Bastionhost:Best practices for secure O&M of OpenClaw

Create an O&M script

Based on your requirements, choose one of the following methods to create an O&M script. The script content is the same for both methods, but the creation entry point and approval workflow are different.

Installation script content

#!/bin/bash

set -euo pipefail

echo "Starting Node.js (v24.x) installation..."

# 1. Install Node.js 24.x
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash - && \
sudo apt install -y nodejs

echo "Node.js installation completed."

echo "Running OpenClaw installation script..."

# 2. Run the OpenClaw installation script (skips interactive prompts and post-install)
(
  set +e
  export CI=1
  export OPENCLAW_SKIP_POST_INSTALL=1
  curl -fsSL https://openclaw.ai/install.sh | bash
  exit 0
)

echo "OpenClaw installation script finished."

# 3. Configure OpenClaw and install the systemd service (as the root user)
echo "Configuring OpenClaw and installing systemd service..."

# Set the configuration
openclaw config set gateway.mode local
if ! openclaw config get gateway.auth.token >/dev/null 2>&1; then
    openclaw config set gateway.auth.token "$(openssl rand -hex 20)"
fi

# Create the systemd user service file (for the root user)
mkdir -p /root/.config/systemd/user
cat > /root/.config/systemd/user/openclaw-gateway.service <<'EOF'
[Unit]
Description=OpenClaw Gateway
After=network.target

[Service]
Environment=HOME=/root
ExecStart=/usr/bin/openclaw gateway --port 18789
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=default.target
EOF

# Enable linger to allow the root user's service to run without an active login session
sudo loginctl enable-linger root 2>/dev/null || true

# Reload the user-level systemd configuration and start the service
systemctl --user daemon-reload
systemctl --user restart openclaw-gateway

# Explicitly restart and check if the port is listening
echo "Restarting OpenClaw service to apply configuration..."
systemctl --user restart openclaw-gateway

echo "Checking if port 18789 is being listened on..."

# Wait for up to 10 seconds for the service to start
for i in {1..10}; do
    if ss -tuln | grep -q ':18789\s'; then
        echo "Successfully listening on port 18789!"
        break
    fi
    sleep 1
done

# Final verification
if ! ss -tuln | grep -q ':18789\s'; then
    echo "Error: OpenClaw is not listening on port 18789!"
    echo "Please check the logs:"
    journalctl --user -u openclaw-gateway -n 50 --no-pager
    exit 1
fi

# Post-installation status check
echo "Checking OpenClaw installation status..."

# 1. Check if the command exists and get the version
if command -v openclaw &> /dev/null; then
    echo "openclaw command found."
    echo "Version info:"
    openclaw --version
else
    echo "openclaw command not found, please verify the installation."
    exit 1
fi

echo ""

# 2. Display the executable file path
echo "Installation path:"
which openclaw

echo ""

# 3. Get and display the token
TOKEN=$(openclaw config get gateway.auth.token 2>/dev/null || echo "<unable to read>")
echo "Access Token: $TOKEN"

echo ""

# 4. Check the service status
if systemctl --user is-active --quiet openclaw-gateway; then
    echo "openclaw-gateway service is running."
elif systemctl --user is-enabled --quiet openclaw-gateway 2>/dev/null; then
    echo "openclaw-gateway service is enabled but not running."
else
    echo "openclaw-gateway service is not enabled or does not exist."
fi

echo ""
echo "Detailed service status:"
systemctl --user status openclaw-gateway --no-pager

echo ""
echo "Listening page (SSH tunnel required): http://localhost:18789/__openclaw__/canvas/"
echo ""
echo "OpenClaw installation, configuration, and verification completed!"

Create an O&M task

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

2. Choose O&M Tasks and click Create O&M Task.

3. Configure the following parameters:

   • Task Information: Enter a name for the task. Set Execution Mode to Manual. Set Script Content to Specific O&M Script, and then select the public script or private script that you created.

   • Associate Host Account: Select the host accounts on which you want to run the task.

4. Click Create O&M Task. After the task is created, its status is displayed as Pending Approval in the O&M task list.

Approve the O&M task

O&M tasks that use public scripts must be approved by an administrator before they can run. Tasks that use private scripts do not require approval and can be run immediately. For more information about how to approve tasks, see Review O&M tasks.

1. Log on to the Bastionhost console as an administrator and select the region where your Bastionhost instance is deployed.

2. Find the target instance and click Manage.

3. In the left-side navigation pane, choose Approval > To-do List.

4. Click the Task Review tab, find the task that you want to approve, and click Allow.

Run the O&M task

1. In the O&M portal, click O&M Tasks.

2. Find the target task and click Start. The task status changes to Running.

3. After the status changes to Completed, click Actions > View Execution Results. Find the target execution record and click View in the Output column to check the execution log for each host.

