alvis
bedb527145
Some checks failed
ClawSweeper Dispatch / dispatch (push) Has been cancelled
CodeQL / Security High (actions) (push) Has been cancelled
CodeQL / Security High (channel-runtime-boundary) (push) Has been cancelled
CodeQL / Security High (core-auth-secrets) (push) Has been cancelled
CodeQL / Security High (mcp-process-tool-boundary) (push) Has been cancelled
CodeQL / Security High (network-ssrf-boundary) (push) Has been cancelled
CodeQL / Security High (plugin-trust-boundary) (push) Has been cancelled
CodeQL / Security High (process-exec-boundary) (push) Has been cancelled
Docs Sync Publish Repo / sync-publish-repo (push) Has been cancelled
Docs / docs (push) Has been cancelled
OpenClaw Stable Main Closeout / Resolve stable release closeout inputs (push) Has been cancelled
OpenClaw Stable Main Closeout / Verify stable main closeout (push) Has been cancelled
Workflow Sanity / no-tabs (push) Has been cancelled
Workflow Sanity / actionlint (push) Has been cancelled
Workflow Sanity / generated-doc-baselines (push) Has been cancelled
CI / runner-admission (push) Has been cancelled
CI / preflight (push) Has been cancelled
CI / security-fast (push) Has been cancelled
CI / pnpm-store-warmup (push) Has been cancelled
CI / build-artifacts (push) Has been cancelled
CI / native-i18n (push) Has been cancelled
CI / ${{ matrix.check_name }} (push) Has been cancelled
CI / ${{ matrix.checkName }} (push) Has been cancelled
CI / checks-node-compat-node22 (push) Has been cancelled
CI / check-bundled-channel-config-metadata (push) Has been cancelled
CI / check-dependencies (push) Has been cancelled
CI / check-guards (push) Has been cancelled
CI / check-lint (push) Has been cancelled
CI / check-prod-types (push) Has been cancelled
CI / check-shrinkwrap (push) Has been cancelled
CI / check-test-types (push) Has been cancelled
CI / check-additional-boundaries-a (push) Has been cancelled
CI / check-additional-boundaries-bcd (push) Has been cancelled
CI / check-additional-extension-bundled (push) Has been cancelled
CI / check-additional-extension-channels (push) Has been cancelled
CI / check-additional-extension-package-boundary (push) Has been cancelled
CI / check-additional-runtime-topology-architecture (push) Has been cancelled
CI / check-session-accessor-boundary (push) Has been cancelled
CI / check-session-transcript-reader-boundary (push) Has been cancelled
CI / check-docs (push) Has been cancelled
CI / skills-python (push) Has been cancelled
CI / macos-swift (push) Has been cancelled
CI / ios-build (push) Has been cancelled
CI / ci-timings-summary (push) Has been cancelled
Native App Locale Refresh / Refresh native fa (push) Has been cancelled
Native App Locale Refresh / Refresh native fr (push) Has been cancelled
Native App Locale Refresh / Refresh native hi (push) Has been cancelled
Native App Locale Refresh / Refresh native id (push) Has been cancelled
Native App Locale Refresh / Refresh native it (push) Has been cancelled
Native App Locale Refresh / Refresh native ja-JP (push) Has been cancelled
Control UI Locale Refresh / plan (push) Has been cancelled
Control UI Locale Refresh / Refresh ${{ matrix.locale }} (push) Has been cancelled
Control UI Locale Refresh / Commit control UI locale refresh (push) Has been cancelled
Live Media Runner Image / Build live media runner image (push) Has been cancelled
Native App Locale Refresh / Refresh native ar (push) Has been cancelled
Native App Locale Refresh / Refresh native de (push) Has been cancelled
Native App Locale Refresh / Refresh native es (push) Has been cancelled
Native App Locale Refresh / Refresh native ko (push) Has been cancelled
Native App Locale Refresh / Refresh native nl (push) Has been cancelled
Native App Locale Refresh / Refresh native pl (push) Has been cancelled
Native App Locale Refresh / Refresh native pt-BR (push) Has been cancelled
Native App Locale Refresh / Refresh native ru (push) Has been cancelled
Native App Locale Refresh / Refresh native sv (push) Has been cancelled
Native App Locale Refresh / Refresh native th (push) Has been cancelled
Native App Locale Refresh / Refresh native tr (push) Has been cancelled
Native App Locale Refresh / Refresh native uk (push) Has been cancelled
Native App Locale Refresh / Refresh native vi (push) Has been cancelled
Native App Locale Refresh / Refresh native zh-CN (push) Has been cancelled
Native App Locale Refresh / Refresh native zh-TW (push) Has been cancelled
Native App Locale Refresh / Commit native locale refresh (push) Has been cancelled
Plugin Init Scaffold Validation / Validate provider scaffold (push) Has been cancelled
Plugin NPM Release / preview_plugins_npm (push) Has been cancelled
Plugin NPM Release / Validate release publish approval (push) Has been cancelled
Plugin NPM Release / preview_plugin_pack (push) Has been cancelled
Plugin NPM Release / publish_plugins_npm (push) Has been cancelled
Sandbox Common Smoke / sandbox-common-smoke (push) Has been cancelled
Website Installer Sync / static (push) Has been cancelled
Website Installer Sync / linux-docker (push) Has been cancelled
Website Installer Sync / macos-installer (push) Has been cancelled
Website Installer Sync / windows-installer (push) Has been cancelled
Website Installer Sync / sync-website (push) Has been cancelled
Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11), free to diverge. Tree copied sans upstream .git; upstream remote added for future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19. Preserves docs/ARCHITECTURE.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2
106 lines
2.5 KiB
Markdown
106 lines
2.5 KiB
Markdown
---
|
|
name: healthcheck
|
|
description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."
