Install OpenClaw on a Secure VPS in Under 10 Minutes

By Samuel Gregory

Duration: 10:00

player.exe -v "vps-deploy-10-minutes"

overview.md

A quick deployment walkthrough: a 10-minute VPS setup with security hardening, firewall rules, and an SSH tunnel that keeps your OpenClaw instance running 24/7 without exposing it to the public internet.

vps_hardening.md

Hardening the Server in Under Five Minutes

The walkthrough starts on a freshly provisioned Ubuntu VPS and immediately disables root login over SSH, creates a dedicated deploy user with sudo privileges, and enforces key-based authentication only. He treats every step as non-negotiable, reminding viewers that a default cloud image is a scanning target within minutes of booting.

The firewall configuration is deliberately minimal. UFW allows only the SSH port from a single trusted IP and the OpenClaw tunnel port on localhost. The video explains why it rejects exposing the agent's HTTP port directly: the agent should never be reachable by anyone who happens to know your server's address.

// Minimal hardening sequence from the video

adduser deploy && usermod -aG sudo deploy

sed -i 's/PermitRootLogin yes/PermitRootLogin no/' sshd_config

ufw default deny incoming

ufw allow from 203.0.113.10 to any port 22

ufw enable

Result:

"Only your office IP can reach SSH. Everything else is dark."

The SSH Tunnel Trick

Instead of opening a port, the setup uses a reverse SSH tunnel so the agent's local interface is forwarded securely to a workstation. It wraps the tunnel in a systemd service with automatic restart, meaning even a reboot leaves the connection self-healing within seconds.

always_on.md

Keeping It Alive Around the Clock

The final chapter covers persistence. OpenClaw itself runs under systemd as a managed service, with health checks that restart the process on crash and a log rotation policy that prevents disk bloat. A lightweight monitoring script is added that pings the agent every minute and sends a Telegram alert if it stops responding.

The payoff is a server you can forget about. The video closes on a 30-day uptime graph with zero manual interventions, making the case that a hardened VPS is the right home for an agent that needs to be available while you sleep.

$ ssh clawdbot.space --loading...