OpenClaw VPS Security Preflight

A free, browser-only checklist for reviewing 12 exposure and recovery controls before connecting real accounts or data to an OpenClaw Gateway on a Linux VPS.

Run the live preflight

Install as an OpenClaw Skill

Install the reviewed release from ClawHub:

openclaw skills install @tinyopsstudio/vps-security-preflight

The skill bundles the same read-only Linux audit script and guides an operator through safe execution, interpretation, and remediation planning.

What It Checks

• Loopback or private-network Gateway exposure
• Gateway authentication and trusted remote access
• Paired or allowlisted inbound senders
• Deliberate tool scope and isolated browser state
• Secret handling, non-root operation, patching, and firewall rules
• Supervised startup, RPC health, deep security review, backup, and rollback readiness

Five controls are marked critical. The result panel updates as controls are verified and produces a plain-text remediation list for private operating evidence.

Privacy Model

This repository edition has no analytics, telemetry, signup, storage, or host-data fields. Check state stays in the page and disappears on refresh. Copy and download actions run locally in the browser.

Run Locally

The tool has no build step or package dependencies.

python3 -m http.server 8000

Then open http://localhost:8000.

Optional Linux CLI Audit

The repository also includes a read-only host audit for Linux VPS operators. It checks the local Gateway listener and authentication mode, supervised startup, firewall detection, effective SSH policy, fail2ban, automatic security updates, time synchronization, and the official OpenClaw security-audit command.

./scripts/openclaw-vps-preflight.sh

Use --strict in an acceptance check, or --show-audit to display the current official deep security-audit output. The script does not change configuration, install packages, write files, or upload host data. It deliberately leaves backup freshness, restore testing, provider spend limits, and rollback evidence for manual verification.

Do not paste raw audit output into a public issue without reviewing it for host-specific details.

Scope

This is a conservative preflight for one trusted operator. It is not a formal security audit, penetration test, certification, warranty, or guarantee. OpenClaw changes quickly, so verify commands and configuration against the current official security documentation.

Operator Packet

The paid OpenClaw VPS Deployment Kit adds 13 editable deployment, systemd, acceptance, rollback, incident, inventory, and change-control files. A fixed-scope VPS setup service is also available.

The paid kit is not included in this repository and has its own license.

License

The preflight source in this repository is available under the MIT License.