|
|
---
|
|
|
|
# OpenClaw host healthcheck
|
|
|
|
Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
|
|
|
|
## Rules
|
|
|
|
- Ask before state-changing actions.
|
|
- Do not change SSH/firewall/remote access until access path is confirmed.
|
|
- Prefer reversible steps and rollback notes.
|
|
- Never claim OpenClaw manages OS firewall, SSH, or updates.
|
|
- If identity/role unknown, recommend only.
|
|
- User choices: numbered list.
|
|
- Never print secrets.
|
|
|
|
## Context to infer first
|
|
|
|
- OS/version, container vs host.
|
|
- Privilege level.
|
|
- Access path: local, SSH, RDP, tailnet.
|
|
- Network exposure: public IP, reverse proxy, tunnel, LAN only.
|
|
- OpenClaw gateway status, bind, auth.
|
|
- Backup status.
|
|
- Disk encryption.
|
|
- Automatic security updates.
|
|
- Usage mode: personal workstation, local assistant box, remote server, other.
|
|
|
|
Ask only for missing facts. Simple phrasing preferred.
|
|
|
|
## Read-only checks
|
|
|
|
Ask once for permission to run read-only checks. Then run relevant commands.
|
|
|
|
Common:
|
|
|
|
```bash
|
|
openclaw security audit --deep
|
|
openclaw gateway status --deep
|
|
openclaw doctor
|
|
```
|
|
|
|
macOS:
|
|
|
|
```bash
|
|
sw_vers
|
|
lsof -nP -iTCP -sTCP:LISTEN
|
|
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
|
|
pfctl -s info
|
|
tmutil status
|
|
fdesetup status
|
|
softwareupdate --schedule
|
|
```
|
|
|
|
Linux:
|
|
|
|
```bash
|
|
cat /etc/os-release
|
|
ss -ltnup || ss -ltnp
|
|
ufw status || firewall-cmd --state || nft list ruleset
|
|
systemctl status ssh sshd
|
|
lsblk -f
|
|
```
|
|
|
|
Windows:
|
|
|
|
```powershell
|
|
systeminfo
|
|
Get-NetFirewallProfile
|
|
Get-BitLockerVolume
|
|
```
|
|
|
|
## Risk profile
|
|
|
|
After context is known, ask desired posture:
|
|
|
|
1. Convenience: local/private, minimal prompts.
|
|
2. Balanced: secure defaults, low friction.
|
|
3. Strict: remote/public/sensitive data, more lock-down.
|
|
|
|
## Report shape
|
|
|
|
- Current posture: one paragraph.
|
|
- Findings: severity + evidence + why it matters.
|
|
- Recommended plan: staged, reversible.
|
|
- Commands: read-only first; write actions only after approval.
|
|
- Gaps: what could not be checked.
|
|
|
|
## Hardening menu
|
|
|
|
Offer only relevant items:
|
|
|
|
- Bind gateway to loopback/LAN/tailnet intentionally.
|
|
- Require auth for remote access.
|
|
- Close public ports or restrict by firewall.
|
|
- Enable OS security updates.
|
|
- Enable disk encryption.
|
|
- Verify backups and restore path.
|
|
- Disable password SSH or require keys/MFA where appropriate.
|
|
- Add scheduled `openclaw security audit --deep`.
|
|
|
|
Confirm exact action before applying.
|