Secure OpenClaw VPS Before Exposing to Internet

This guide walks you through hardening a fresh OpenClaw VPS before it faces the public internet. You’ll lock down SSH, set up a firewall, enable automatic updates, and configure basic intrusion prevention—so your server is far less likely to be compromised. You’ll need root or sudo access to the VPS and a basic comfort with the command line.

What You’ll Need

• A VPS running a recent Linux distribution (Ubuntu 22.04/24.04, Debian 12, or similar).
• SSH access to the server (you’re already logged in).
• A second terminal window or a way to test SSH from another machine.
• Optional: a domain name if you plan to use HTTPS later.

Step-by-Step

1. Update everything. Run sudo apt update && sudo apt upgrade -y (or your distro’s equivalent). Reboot if a kernel update was applied.
2. Create a non-root user. Use adduser myuser and give it a strong password. Then add to sudo group: usermod -aG sudo myuser. You’ll use this account for daily work.
3. Set up SSH keys. On your local machine, generate a key pair if you don’t have one: ssh-keygen -t ed25519. Copy the public key to the VPS: ssh-copy-id myuser@your_server_ip. Test logging in with the key before proceeding.
4. Disable password SSH login. Edit /etc/ssh/sshd_config and set PasswordAuthentication no. Also set PermitRootLogin no. Then restart SSH: sudo systemctl restart sshd. Keep your current SSH session open—if you lock yourself out, you can still recover.
5. Configure a firewall. Install UFW if not present: sudo apt install ufw. Allow SSH (port 22) and any other essential ports (e.g., 80/443 for web). Then enable: sudo ufw allow OpenSSH, sudo ufw enable. Check status with sudo ufw status.
6. Install and configure Fail2ban. sudo apt install fail2ban. Create a local config file /etc/fail2ban/jail.local with:

   [sshd]
   enabled = true
   port = ssh
   maxretry = 5
   bantime = 3600

   Then restart: sudo systemctl restart fail2ban.

7. Enable automatic security updates. Install unattended-upgrades and configure it: sudo dpkg-reconfigure unattended-upgrades (choose Yes). Verify with sudo systemctl status unattended-upgrades.
8. Harden sysctl network settings. Add these lines to /etc/sysctl.conf to prevent IP spoofing and redirects:

   net.ipv4.conf.all.rp_filter = 1
   net.ipv4.conf.default.rp_filter = 1
   net.ipv4.conf.all.accept_redirects = 0
   net.ipv6.conf.all.accept_redirects = 0

   Apply with sudo sysctl -p.

9. Set up a basic intrusion detection (optional but recommended). Install aide and initialize its database: sudo aideinit. This creates a snapshot of system files; run sudo aide.wrapper --check periodically to spot changes.
10. Disable unused services. Run sudo ss -tulpn to see listening ports. If you see anything you don’t need (e.g., telnet, rpcbind), disable and remove the package.
11. Configure logwatch (optional). Install logwatch and set it to email you a daily summary: sudo apt install logwatch then edit /etc/cron.daily/00logwatch to add your email.
12. Reboot and test. Reboot the VPS, then try SSH with your key from a fresh terminal. Also verify the firewall is active and fail2ban is running.

Common Mistakes

• Disabling password auth before testing the key—you can lock yourself out.
• Forgetting to allow SSH in UFW before enabling it—you lose remote access.
• Using a weak password for the new user—use a passphrase or a long random string.
• Not rebooting after kernel updates—the old kernel remains vulnerable.
• Opening extra ports “just in case”—only expose what you actually need.

Tips

• Use a non-standard SSH port (e.g., 2222) to reduce automated attacks, but remember to update UFW and fail2ban accordingly.
• Consider setting up a VPN (like WireGuard) for admin access instead of exposing SSH to the world.
• Keep your server’s timezone and NTP correct—logs are easier to correlate.
• Regularly review /var/log/auth.log for unusual login attempts.
• If you run web services, install a TLS certificate (e.g., Let’s Encrypt) to encrypt traffic.

Troubleshooting

• Locked out of SSH. Use your VPS provider’s web console (out-of-band access) to log in as root. Re-enable password auth temporarily, fix the key, then disable again.
• UFW blocks SSH after enabling. If you forgot to allow SSH, use the provider’s console to run sudo ufw allow OpenSSH and then sudo ufw reload.
• Fail2ban bans your own IP. Check sudo fail2ban-client set sshd unbanip YOUR_IP. Adjust maxretry and bantime if needed.
• Unattended upgrades not running. Check systemctl status unattended-upgrades and the config at /etc/apt/apt.conf.d/20auto-upgrades—ensure both lines are set to “1”.
• SSH key not working. Verify permissions: ~/.ssh should be 700, authorized_keys 600. Check /var/log/auth.log for errors.

Frequently Asked Questions

Do I really need all these steps for a small project?

Yes, even small VPSs get scanned and attacked within minutes of going online. The steps are quick and dramatically reduce risk.

What if I need to expose other services (like a web app)?

Only open the ports you need (80/443) and consider putting the service behind a reverse proxy. Apply the same principle: keep software updated and use strong authentication.

Can I use a key with a passphrase?

Yes, it’s recommended. Use ssh-agent to avoid typing it every time.

Will fail2ban affect legitimate users?

It can if they mistype passwords repeatedly, but you can whitelist your own IP in jail.local with ignoreip.

How often should I run AIDE checks?

Weekly is a good balance. You can automate it with cron and email the report.

What if my VPS provider has its own firewall?

Use both. The provider firewall blocks traffic before it reaches your OS, which is a good first layer, but the local firewall protects against internal threats too.

Related

• Multiple Matches into Separate Rows? Excel Guide
• Verify Valorant Account: Step-by-Step Guide
• Keyword Research Tools for Hidden Ranking Gaps