   Note

   Installation time varies based on network conditions. For example, it may take about 30 minutes in the Chinese mainland.

Get OpenClaw UI access

1. In the O&M portal, click Hosts.

2. Find the target host and click the username under Remote Connection to open the host terminal.

3. Run the following command to obtain the token and other information required to log on to the OpenClaw UI:

   openclaw dashboard

   The command returns the following output:

   Dashboard URL: http://127.0.0.1:18789/#token=3703e******e8a75

4. To access the OpenClaw UI:

   1. Go to the ECS Instances page, select the region where the target ECS instance is located, and click the instance name to go to the details page.

   2. On the Security Groups tab, find the target security group in the Security Groups and click its Security Group ID. On the Security Group Details page, click the Inbound tab and add a rule with the following settings:

      • Action: Allow

      • Protocol: Custom TCP

      • Source: 0.0.0.0/0

      • Destination: 18789

   3. Open a terminal on your local computer and run the following command to create an SSH tunnel: ssh -N -L 18789:127.0.0.1:18789 root@<ECS_public_IP_address>.

      To find the public IP address, go to the ECS Instances page, find the target ECS instance, and view the IP Address column.

   4. In your browser, navigate to the Dashboard URL that you obtained earlier. Replace 127.0.0.1 with the public IP address of the ECS instance to access the OpenClaw UI.

      Warning

      You must temporarily open port 18789 for inbound traffic in the security group of the ECS instance. After completing the OpenClaw setup, immediately remove this rule to reduce security risks.

Create a private script

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

   Note

   To obtain the public URL of the O&M portal: Log on to the Bastionhost instance list page as an administrator, select the target region, find your instance, and click Manage. On the Overview page, you can find the URL in the instance information panel on the right.

2. Choose O&M Tasks, switch to the Script Management tab, and then click Create O&M Script.

3. Enter a name for the script, paste the following hardening script content, and then click OK.

   Note

   The script performs the following actions: runs a security audit and remediation, sets permissions for configuration files and state directories, and performs a deep security audit.

   #!/bin/bash
   
   # OpenClaw host security hardening script
   # Description:
   # 1. Runs 'openclaw security audit --fix' to remediate security issues.
   # 2. Sets permissions for configuration files and state directories.
   # 3. Performs a deep security audit.
   
   set -e # Exit immediately if a command exits with a non-zero status.
   
   # Color definitions for formatted output
   RED='\033[0;31m'
   GREEN='\033[0;32m'
   YELLOW='\033[1;33m'
   BLUE='\033[0;34m'
   NC='\033[0m' # No Color
   
   # Logging functions
   log_info() {
       echo -e "${BLUE}[INFO]${NC} $1"
   }
   
   log_success() {
       echo -e "${GREEN}[SUCCESS]${NC} $1"
   }
   
   log_warning() {
       echo -e "${YELLOW}[WARNING]${NC} $1"
   }
   
   log_error() {
       echo -e "${RED}[ERROR]${NC} $1" >&2
   }
   
   # Check if OpenClaw is installed
   check_openclaw_installed() {
       if ! command -v openclaw &> /dev/null; then
           log_error "openclaw command not found, please install OpenClaw first"
           exit 1
       fi
       log_info "OpenClaw is installed"
   }
   
   # Get the path to the OpenClaw configuration directory
   get_openclaw_config_dir() {
       if [ -n "$OPENCLAW_CONFIG_DIR" ]; then
           echo "$OPENCLAW_CONFIG_DIR"
       else
           echo "$HOME/.openclaw"
       fi
   }
   
   # Main function
   main() {
       log_info "Starting OpenClaw host security hardening..."
   
       # Check if OpenClaw is installed
       check_openclaw_installed
   
       # Get configuration directory path
       CONFIG_DIR=$(get_openclaw_config_dir)
       CONFIG_FILE="$CONFIG_DIR/openclaw.json"
   
       log_info "Config directory: $CONFIG_DIR"
       log_info "Config file: $CONFIG_FILE"
   
       # Step 1: Run security audit and remediation
       log_info "Step 1: Running 'openclaw security audit --fix' for security remediation..."
       if openclaw security audit --fix; then
           log_success "Security remediation completed"
       else
           log_warning "Warnings encountered during security remediation, continuing with next steps"
       fi
   
       # Step 2: Set permissions for configuration file and state directory
       log_info "Step 2: Setting config file and state directory permissions..."
   
       if [ ! -d "$CONFIG_DIR" ]; then
           log_warning "Config directory $CONFIG_DIR does not exist, creating..."
           mkdir -p "$CONFIG_DIR"
       fi
   
       chmod 700 "$CONFIG_DIR"
       log_success "Directory permissions set: chmod 700 $CONFIG_DIR"
   
       if [ -f "$CONFIG_FILE" ]; then
           chmod 600 "$CONFIG_FILE"
           log_success "Config file permissions set: chmod 600 $CONFIG_FILE"
       else
           log_warning "Config file $CONFIG_FILE does not exist, skipping permission setup"
       fi
   
       # Step 3: Run a deep security audit (critical step)
       log_info "Step 3: Running 'openclaw security audit --deep' for deep security audit..."
   
