Server Overview
Services
SSH Hardening
TLS & Web Proxy
Channels
Fixed This Session
OpenClaw security posture
Current OpenClaw security audit reports 0 critical, 1 warning, 1 info. Host review still shows 19 upgradable packages, one failed postfix@-.service unit, and an outdated OpenClaw gateway service install that should be reinstalled.
Attack surface summary
Personal-assistant trust model, internal hooks enabled, browser control enabled, elevated tools exposed in trusted contexts.
Potential multi-user setup detected
Gateway may be reachable by more than one user context while runtime/process tools remain available without full sandboxing.
Heartbeats and recurring tasks
Heartbeat: main every 30m, myai-it disabled. Cron tasks: 1 active, including this approved 6h dashboard mission running now.
Pending Actions — Awaiting Approval
nginx.conf — TLS 1.0/1.1 Listed
Global config still lists deprecated protocols. Per-site config overrides this, so not immediately exploitable. Requires sudo to fix /etc/nginx/nginx.conf.
nginx server_tokens Not Disabled
nginx server_tokens off; still needs to be set in /etc/nginx/nginx.conf with sudo.
Firewall Status Unconfirmed
ufw, iptables, nftables not found in PATH. May be hypervisor-managed. Open ports: :2277 (SSH), :80, :443.
Self-Signed TLS Certificate
TLS certificate is still self-signed. If a public domain is available, replace it with Let's Encrypt.
Security and base-system updates pending
19 packages are upgradable, including openssl, libssl3t64, systemd, and Docker components. Schedule a maintenance window to patch.
postfix@-.service failed during boot
systemctl --failed still reports postfix@-.service failed. Not impacting nginx or OpenClaw, but mail transport setup should be reviewed.
OpenClaw gateway service install needs refresh
openclaw gateway status and openclaw doctor both report the service command is non-standard and still embeds OPENCLAW_GATEWAY_TOKEN. Reinstall the service with openclaw gateway install --force in a maintenance window.