From 9e909c9bd780801024e23645cf79bbc9488f04c4 Mon Sep 17 00:00:00 2001 From: Toby <45889209+BagelHole@users.noreply.github.com> Date: Fri, 6 Mar 2026 16:53:15 -0500 Subject: [PATCH] Add OpenClaw security hardening skills --- README.md | 2 + .../openclaw-security-hardening/SKILL.md | 109 ++++++++++++++++++ .../openclaw-deployment-hardening/SKILL.md | 106 +++++++++++++++++ 3 files changed, 217 insertions(+) create mode 100644 infrastructure/local-ai/openclaw-security-hardening/SKILL.md create mode 100644 security/hardening/openclaw-deployment-hardening/SKILL.md diff --git a/README.md b/README.md index 64dfb55..98cf346 100644 --- a/README.md +++ b/README.md @@ -261,6 +261,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [container-hardening](security/hardening/container-hardening/) | Secure Docker/K8s configs | | [kubernetes-hardening](security/hardening/kubernetes-hardening/) | K8s security contexts and policies | | [cis-benchmarks](security/hardening/cis-benchmarks/) | CIS benchmark auditing | +| [openclaw-deployment-hardening](security/hardening/openclaw-deployment-hardening/) | OpenClaw CI/CD, container, and runtime hardening guardrails | ### Network Security | Skill | Description | @@ -391,6 +392,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's | [ollama-stack](infrastructure/local-ai/ollama-stack/) | Private local inference stack with Ollama | | [mac-mini-llm-lab](infrastructure/local-ai/mac-mini-llm-lab/) | Mac mini setup for always-on local LLM serving | | [openclaw-local-mac-mini](infrastructure/local-ai/openclaw-local-mac-mini/) | OpenClaw setup for local development and Mac mini hosting | +| [openclaw-security-hardening](infrastructure/local-ai/openclaw-security-hardening/) | OpenClaw host, auth, secrets, and network hardening for self-hosted deployments | | [vllm-server](infrastructure/local-ai/vllm-server/) | High-throughput LLM serving with vLLM — PagedAttention, tensor parallelism, OpenAI API | | [llm-inference-scaling](infrastructure/local-ai/llm-inference-scaling/) | Auto-scale LLM inference clusters on Kubernetes with KEDA and GPU-aware scheduling | | [rag-infrastructure](infrastructure/local-ai/rag-infrastructure/) | Production RAG with vector stores, hybrid search, embedding pipelines, and reranking | diff --git a/infrastructure/local-ai/openclaw-security-hardening/SKILL.md b/infrastructure/local-ai/openclaw-security-hardening/SKILL.md new file mode 100644 index 0000000..2c6dd7c --- /dev/null +++ b/infrastructure/local-ai/openclaw-security-hardening/SKILL.md @@ -0,0 +1,109 @@ +--- +name: openclaw-security-hardening +description: Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Use when deploying OpenClaw in home labs, startups, or production-like local AI infrastructure. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# OpenClaw Security Hardening + +Use this skill to reduce exposure in self-hosted OpenClaw deployments before opening access to teammates or external networks. + +## Build a Threat Model First + +Map the highest-risk assets and paths: + +- Admin/API endpoints for OpenClaw +- Provider API keys and model credentials +- Prompt/response logs containing sensitive business data +- Host-level access (SSH, local admin accounts, remote desktop) + +Prioritize controls that reduce credential theft, remote code execution blast radius, and data exfiltration. + +## Apply Baseline Host Hardening + +1. Keep OS and package dependencies patched on a regular cadence. +2. Run OpenClaw as a dedicated non-admin user account. +3. Enable full-disk encryption and secure boot features where available. +4. Remove unnecessary services and block inbound ports by default. +5. Lock down remote admin (key-only SSH, no password login, limited source CIDRs). + +Example Linux baseline checks: + +```bash +id openclaw +sudo ss -tulpn +sudo ufw status verbose +sudo systemctl --failed +``` + +## Harden Application Runtime + +- Bind OpenClaw to localhost or private VLAN by default. +- Place a reverse proxy in front of OpenClaw for TLS, auth, and rate limits. +- Enforce authentication on every non-health endpoint. +- Disable debug/dev modes in persistent environments. +- Restrict outbound egress to only required providers (LLM API, telemetry sink, package mirror). + +Example reverse proxy controls to enforce: + +- TLS 1.2+ only +- strict transport security header +- request body size limits +- request timeout and upstream timeout guardrails +- per-IP and per-token rate limiting + +## Protect Secrets and Tokens + +- Store secrets in a vault or platform secret manager, not committed `.env` files. +- Rotate provider and admin tokens on a fixed interval and after any incident. +- Scope tokens minimally (least privilege, per-service keys). +- Scan repos and deployment artifacts for leaked credentials before release. + +Rotation checklist: + +1. Generate replacement key. +2. Update runtime secret store. +3. Restart or reload OpenClaw. +4. Validate request success with new key. +5. Revoke old key. + +## Segment Network Access + +Use layered access patterns: + +- **Tier 1 (private):** OpenClaw service