Security + Network Hardening
Audit first, then harden with explicit approval. Keep this file short; read the references when needed.
Core rules
- - Start read-only unless the user explicitly asks for fixes.
- Require confirmation before any state-changing action.
- Preserve current management access; do not break SSH/RDP/VNC.
- Prefer exact findings over generic advice.
- After workspace edits, commit them.
Read-only baseline
Run:
CODEBLOCK0
If firewall state matters, also run:
CODEBLOCK1
Priorities
Check for these first:
- 1. elevated wildcard access in INLINECODE0
- writable credentials directories
- missing gateway auth rate limiting
- broad or unclear listening ports
- metrics endpoints exposed too widely
- ineffective custom INLINECODE1
- workspace skill symlink escapes
Fix patterns
Read these only when relevant:
- - UFW/firewall workflow: INLINECODE2
- OpenClaw config fixes: INLINECODE3
Artifact generation
When the user wants generated files, create:
- - INLINECODE4
- INLINECODE5
- INLINECODE6
- INLINECODE7
Safe firewall order
- 1. Confirm allowed source subnet/IPs.
- Add SSH rule first if SSH is in use.
- Apply LAN-only and single-host rules.
- Verify from expected clients.
- Re-check
ufw status verbose and ss -ltnp.
Verification
After fixes, verify with:
CODEBLOCK2
Success means:
- - no critical audit findings
- no warning audit findings when practical
- gateway reachable
- required ports reachable only from approved sources
技能名称：security-network-hardening
详细描述：
安全 + 网络加固
先审计，获得明确批准后再加固。保持此文件简短；需要时查阅参考资料。
核心规则
- - 除非用户明确要求修复，否则以只读模式开始。
- 任何状态变更操作前需获得确认。
- 保留当前管理访问权限；不要中断SSH/RDP/VNC。
- 优先提供精确发现，而非泛泛建议。
- 工作区编辑完成后，提交更改。
只读基线
运行：
bash
uname -a
cat /etc/os-release
id
ss -ltnup 2>/dev/null || ss -ltnp 2>/dev/null
openclaw security audit --deep
openclaw update status
openclaw status --deep
如果防火墙状态相关，还需运行：
bash
ufw status verbose || true
firewall-cmd --state 2>/dev/null || true
nft list ruleset 2>/dev/null || true
优先级
首先检查以下项目：
- 1. tools.elevated.allowFrom.* 中的通配符提升访问权限
- 可写的凭据目录
- 缺少网关认证速率限制
- 宽泛或不明确的监听端口
- 指标端点暴露范围过广
- 无效的自定义 gateway.nodes.denyCommands
- 工作区技能符号链接逃逸
修复模式
仅在相关时阅读：
- - UFW/防火墙工作流程：references/ufw-playbook.md
- OpenClaw配置修复：references/openclaw-fix-patterns.md
产物生成
当用户需要生成文件时，创建：
- - firewall-rules.md
- apply-firewall.sh
- scripts/rollback-firewall.sh
- scripts/verify-firewall.sh
安全防火墙顺序
- 1. 确认允许的源子网/IP。
- 如果使用SSH，首先添加SSH规则。
- 应用仅限局域网和单主机规则。
- 从预期客户端进行验证。
- 重新检查 ufw status verbose 和 ss -ltnp。
验证
修复后，使用以下命令验证：
bash
openclaw security audit --deep
openclaw gateway status
python3 -m json.tool ~/.openclaw/openclaw.json >/dev/null
sudo ufw status verbose
ss -ltnp
成功标准：
- - 无严重审计发现
- 实际可行时无警告审计发现
- 网关可达
- 所需端口仅从授权来源可达