       # Capture deep audit output, retaining it even if the command fails
       DEEP_AUDIT_OUTPUT=""
       if ! DEEP_AUDIT_OUTPUT=$(openclaw security audit --deep 2>&1); then
           DEEP_AUDIT_EXIT_CODE=$?
           log_warning "Deep security audit command failed (exit code: $DEEP_AUDIT_EXIT_CODE), but output has been captured"
       else
           log_success "Deep security audit completed successfully"
       fi
   
       # === End of script: Highlight deep audit results ===
       echo ""
       echo -e "${YELLOW}========================================${NC}"
       echo -e "${YELLOW}   OpenClaw Deep Security Audit Results   ${NC}"
       echo -e "${YELLOW}========================================${NC}"
       if [ -n "$DEEP_AUDIT_OUTPUT" ]; then
           echo "$DEEP_AUDIT_OUTPUT"
       else
           echo -e "${RED}(No output)${NC}"
       fi
       echo -e "${YELLOW}========================================${NC}"
       echo ""
   
       log_success "OpenClaw host security hardening completed! Please review the deep audit results above."
   }
   
   # Script entry point
   if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
       main "$@"
   fi

Create an O&M task

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

   Note

   To obtain the public URL of the O&M portal: Log on to the Bastionhost instance list page as an administrator, select the target region, find your instance, and click Manage. On the Overview page, you can find the URL in the instance information panel on the right.

2. Choose O&M Tasks and click Create O&M Task.

3. Configure the following parameters:

   • Task Information: Enter a name for the task. Set Execution Mode to Manual. Set Script Content to Specific O&M Script, and then select the private script that you created.

   • Associate Host Account: Select the host accounts on which you want to run the task.

4. Click Create O&M Task.

   Note

   O&M tasks created with private scripts do not require administrator approval and can be run immediately.

Run the O&M task

1. In the O&M portal, click O&M Tasks.

2. Find the target task and click Start. The task status changes to Running.

3. After the status changes to Completed, click Actions > View Execution Results. Find the target execution record and click View in the Output column to check the hardening log for each host.

Create a private script

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

   Note

   To obtain the public URL of the O&M portal: Log on to the Bastionhost instance list page as an administrator, select the target region, find your instance, and click Manage. On the Overview page, you can find the URL in the instance information panel on the right.

2. Choose O&M Tasks, switch to the Script Management tab, and then click Create O&M Script.

3. Enter a name for the script, paste the following uninstallation script content, and then click OK.

   Note

   The script performs the following actions: stops and removes the systemd service, cleans up global npm packages and CLI files, deletes configuration and cache directories, cleans up shell configurations, and automatically verifies the uninstallation.

   #!/bin/bash
   # This script completely uninstalls OpenClaw and immediately verifies the cleanup.
   
   set -e
   
   echo "Starting to uninstall OpenClaw..."
   
   # 1. Stop and clean up the systemd user service (order is critical)
   echo "Stopping and removing Gateway service..."
   systemctl --user stop openclaw-gateway 2>/dev/null || true
   systemctl --user disable openclaw-gateway 2>/dev/null || true
   rm -f ~/.config/systemd/user/openclaw-gateway.service
   
   # Reload the systemd user instance (must be done after deleting the file)
   systemctl --user daemon-reload 2>/dev/null || true
   
   # Force-reset the systemd user state to resolve cached remnants
   if command -v systemctl >/dev/null 2>&1; then
       sleep 1
       systemctl --user reset-failed 2>/dev/null || true
   fi
   
   # 2. Get the npm global node_modules path
   NPM_GLOBAL_DIR=""
   if command -v npm >/dev/null 2>&1; then
       NPM_GLOBAL_DIR=$(npm root -g 2>/dev/null || echo "")
   fi
   [ -z "$NPM_GLOBAL_DIR" ] && NPM_GLOBAL_DIR="/usr/lib/node_modules"
   