port reachable only from app/proxy subnet. +- **Tier 2 (operator):** Admin plane reachable only from VPN/Tailscale/WireGuard. +- **Tier 3 (public):** Expose only hardened reverse proxy with strict ACLs. + +Do not publish raw OpenClaw service ports directly to the internet. + +## Add Detection and Recovery Paths + +- Centralize auth, error, and audit logs. +- Alert on brute-force attempts, token failures, and unusual outbound traffic. +- Capture immutable backup snapshots of configs and prompt data retention settings. +- Test rollback and restore procedures every release cycle. + +Minimum operational runbook: + +- service restart path +- key revocation path +- incident isolation path (network block + token disable) +- known-good rollback version + +## Validation Checklist + +- All sensitive endpoints require auth and are unreachable without VPN or gateway policy. +- Secrets are absent from repo history and plaintext shared directories. +- Host firewall default deny is active for inbound traffic. +- TLS termination and rate limits are active at ingress. +- Rollback drill can restore service within target RTO. + +## Related Skills + +- [openclaw-local-mac-mini](../openclaw-local-mac-mini/) - Local OpenClaw hosting setup +- [multi-tenant-llm-hosting](../multi-tenant-llm-hosting/) - Multi-tenant AI isolation patterns +- [zero-trust](../../networking/zero-trust/) - Private access and identity-aware network controls diff --git a/security/hardening/openclaw-deployment-hardening/SKILL.md b/security/hardening/openclaw-deployment-hardening/SKILL.md new file mode 100644 index 0000000..14a8a7d --- /dev/null +++ b/security/hardening/openclaw-deployment-hardening/SKILL.md @@ -0,0 +1,106 @@ +--- +name: openclaw-deployment-hardening +description: Secure OpenClaw deployments with preflight hardening checks, CI/CD guardrails, container runtime restrictions, and post-deploy verification. Use when shipping OpenClaw with Docker, Kubernetes, or automated release pipelines. +license: MIT +metadata: + author: devops-skills + version: "1.0" +--- + +# OpenClaw Deployment Hardening + +Use this skill to add repeatable security gates around OpenClaw build and deployment workflows. + +## Enforce a Secure Build Pipeline + +Add mandatory controls to CI before artifacts are promoted: + +1. Dependency and lockfile vulnerability scan (fail on critical CVEs). +2. Image scan for OS/package vulnerabilities. +3. Secret scanning across source and build context. +4. SBOM generation and artifact signing. +5. Policy check that blocks deploy when controls fail. + +Example CI step order: + +```bash +# Build +npm ci +npm run build + +# Security gates +trivy fs . +trivy image my-registry/openclaw:${GIT_SHA} +syft my-registry/openclaw:${GIT_SHA} -o spdx-json > sbom.json +cosign sign --key cosign.key my-registry/openclaw:${GIT_SHA} +``` + +## Lock Down Container Runtime + +Run OpenClaw with restrictive defaults: + +- Non-root user in container +- Read-only root filesystem where possible +- Drop all Linux capabilities, add back only required +- `no-new-privileges` enabled +- Constrained CPU/memory limits to reduce abuse impact +- Seccomp/AppArmor (or equivalent) profile enforced + +Kubernetes-oriented expectations: + +- `runAsNonRoot: true` +- `allowPrivilegeEscalation: false` +- `readOnlyRootFilesystem: true` +- network policy deny-all baseline with explicit allow rules + +## Gate Production Promotion + +Require explicit promotion checks: + +- Security sign-off on CVE exceptions. +- Signed artifact verification in deployment stage. +- Drift check between expected and live manifest values. +- Deployment only from immutable tags or digests. + +Avoid mutable `latest` tags for production OpenClaw services. + +## Protect Data and Session Surfaces + +- Minimize prompt/response retention by policy. +- Mask secrets and PII in logs before shipping to SIEM. +- Encrypt persistent volumes and backups. +- Isolate tenant/session data boundaries when serving multiple teams. + +## Post-Deploy Verification + +Run a hardening smoke test immediately after rollout: + +```bash +kubectl get pods -n openclaw +kubectl auth can-i --as=system:serviceaccount:openclaw:default list secrets -n openclaw +kubectl get networkpolicy -n openclaw +kubectl logs deploy/openclaw -n openclaw --tail=200 +``` + +Verify: + +- Pod security context matches policy. +- Service account permissions are least privilege. +- Ingress auth/rate limits are effective. +- No plaintext secrets appear in logs. + +## Incident-Ready Rollback Pattern + +Maintain a hardened rollback workflow: + +1. Freeze further rollouts. +2. Revoke suspect tokens and rotate secrets. +3. Roll back to last signed known-good image digest. +4. Re-run post-deploy hardening verification. +5. Capture timeline and artifacts for forensics. + +## Related Skills + +- [container-hardening](../container-hardening/) - Container security baseline controls +- [kubernetes-hardening](../kubernetes-hardening/) - Pod and cluster hardening patterns +- [sbom-supply-chain](../../scanning/sbom-supply-chain/) - SBOM, signing, and provenance controls