A rapid security hardening skill to protect Linux servers running OpenClaw from unauthorized access and brute-force attacks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install server-host-hardening
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install server-host-hardening using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Host Hardening?
Host Hardening is a specialized security configuration skill designed to lock down Linux servers hosting OpenClaw instances. It implements industry-standard security practices including SSH key-only authentication, UFW firewall restrictions, and automated brute-force protection using fail2ban. This skill ensures your Openclaw Skills environment remains resilient against external threats while maintaining high availability for the gateway service.
Host Hardening Use Cases
- Setting up a new OpenClaw instance on a fresh Linux VPS to ensure immediate protection.
- Auditing existing server security to ensure best practices are met for long-term production use.
- Recovering and re-securing a server after a potential security incident or vulnerability discovery.
- Automating the deployment of security configurations across multiple nodes to maintain a consistent security posture.
How Host Hardening Works
- Modifies SSH configuration to disable password-based logins and restrict root access to keys only, preventing credential theft.
- Configures the Uncomplicated Firewall (UFW) to block all unsolicited incoming traffic except for essential SSH access.
- Installs and activates fail2ban to automatically monitor system logs and block IP addresses exhibiting malicious brute-force behavior.
- Restricts file permissions on sensitive credential files within the Openclaw Skills environment to prevent local unauthorized access.
- Creates and enables a systemd service to ensure the OpenClaw Gateway restarts automatically on system reboot for maximum uptime.
Host Hardening Setup
To apply these security measures to your server, execute the following commands as root:
# Harden SSH access
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh
# Configure UFW Firewall
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
yes | ufw enable
# Install Fail2ban
apt-get install -y fail2ban
systemctl enable --now fail2ban
Host Hardening Data Schema & Taxonomy
The skill interacts with system-level configuration files and organizes its data as follows:
| Component | Path | Description |
|---|---|---|
| SSH Config | /etc/ssh/sshd_config |
Primary configuration for the SSH daemon |
| Firewall | /etc/ufw/ |
Directory containing firewall rules and policies |
| Brute-Force | /etc/fail2ban/ |
Configuration for automated IP blocking |
| Credentials | ~/.openclaw/credentials |
Sensitive access tokens protected by 700 permissions |
| Gateway Service | /etc/systemd/system/openclaw-gateway.service |
System service definition for process management |
Host Hardening Advanced Features
- Automated systemd service creation for persistent OpenClaw Gateway operation across reboots.
- Support for custom fail2ban jail configurations via jail.local for specific application needs.
- Defense-in-depth strategy that complements cloud provider security groups at the host level.
- Verified idempotent configuration steps suitable for automation and CI/CD pipelines in Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Chainwatch Safety Enforcement
A runtime safety control plane that enforces deterministic security policies on shell commands, network requests, and file operations.
Autonomous Execution
An AI agent skill designed to execute multi-step tasks autonomously while adhering to strict safety guardrails and confirmation protocols.
How To Skill
A meta-skill designed to teach developers and agents how to create, structure, and publish their own custom agentic capabilities.
Exoskeletons - AI Agent Identity Skill
Exoskeletons provide AI agents with a persistent onchain identity, reputation system, and secure marketplace built on the Base network.
Apple Health Data Analyzer
A privacy-focused CLI utility for analyzing Apple Health exports and extracting granular health metrics locally.
backup-manager
A comprehensive CLI utility for managing, scheduling, and monitoring local and cloud-based backups using rsync, Time Machine, and rclone.
Featured*
