openclaw-server-secure-skill

## Workflow

### Phase 1: System Hardening

1. **Lock down SSH**
    - Goal: Keys only, no passwords, no root login.
    - Action: Modify `/etc/ssh/sshd_config`.
    - Commands:
      ```bash
      # Backup config
      sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
      # Disable Password Auth
      sudo sed -i 's/^#*PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
      # Disable Root Login
      sudo sed -i 's/^#*PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config
      # Reload SSH
      sudo sshd -t && sudo systemctl reload ssh
      ```

2. **Default-deny Firewall**
    - Goal: Block everything incoming by default.
    - Action: Install and enable UFW.
    - Commands:
      ```bash
      sudo apt update && sudo apt install ufw -y
      sudo ufw default deny incoming
      sudo ufw default allow outgoing
      sudo ufw enable
      ```
      *Note: Ensure you have console access or a fallback before enabling if SSH is not yet allowed on another interface, though we configure Tailscale next.*

3. **Brute-force Protection**
    - Goal: Auto-ban IPs after failed login attempts.
    - Action: Install Fail2ban.
    - Commands:
      ```bash
      sudo apt install fail2ban -y
      sudo systemctl enable --now fail2ban
      ```

### Phase 2: Network Privacy (Tailscale)

4. **Install Tailscale**
    - Goal: Create a private VPN mesh network.
    - Commands:
      ```bash
      curl -fsSL https://tailscale.com/install.sh | sh
      sudo tailscale up
      ```
    - *Wait for user to authenticate the Tailscale link.*

5. **Configure SSH & Web via Tailscale**
    - Goal: Allow traffic only from the Tailscale subnet (100.64.0.0/10) and remove public access.
    - Commands:
      ```bash
      # Allow SSH over Tailscale
      sudo ufw allow from 100.64.0.0/10 to any port 22 proto tcp
      # Remove public SSH access (Adjust rule name/number as needed)
      sudo ufw delete allow OpenSSH || sudo ufw delete allow 22/tcp
      # Allow Web ports over Tailscale
      sudo ufw allow from 100.64.0.0/10 to any port 443 proto tcp
      sudo ufw allow from 100.64.0.0/10 to any port 80 proto tcp
      ```

6. **Disable IPv6 (Optional)**
    - Goal: Reduce attack surface.
    - Commands:
      ```bash
      sudo sed -i 's/IPV6=yes/IPV6=no/' /etc/default/ufw
      if ! grep -q "net.ipv6.conf.all.disable_ipv6 = 1" /etc/sysctl.conf; then
        echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf
      fi
      sudo sysctl -p && sudo ufw reload
      ```

### Phase 3: OpenClaw Installation

7. **Install OpenClaw**
    - Commands:
      ```bash
      npm install -g openclaw && openclaw doctor
      ```

8. **Configure Owner Access**
    - **Required Input:** Ask the user for their **Telegram ID**.
    - Action: Update the config to allowlist only that ID.
    - JSON Config Target (verify location via `openclaw doctor`):
      ```json
      { 
        "dmPolicy": "allowlist", 
        "allowFrom": ["YOUR_TELEGRAM_ID"], 
        "groupPolicy": "allowlist" 
      }
      ```

9. **Secure Credentials**
    - Goal: Restrict file permissions.
    - Commands:
      ```bash
      chmod 700 ~/.openclaw/credentials 2>/dev/null || true
      chmod 600 .env 2>/dev/null || true
      ```

10. **Final Audit**
    - Action: Run the built-in security audit.
    - Command:
      ```bash
      openclaw security audit --deep
      ```

## Verification Status
Run to confirm:
```bash
sudo ufw status verbose
ss -tulnp
tailscale status
openclaw doctor
```