   # 3. Force-remove the npm global package
   echo "Force cleaning npm global packages..."
   if [ -d "$NPM_GLOBAL_DIR/openclaw-cli" ]; then
       rm -rf "$NPM_GLOBAL_DIR/openclaw-cli"
       echo "  Removed $NPM_GLOBAL_DIR/openclaw-cli"
   fi
   if [ -d "$NPM_GLOBAL_DIR/openclaw" ]; then
       rm -rf "$NPM_GLOBAL_DIR/openclaw"
       echo "  Removed $NPM_GLOBAL_DIR/openclaw (legacy name)"
   fi
   
   # 4. Delete the CLI executable
   echo "Cleaning CLI executables..."
   rm -f /usr/local/bin/openclaw /usr/bin/openclaw /bin/openclaw
   
   # 5. Delete configuration, cache, and compilation cache directories
   echo "Cleaning config and cache..."
   rm -rf ~/.openclaw ~/.cache/openclaw /var/tmp/openclaw-compile-cache
   
   # 6. Clean up linger settings
   if command -v loginctl >/dev/null 2>&1; then
       if loginctl show-user "$USER" 2>/dev/null | grep -q "Linger=yes"; then
           echo "Disabling lingering..."
           loginctl disable-linger "$USER" 2>/dev/null || true
       fi
   fi
   
   # 7. Clean up shell configuration files
   echo "Cleaning shell configuration..."
   for rc in ~/.bashrc ~/.zshrc ~/.profile /etc/profile; do
       if [ -f "$rc" ]; then
           cp "$rc" "$rc.bak-openclaw" 2>/dev/null || true
           sed -i.bak -E '/(openclaw|NODE_COMPILE_CACHE|OPENCLAW_NO_RESPAWN)/d' "$rc" 2>/dev/null || true
       fi
   done
   
   echo ""
   echo "OpenClaw uninstall complete, verifying cleanup..."
   
   # Automatic verification of the cleanup
   CLEAN=true
   
   # 1. Check if the CLI command still exists
   if command -v openclaw &> /dev/null; then
       echo "[LEFTOVER] 'openclaw' command still exists"
       CLEAN=false
   else
       echo "CLI command removed"
   fi
   
   # 2. Check for the npm global package
   if command -v npm >/dev/null 2>&1; then
       if npm list -g --depth=0 2>/dev/null | grep -q "openclaw"; then
           echo "[LEFTOVER] openclaw package still exists in npm"
           CLEAN=false
       else
           echo "npm package uninstalled"
       fi
   else
       echo "npm not available, skipping npm package check"
   fi
   
   # 3. Check for the configuration directory
   if [ -d "$HOME/.openclaw" ]; then
       echo "[LEFTOVER] Config directory ~/.openclaw still exists"
       CLEAN=false
   else
       echo "Config directory cleaned"
   fi
   
   # 4. Check for the cache directory
   if [ -d "$HOME/.cache/openclaw" ]; then
       echo "[LEFTOVER] Cache directory ~/.cache/openclaw still exists"
       CLEAN=false
   else
       echo "Cache directory cleaned"
   fi
   
   # 5. Check for the systemd user service
   if systemctl --user list-units --full 2>/dev/null | grep -q "openclaw"; then
       echo "[LEFTOVER] systemd user service still exists"
       CLEAN=false
   else
       echo "systemd user service cleaned"
   fi
   
   # 6. Check for running processes
   if pgrep -f "openclaw" > /dev/null 2>&1; then
       echo "[LEFTOVER] OpenClaw process still running"
       CLEAN=false
   else
       echo "No OpenClaw process running"
   fi
   
   # Final result
   echo ""
   if [ "$CLEAN" = true ]; then
       echo "Verification passed! OpenClaw has been completely removed."
       exit 0
   else
       echo "Warning: leftovers detected, please clean up manually."
       exit 1
   fi

Create an O&M task

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

   Note

   To obtain the public URL of the O&M portal: Log on to the Bastionhost instance list page as an administrator, select the target region, find your instance, and click Manage. On the Overview page, you can find the URL in the instance information panel on the right.

2. Choose O&M Tasks and click Create O&M Task.

3. Configure the following parameters:

   • Task Information: Enter a name for the task. Set Execution Mode to Manual. Set Script Content to Specific O&M Script, and then select the private script that you created.

   • Associate Host Account: Select the host accounts on which you want to run the task.

4. Click Create O&M Task.

   Note

   O&M tasks created with private scripts do not require administrator approval and can be run immediately.

Run the O&M task

1. In the O&M portal, click O&M Tasks.

2. Find the target task and click Start. The task status changes to Running.

3. After the status changes to Completed, click Actions > View Execution Results. Find the target execution record and click View in the Output column to check the uninstallation log for each host.