Skip to content

Operations

This page covers how the instance is secured, how it stays up to date, and how to back it up, read its logs and check its health.

Security model

The hardening below is built into the image and active on first boot.

Control Setting
UFW firewall Deny all inbound by default. Allow TCP 22 and TCP 18789. Allow all outbound.
fail2ban The sshd jail bans an address for 1 hour after 5 failed logins within 10 minutes.
SSH Key-only: password login off, root login only with a key, X11 forwarding off, at most 3 authentication tries.
Kernel ICMP redirects off, IP forwarding off.
Updates Unattended security upgrades, daily, with no automatic reboot.

The image ships with no SSH keys, passwords or API keys. EC2 adds your key pair at launch.

The UFW firewall and the EC2 security group are separate layers: traffic has to pass both. Keep the security group as narrow as you can, ideally SSH only from your own address, and reach the dashboard through an SSH tunnel.

Anyone who can message your agent spends your AI provider credits and can ask it to act for you. Only allow the users you trust in each channel.

Updates

  • Operating system. Security updates install automatically every day. The instance does not reboot by itself; when an update needs a reboot, for example a new kernel, reboot at a time that suits you:

    sudo reboot

  • OpenClaw. Each image version comes with a specific OpenClaw release. You can update OpenClaw in place on your instance: see the OpenClaw documentation for the update command. Check the installed version with openclaw --version.

  • New image versions. A new version on AWS Marketplace does not change instances that are already running. To move to it, launch a new instance and copy your ~/.openclaw directory across.

Backups

Your agent's configuration, credentials, memory and sessions are all in /home/ubuntu/.openclaw. To back up the whole instance, take an EBS snapshot of the root volume from the EC2 console. To back up only OpenClaw's data:

tar -czf openclaw-backup.tar.gz -C /home/ubuntu .openclaw

Warning

The backup contains your API keys and channel tokens. Store it encrypted and delete copies you no longer need.

Logs and health checks

OpenClaw's log files in /var/log/openclaw/ rotate daily and are kept for 7 days, compressed.

Check the host:

free -h                              # memory and the 4 GB swap
sudo ufw status                      # firewall rules
sudo fail2ban-client status sshd     # banned addresses
timedatectl                          # time zone and clock

Stop and start

Stopping the instance stops the hourly software charge. When you start it again it gets a new public IP address, unless you attach an Elastic IP. Messages sent to your agent while it is stopped wait in the messaging platform until it is back.

Support

For help with the image, its hardening or deployment, email info@softwaresushi.com with your instance ID, the image version and what you see. Never send API keys or tokens.

For OpenClaw itself, see the OpenClaw documentation and its issue tracker.