Security & Server Hardening

This guide shows how to harden the server running your OpenClaw instance with SSH keys, disabled password logins, the UFW firewall and Fail2Ban. All steps work on Ubuntu 24.04 and Debian 13.

Important: Keep your current SSH session open in a separate window until you have verified that the new login works. If you get locked out, use the Rescue Mode in your PowerPanel to mount your drive and reset the sshd_config.

Step 1

Deploy SSH Keys

SSH Keys are cryptographic pairs. The private key stays on your PC, while the public key is uploaded to the server to identify you. Run this on your local computer:

Your Local Computer

ssh-keygen -t ed25519 -C "admin-access"

Next, transfer the public key to your server. (Note: On Debian, if ssh-copy-id is missing, install it via apt install openssh-client):

Your Local Computer

ssh-copy-id root@your-server-ip

Verification Test

Before moving to Step 2, ensure you can log in without being prompted for a password:

New Local Terminal Window

ssh root@your-server-ip

Step 2

Disable Password Logins

Now that your key works, we disable password logins to block brute-force attacks. Open the SSH configuration:

Server Terminal

nano /etc/ssh/sshd_config

Find these lines and edit them to match exactly (ensure no # is at the start):

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

Also check the files in /etc/ssh/sshd_config.d/ (e.g. 50-cloud-init.conf on Ubuntu): a line PasswordAuthentication yes there overrides your setting and must be changed to no.

Save: CTRL+O → Enter. Exit: CTRL+X.

Restart SSH to apply:

Server Terminal

systemctl restart ssh

Step 3

Firewall Configuration (UFW)

We use UFW (Uncomplicated Firewall). On Debian, it might not be pre-installed. Run the following commands to install and configure it:

Server Terminal

apt update && apt install ufw -y ufw allow ssh ufw enable

Important: Typing ufw enable will ask for confirmation. Type y and press Enter. This will not disconnect your current SSH session as we allowed SSH in the previous line. Do not open port 18789: the OpenClaw Gateway listens on 127.0.0.1 only and is accessed via the SSH tunnel.

Step 4

Install Fail2Ban

Fail2Ban provides an extra layer of defense by banning IPs that show suspicious login patterns:

Server Terminal

apt install fail2ban -y

Check if service is active:

Server Terminal

systemctl status fail2ban

Security Hardening Complete

Your server now only accepts SSH key logins and is protected by a firewall and Fail2Ban. The official OpenClaw documentation also recommends running OpenClaw under a dedicated non-root user and checking the configuration regularly with openclaw security audit. Head back to the main guide to continue with OpenClaw.

To Installation Guide