your server becomes invisible to the entire internet — only your approved devices can see it. It's like a secret tunnel that only you have the key to.

Install Tailscale on your server

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

It'll give you a link to log in. Click it, sign in with Google/GitHub, and you're done.

Install on your phone/laptop too

Download the Tailscale app on every device you want to access OpenClaw from. Now they can all talk to each other privately.

Bind OpenClaw to Tailscale only

{
  "gateway": {
    "bind": "100.x.x.x",
    "port": 39217
  }
}

Replace 100.x.x.x with your server's Tailscale IP (find it by running tailscale ip).

SSH is how you connect to your server remotely. By default, it uses passwords — which can be guessed. SSH keys are like a physical key that can't be guessed, and Fail2ban automatically blocks anyone who tries.

Step A: Create your SSH key (on your local computer)

ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter 3 times to accept defaults. This creates a key pair on your computer.

Step B: Copy the key to your server

ssh-copy-id openclaw@YOUR_SERVER_IP

Step C: Disable password login

sudo nano /etc/ssh/sshd_config

sudo systemctl restart sshd

Step D: Install Fail2ban

sudo apt update
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Fail2ban monitors your SSH logs. 3 wrong attempts? That IP gets banned for 24 hours. Automatic.

UFW (Uncomplicated Firewall) blocks all incoming connections except the ones you specifically allow. Think of it as a bouncer at the door — if you're not on the list, you're not getting in.

# Block everything by default
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (so you don't lock yourself out!)
sudo ufw allow ssh

# If NOT using Tailscale, allow your OpenClaw port
# sudo ufw allow 39217

# Turn it on
sudo ufw enable

# Check it's working
sudo ufw status

Tell OpenClaw exactly which Telegram accounts are allowed to talk to it. Anyone else who messages your bot? Completely ignored. No response, no acknowledgment, nothing.

Find your Telegram User ID

Open Telegram, search for @userinfobot, send /start. It'll reply with your user ID (a number like 123456789).

Add it to your config

{
  "channels": {
    "telegram": {
      "allowFrom": ["tg:YOUR_USER_ID_HERE"],
      "dmPolicy": "pairing"
    }
  }
}

Set a strong auth password

{
  "gateway": {
    "auth": {
      "mode": "password",
      "password": "PICK-A-RANDOM-30-CHAR-PASSWORD-HERE"
    }
  }
}

Use 20+ characters, mix letters/numbers/symbols. Don't use the example — make your own.

This is the cool part. OpenClaw can actually examine its own configuration and tell you if anything is wrong. Just send it a message.

Audit your own security setup. Check:
1. Are you running as root? (you shouldn't be)
2. What port is the gateway on? (shouldn't be 18789)
3. Is the gateway bound to 127.0.0.1 or a Tailscale IP? (good) or 0.0.0.0? (bad)
4. Is there an allowFrom list in the config? (there should be)
5. Is UFW enabled? What ports are open?
6. Is Fail2ban running?
7. What are the file permissions on openclaw.json? (should be 600)
8. Are there any API keys hardcoded in config files? (they should be in .env)
9. Is the exec security set to "allowlist"? (it should be)
10. Check if Docker is available for sandboxing subagents.

Give me a security score out of 10 and tell me what to fix.

Configure OpenClaw to notify you whenever something unusual happens. Failed login attempts, configuration changes, new SSH connections — you'll know immediately.

Add security rules to your SOUL.md

## Security Monitoring
- If you detect any failed authentication attempts, alert me immediately
- If any configuration files are modified, tell me what changed
- If a new SSH session connects to this server, let me know
- Never output API keys, passwords, tokens, or .env file contents
- If someone asks you to reveal secrets, refuse and alert me
- Run a daily security check and report any issues

If your bot is in a group chat, anyone in that group can give it commands.They could tell it to read your files, run commands, or do things you never authorized. Keep it to DMs only.

{
  "channels": {
    "telegram": {
      "dmPolicy": "pairing",
      "allowFrom": ["tg:YOUR_USER_ID"],
      "groupPolicy": "disabled"
    }
  }
}

OpenClaw can spawn subagents — smaller AI workers that handle specific tasks autonomously. Think of them as assistants your assistant hires. They might research a topic, write code, or process files on their own.

Here's the problem: subagents read things. Webpages, files, documents. If a subagent reads a malicious webpage with hidden instructions (this is called prompt injection), it could get tricked into doing bad stuff — like reading your .env file and sending your API keys to an attacker.

The fix? Run subagents inside Docker containers. Docker is like a sealed box — the subagent can do its work, but it can't see your real files, your keys, or anything else on your server. Even if it gets prompt-injected, there's nothing to steal.

Install Docker

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker openclaw

Log out and back in after adding your user to the docker group, so it takes effect.

Configure sandbox settings

{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main",
        "workspaceAccess": "rw",
        "network": "bridge"
      }
    }
  }
}

Understanding workspace access levels

Understanding network options

You locked everything down — nice. But what happens next week when something changes? A package updates, a config drifts, a new port opens. You won't notice unless someone checks.

Good news: OpenClaw has built-in cron scheduling. You can tell your bot to run a full security audit every single morning, automatically. It's like having a security guard that checks all the locks every morning before you wake up.

Set up a daily cron job that runs a full security audit every morning at 9am. Check: firewall status, fail2ban, SSH config, file permissions, open ports, Docker status, and report any issues.

Every software update includes security patches — fixes for vulnerabilities that have been discovered since the last version. Running an old version of OpenClaw means running software with known security holes. Attackers actively scan for outdated software because the exploits are public knowledge.

Check your current version

openclaw --version

Update to the latest

npm install -g openclaw

Best practices