changes from steflsd - feat: Rename clawdbot to openclaw - #5
Open
sandy-wang wants to merge 10 commits into
Open
Conversation
…to-updates Security improvements: 1. CRITICAL: Scope sudo access for clawdbot user - Changed from 'ALL=(ALL) NOPASSWD: ALL' to specific commands only - Now limited to: systemctl for clawdbot service, tailscale, journalctl - Prevents full root compromise if application is exploited 2. CRITICAL: Fix hardcoded UID in systemd template - Changed XDG_RUNTIME_DIR from /run/user/1000 to dynamic - Uses clawdbot_uid_value variable with fallback 3. Add fail2ban for SSH brute-force protection - 5 failed attempts = 1 hour ban - Protects against automated attacks on exposed SSH 4. Add unattended-upgrades for automatic security updates - Security-only updates enabled by default - Automatic reboots disabled (manual control) 5. Update documentation - security.md: Document all 8 security layers - README.md: Add security features to list - AGENTS.md: Document security rationale and known limitations Known limitations documented: - macOS support incomplete (no launchd/pf) - IPv6 disabled in Docker - curl|bash pattern inherent risks Signed-off-by: Andrew Lauppe <andy@t5tele.com>
Add Homebrew to path (linux) broken due to cleared env
Simplified condition from `is_linux and not is_macos` to `is_linux` since these are mutually exclusive (is_linux checks for Debian family). Co-Authored-By: Jayakorn Karikan <jayakornk@users.noreply.github.com> Co-Authored-By: Andy Lauppe <andy@lauppe.org>
Install ACL package for privilege escalation on Linux systems
- Add documentation to sudoers explaining security rationale - Include instructions for operators to expand permissions if needed - Scope tailscale to: status, up, down, ip, version, ping, whois - Add note about up/down allowing flags like --advertise-exit-node - Document daemon-reload affecting all units - Remove redundant fail2ban config (logpath, duplicate maxretry/bantime) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
fix(security): harden installation with scoped sudo, fail2ban, and auto-updates
steflsd
force-pushed
the
rename-to-openclaw
branch
from
February 9, 2026 05:00
7077120 to
bb3ef76
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.