how to secure OpenClaw for VPS use

Wetin OpenClaw be, and why you must harden am first

OpenClaw na self-hosted AI agent. You go run am for your own server, connect am to large language model, and e fit run shell commands, control browser, read and write your files, and even do wetin you tell am from chat apps. Dat power na wetin make di tool useful, but na dat power also be di risk. Agent wey fit run any command dey safe only as di box wey e dey run for and di limits wey you set for am.

Two things dey set di tone for dis guide. First, OpenClaw design am so dat you go harden am. Im security model put di responsibility for tight tool policies, sandboxing, and careful permissions for di operator, no be say e dey come with safe default. Second, di project don face serious security wahala before: for March 2026, nine security issues come out within four days, including one critical privilege-escalation flaw, CVE-2026-32922, wey get 9.9 out of 10 rating. Dis two things no mean say make you avoid OpenClaw. Dem mean say make you no run am like lazy person, and dis guide na di careful way.

Dem get good news too. OpenClaw don already make one safe choice for you: im gateway, di single process wey dey control everything, dey listen on di loopback address by default, so internet no fit reach am unless you go out your way to expose am. Most of di work below na to keep am so dat e stay dat way and to limit di damage if something go wrong.

Give OpenClaw im own unprivileged user

No ever run agent as root. If OpenClaw run as root and anything go wrong, whether na bug, bad instruction, or CVE like di one wey I mention above, di damage no get limit. Create one dedicated system user wey no get login shell and no get sudo, and run di agent as dat user:

sudo useradd --system --home /opt/openclaw --shell /usr/sbin/nologin openclaw

Everything OpenClaw own dey live under /opt/openclaw, wey dat account own. Dis na di most important step, and na di same principle wey dem talk for running services as an unprivileged user: di account wey agent dey run as na di ceiling for wetin e fit break.

Install OpenClaw

OpenClaw dey come as npm package, so install Node.js first if di server no get am. Install di package globally, wey go put di openclaw binary for PATH for every user, then run di one-time onboarding step:

sudo npm install -g openclaw@latest
sudo -u openclaw openclaw onboard

To run onboarding as di openclaw user mean say di agent configuration go land for im home directory, /opt/openclaw, no be for root directory. Di project also get one curl -fsSL https://openclaw.ai/install.sh | bash installer wey fit do di same install for one line. Skip di --install-daemon flag during onboarding: e go register OpenClaw own service, and di hardened systemd unit wey you go build below dey more strict.

Keep di gateway on loopback, behind a firewall

Di gateway dey bind to 127.0.0.1 by default. Leave am there. No be every time you go need to publish dat port to internet, and if you do am, you dey give anyone wey find am one remote way to enter one process wey dey run commands for life.

Put one default-deny firewall for front of di box so nothing go expose by accident:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

Two traps to avoid here. Firewall wey only cover IPv4 fit leave di same service open for IPv6, and dat na di IPv6 firewall gap wey dey catch many people. And if you need reach di gateway from your laptop, no open di port. Reach am through VPN or SSH tunnel, so dat agent no go dey listen to di open internet.

Isolate im secrets

OpenClaw need API key for any language model wey you wan connect am to. Dat key fit spend your money and, through di agent, act for your side, so treat am like password. Keep am out of di unit file and out of any repository. Put am in one file wey only OpenClaw user fit read:

sudo install -o openclaw -g openclaw -m 600 /dev/null /opt/openclaw/openclaw.env
sudoedit /opt/openclaw/openclaw.env      # add ANTHROPIC_API_KEY=... or your model provider's key

Di systemd unit dey load dat file with EnvironmentFile, so di key go reach di process without e ever sit for command line, log, or your shell history.

Run am as a hardened systemd service

To run di agent under systemd dey give you automatic restarts, clean logs through journalctl, and, most importantly, one set of kernel-level sandboxing options wey go reduce wetin di process fit touch even if dem hack am. Di ones wey important pass for agent na NoNewPrivileges so e no fit get new powers, ProtectSystem=strict so di filesystem dey read-only except for where you allow write, PrivateTmp for im own isolated temporary directory, and ProtectHome so e no fit read home directories.

Generate one complete, hardened unit here, then copy am to /etc/systemd/system/openclaw.service:

Di unit dey start openclaw gateway, di long-running process wey dey control di agent; if which openclaw show different path for your server, change ExecStart make e match. Full walkthrough for dese directives, and for daemon-reload and enable --now, dey for running a program as a systemd service. Short version once you don paste di unit:

sudo systemctl daemon-reload
sudo systemctl enable --now openclaw

Harden di front door too

Agent box safe only as di server wey surround am. Two more layers go finish di job. Move SSH to key-only authentication and drop root login, like as for SSH hardening on a VPS, so dat account wey you dey use manage di box no fit dey brute-forced. Then add Fail2ban to kick out di scanners wey dey hammer every public port. Neither of dem dey touch OpenClaw directly, but both dey cut di routes attacker go use reach am.

Keep am updated, on purpose

Di March 2026 disclosures na di clearest argument say make you stay current. Privilege-escalation bug for agent serious pass for ordinary web app, because agent dey run commands already. Watch di project releases, apply security updates quickly, and treat OpenClaw upgrade as routine maintenance rather than something to put for back.

To understand wetin you dey actually harden, the architecture of an OpenClaw-style agent dey explain di moving parts, and building your own AI agent on a VPS dey cover di general shape wey any agent dey take.

FAQ

E safe to run OpenClaw on a public VPS?

E fit be safe, if you harden am. OpenClaw powerful by design: e dey run shell commands and control browser, so careless setup dangerous true true, and di project don already get one critical CVE (CVE-2026-32922 for March 2026). Im security model expect you, di operator, to add di limits. Run am as unprivileged user, keep im gateway on loopback behind a default-deny firewall, isolate im API keys, and run am as a hardened systemd service.

I should expose di OpenClaw gateway to di internet?

No. Di gateway dey bind to loopback by default, and you should leave am there. Na di single process wey dey control di agent, so exposed gateway na remote path enter something wey dey run commands for life. If you need reach am remotely, use VPN or SSH tunnel instead of opening di port.

Which user OpenClaw should run as?

One dedicated system user wey no get login shell and no get sudo, no be root ever. If dem hack di agent, im user account na di ceiling for di damage, so dat account for own only im own files under one directory like /opt/openclaw and nothing else.

How I fit keep OpenClaw API keys secure?

Store dem in one file wey only OpenClaw user fit read (mode 600) and load am into di service with systemd EnvironmentFile. Keep di key out of di unit file, out of your shell history, and out of any git repository. Change am (rotate am) if you suspect say e don leak.