Field contract · OpenClaw on Ubuntu 24.04

A hardened gateway is not done until every boundary has evidence.

Use this acceptance contract on a fresh throwaway VPS before the machine receives production credentials or traffic. It separates automated local checks from the cloud, reboot, OpenClaw-audit, and handoff gates that still require an operator.

Read-only local checker No outbound requests No host or IP output Not a security certification

Free skill · version 1.0.0 · MIT-0 · brand-owned proof asset

Install the complete auditor or inspect the checker by itself.

The 13 KB package includes the installable SKILL.md, the read-only Bash checker, both integrity contracts, agent metadata, and an open license. It requires no account, email, upload, API key, or payment. The checker prints classifications—not identities, endpoints, configuration values, or secrets—and fails closed when Linux network isolation is unavailable.

Download the free skill Checker only

Package SHA-256 · Machine-readable package metadata · Checker SHA-256 · This is newly built synthetic acceptance evidence, not a claim about prior customer work.

Verify, unpack, and install the skill locally

curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-auditor-v1.0.0.zip
curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-auditor-v1.0.0.zip.sha256
sha256sum -c openclaw-vps-readiness-auditor-v1.0.0.zip.sha256
unzip -l openclaw-vps-readiness-auditor-v1.0.0.zip
unzip openclaw-vps-readiness-auditor-v1.0.0.zip
openclaw skills install ./openclaw-vps-readiness-auditor

Inspect SKILL.md and the checker before installation. The skill changes no host state; it keeps automated evidence separate from manual provider-firewall, deep-audit, reboot, and handoff gates.

Run only the reviewed checker on the trial host

curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-check.sh
curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-check.sh.sha256
sha256sum -c openclaw-vps-readiness-check.sh.sha256
less openclaw-vps-readiness-check.sh

sudo bash openclaw-vps-readiness-check.sh \
  --runtime-user openclaw \
  --openclaw-bin /home/openclaw/.local/bin/openclaw \
  --env-file /home/openclaw/.config/openclaw/gateway.env

Substitute the actual dedicated account and user-local paths. Root is required only so the script can read effective host and service state; the script contains no package installer, firewall mutation, service mutation, remote probe, credential prompt, or eval. It requires Ubuntu's unshare utility to isolate OpenClaw CLI reads from the network. Do not run code fetched from the internet with sudo until you have inspected it.

Gate 1: isolate the runtime before testing the agent

Dedicated identity

OpenClaw runs as a non-root account outside sudo, admin, and wheel. Its explicit binary resolves inside that account's home.

Private state

The state directory and configuration are regular, runtime-owned paths with no group or world access.

One trust boundary

One trusted operator boundary owns the gateway. Mixed or adversarial users require separate gateways and preferably separate users or hosts.

Gate 2: make SSH the only external TCP listener

Effective SSH policy enables public-key authentication, disables password and keyboard-interactive authentication, disables root login, and uses TCP 22.
UFW is active, defaults to deny incoming, and has no additional inbound allow rule beyond SSH.
fail2ban and its sshd jail are active.
No non-loopback TCP listener exists except port 22.
The VPS-provider firewall separately exposes only the agreed SSH source range. The local checker cannot prove provider-console state.

Listener evidence does not replace a firewall, and a local firewall does not prove the provider firewall. Record both. Verify UDP and private-network exposure separately rather than pretending one TCP snapshot covers them.

Gate 3: keep the OpenClaw gateway local and authenticated

The automated report requires a valid OpenClaw configuration, gateway.bind: "loopback", and shared-secret authentication. The public internet should never reach the gateway port directly. Administrative access can use an SSH tunnel to the loopback listener.

# Run as the dedicated OpenClaw account after the host checker.
openclaw doctor
openclaw security audit
openclaw security audit --deep
openclaw health

Resolve every critical audit finding. Document each intentionally accepted warning by its checkId. The downloadable checker deliberately does not execute these commands: the deep audit probes the live local gateway and deserves an explicit operator action.

Gate 4: prove restart behavior without putting secrets in systemd

Exactly one intended OpenClaw systemd unit is active and enabled.
A user unit has lingering enabled; a system unit explicitly names the dedicated runtime account.
The effective restart policy is Restart=always.
The unit references the supplied environment file, which is runtime-owned and mode 0600.
No token-, password-, secret-, credential-, private-key-, or API-key-shaped value appears inline in Environment= or ExecStart=.
After a controlled reboot, the gateway, fail2ban, CrowdSec, its firewall bouncer, and Netdata return healthy without an interactive shell.

Review shell history locally and record only “clear” or “not clear.” Never paste history or an environment file into a ticket, recording, chat, or acceptance report.

Gate 5: monitoring must not create a new public control surface

The strict contract expects CrowdSec plus an active firewall bouncer and an active Netdata service. Netdata's default TCP port, when used, must be loopback-only. An alternative can pass only when the buyer accepts the replacement in writing and the runbook explains detection, alert delivery, retention, and recovery.

Detection

Record what constitutes an SSH attack, gateway outage, resource-pressure event, and repeated restart.

Delivery

Prove where alerts go without exposing a monitoring dashboard or embedding notification secrets in a unit.

Recovery

Reboot, verify supervised recovery, and preserve the evidence and rollback order in the handoff.

Final handoff: evidence someone else can repeat

Exact Ubuntu, Node, OpenClaw, and monitoring versions plus the pinned install command.
Redacted systemd, firewall, listener, audit, health, and reboot evidence.
A concise architecture and trust-boundary note.
Backup, upgrade, rollback, credential-rotation, and access-removal steps.
A narrated screen recording of the important checks with no secret values, customer data, public IP, or reusable credential visible.

“Service is running” is not acceptance. The handoff passes when a second operator can identify what is exposed, reproduce the validation, and reverse the change without guessing.

Official OpenClaw references

A production gateway is already failing?

Turn redacted evidence into one bounded recovery path.

The $1,000 Agent Rescue covers one accepted broken agent workflow or gateway path. The 12-hour clock starts only after cleared payment, accepted scope, a reproducible failure, and agreed access are all in place.

Submit a free fit review