Hardened OpenClaw Gateway Permission Profiles on Ubuntu 24.04

This product provides an OpenClaw 2026.11.2 gateway on Ubuntu 24.04 (x86_64) with seller-written software that sets up and monitors its permissions and audit trail. The delivered configuration combines the unmodified OpenClaw gateway, Node.js 24.22.2 and Hanwei Claw Guard 1.0.0. It configures a gateway that listens on the loopback interface only and is protected by a token. The additional charges cover seller-performed integration, configuration and testing on the bounded baseline described below. Any support or maintenance offered by the seller is a supplementary service and is not the sole basis for the software charges.

What the additional charges cover:

• Integration of OpenClaw with a first-boot initializer that generates a unique gateway token and a fresh state directory for each instance, so no token or audit key is shared between instances launched from the AMI.
• Two permission profiles. In the default restricted profile the agent is offered only messaging and meta tools. In the workspace profile it is also offered file read, write and edit tools limited to its workspace, and a command tool configured to ask for approval every time. The approval flow itself was not exercised in testing. A switch command applies the profile, re-checks the OpenClaw policy and rolls back if the check fails.
• A root-owned OpenClaw policy file, pinned by hash, that the unprivileged gateway user cannot modify.
• An audit exporter that copies the OpenClaw activity ledger into append-only, hash-chained files and provides a verify command. OpenClaw keeps its ledger for 30 days; the exporter keeps exported files for 400 days by default.
• A verifier that runs 22 checks and writes a JSON report. It runs hourly and reports drift; it does not revert changes automatically.
• Testing of the above on the stated baseline.

Technical implementation:

• The gateway runs as an unprivileged system user under a systemd unit with NoNewPrivileges, ProtectSystem=full, PrivateTmp and restricted address families.
• The gateway token is stored in a root-owned environment file and referenced from the OpenClaw configuration as an environment secret reference.
• sshd is configured for public-key login only; kernel and network settings are applied through sysctl.
• OpenClaw upstream update checks and anonymous telemetry are turned off.

Included components:

• Ubuntu 24.04.5 LTS (x86_64)
• OpenClaw 2026.11.2 (MIT licence), unmodified
• Node.js 24.22.2
• Hanwei Claw Guard 1.0.0 (seller software)

Tested deployment baseline:

• Instance type and hardware: t3.medium, 2 vCPU, 4 GiB memory, 30 GiB gp3 root volume.
• Operating system and architecture: Ubuntu 24.04.5 LTS, x86_64.
• Functional checks: first boot on two separate instances, reboot persistence, permission profile switching, policy tamper protection, audit export with edit and truncation detection, gateway token authentication and rotation, SSH-tunnel access to the Control UI, and an end-to-end agent turn using a local stub language model.
• Scope boundary: other instance types, real language-model providers, chat channels, performance, scale, high availability, backups and OpenClaw upgrades were not tested.

Security and operational boundaries:

• Only TCP 22 needs to be open. Do not open port 18789; the gateway is bound to 127.0.0.1.
• You supply the language model provider and its credentials. Prompts and agent data go to the providers and chat platforms you configure.
• OpenClaw is designed as a personal assistant with one trusted operator boundary. It is not isolation between mutually untrusted users.
• Content the agent reads can influence the model. This AMI limits what tools the agent is offered; it does not prevent prompt injection.
• Audit records contain metadata only. They are tamper-evident, not tamper-proof against a user with root access.
• No backups, TLS reverse proxy or automatic OpenClaw updates are included.

Suitable use cases:

• Running a self-hosted OpenClaw assistant where the agent starts with a minimal tool set and you decide when to widen it.
• Keeping an exported, verifiable record of agent activity for longer than OpenClaw's 30-day ledger.

Pricing statement:

• Marketplace software charges cover the integrated software configuration and tested deployment baseline described above. AWS infrastructure charges and third-party model or channel charges are billed separately.

OpenClaw is a separate open-source project owned by the OpenClaw Foundation. The seller is not affiliated with, endorsed by, or sponsored by it.