Recent scans have revealed over 900 OpenClaw instances exposed publicly. If you are running OpenClaw, security isn't a "nice to have." It is a requirement.

The 6 Security Layers

  1. Network Isolation: Bind to 127.0.0.1, not 0.0.0.0.
  2. Firewall (UFW): Deny all, allow only SSH.
  3. Gateway Auth: Use long, random tokens.
  4. Fail2ban: Stop brute-force attacks.
  5. Auto-Updates: Patch your OS automatically.
  6. SSH Hardening: Disable passwords, use keys.

1. Network Isolation

The single biggest mistake is binding to 0.0.0.0. Always bind to 127.0.0.1.

OPENCLAW_GATEWAY_HOST=127.0.0.1

2. SSH Hardening

Disable password authentication in /etc/ssh/sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes

3. The Docker Trap

Docker bypasses UFW by default. Always bind to 127.0.0.1 in your port mapping:

docker run -p 127.0.0.1:8080:8080 openclaw/gateway