OpenClaw Hardening

Secure your OpenClaw server in four layers: host, commands, secrets, awareness.

Prerequisites

• - OpenClaw installed and running
• Root/sudo access
• Linux (amd64)

Layer 1: Host Hardening (2 min)

CODEBLOCK0

Layer 2: Chainwatch — Command Safety (5 min)

Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy.

Install

CODEBLOCK1

This one-liner does everything: installs chainwatch, creates clawbot profile, sets up intercept proxy as systemd service, configures ANTHROPICBASEURL, hardens the host.

Manual install

CODEBLOCK2

Then set the env var so OpenClaw routes through the proxy:

CODEBLOCK3

For other providers, change --upstream:

• - OpenAI: --upstream https://api.openai.com + set INLINECODE1
• Custom: INLINECODE2

Usage

Route risky commands through chainwatch:

CODEBLOCK4

Safe read-only commands (ls, cat, grep, git status) don't need the wrapper.

What gets blocked

Key lesson

INLINECODE19 mode is too aggressive for agents — it blocks mkdir, cp, touch. Use advisory mode with the denylist. The denylist catches catastrophic commands, advisory logs everything else.

Layer 3: Pastewatch — Secret Redaction (3 min)

Pastewatch prevents secrets (API keys, DB credentials, SSH keys, emails, IPs) from reaching the LLM API. The agent works with placeholders, secrets stay local.

Install

CODEBLOCK5

MCP server setup

CODEBLOCK6

MCP tools

How it works

CODEBLOCK7

What it detects

29 types: AWS keys, Anthropic keys, OpenAI keys, DB connections, SSH keys, JWTs, emails, IPs, credit cards, Slack/Discord webhooks, Azure connections, GCP service accounts, npm/PyPI/RubyGems tokens, Telegram bot tokens, and more.

Deterministic regex. No ML. No API calls. Microseconds per scan.

Audit log

CODEBLOCK8

Logs timestamps, tool calls, file paths, redaction counts. Never logs secret values.

Layer 4: News Intelligence (10 min)

Stay informed without doomscrolling. noisepan scores RSS feeds by relevance, entropia verifies source quality.

Install

CODEBLOCK9

Configure feeds

Edit ~/.noisepan/config.yaml — add RSS feeds relevant to your work. Example categories:

• - Security: r/netsec, Krebs, BleepingComputer, CISA advisories, NVD
• DevOps: r/devops, r/kubernetes, Cloudflare blog, AWS status
• AI/LLM: r/LocalLLaMA, r/ClaudeAI, Simon Willison, arXiv cs.AI
• World: BBC, r/worldnews, r/geopolitics, EFF
• HN: Built-in via INLINECODE29

Reddit rate limiting

With 15+ Reddit feeds, parallel fetching triggers 429s. Create a wrapper:

CODEBLOCK10

Daily digest cron

Set up two cron jobs in OpenClaw:

• - Morning (07:00): noisepan pull → noisepan digest --format json → entropia scan top items → send table
• Afternoon (18:00): Same with INLINECODE32

Format:

CODEBLOCK11

Key lessons

• - noisepan doctor catches stale feeds and all-ignored channels
• INLINECODE34 shows signal-to-noise per channel — prune after 30 days
• INLINECODE35 recomputes scores after taste profile changes
• entropia Support Index < 40 = don't trust it
• HN RSS is too shallow — use native sources.hn or hn-top script for blind spot detection
• Add policy/sovereignty/antitrust/AI safety keywords to taste profile or real stories get buried under security noise

Layer 5: eBPF Enforce — Kernel-Level Containment (3 min)

Chainwatch enforce applies seccomp-bpf filters to OpenClaw's process tree. Blocked syscalls (privilege escalation, kernel manipulation) return EPERM at kernel level — no userspace bypass possible.

Setup

Create the openclaw profile:

CODEBLOCK12

Verify profile

CODEBLOCK13

Launch OpenClaw under enforce

CODEBLOCK14

Systemd service

CODEBLOCK15

CODEBLOCK16

eBPF observe (audit companion)

CODEBLOCK17

Observe logs every syscall (execve, openat, connect, etc.) to journald without blocking.

What gets blocked at kernel level

Key lesson

INLINECODE39 breaks under enforce (it needs setresuid). Use direct root commands or run the service as root. This is a feature, not a bug — if the agent can't sudo, neither can an attacker who compromises it.

Recovery

CODEBLOCK18

Architecture

CODEBLOCK19

What this protects

What this does NOT protect

• - Prompt content, business logic, and ideas still reach the LLM provider
• Provider policy changes are out of your control
• For full privacy: run a local model (Ollama) for sensitive workloads

Verify

CODEBLOCK20

This tool follows the Agent-Native CLI Convention. Validate with: INLINECODE40

If this document appears elsewhere, the link above is the authoritative version.