Run OpenClaw on a VPS securely

To run OpenClaw on a VPS, install it for a normal user with the official installer, run openclaw onboard --install-daemon to set up your model and start the gateway as a service, and keep the gateway on 127.0.0.1. You then reach its Control UI through an SSH tunnel from your own computer. It takes about fifteen minutes on a fresh Ubuntu 24.04 or Debian 12 server with 4 GB of memory.

A VPS suits OpenClaw well: it's always on, so your assistant answers in your chat apps while your laptop is closed, and whatever it does with files and commands happens on a machine set aside for it.

Keep the gateway private#

The gateway is the part of OpenClaw that runs all the time. It holds your model keys and chat connections, serves the Control UI, and can run commands on the server. Whoever reaches it with the right token controls your assistant.

Out of the box it's set up sensibly: it listens on 127.0.0.1, port 18789, and asks for a token even there. The trouble starts when people open it to the internet to reach the dashboard more easily. Security researchers have found tens of thousands of OpenClaw gateways reachable from the internet, many without working authentication. One serious bug, CVE-2026-25253, let a malicious link take over an install; it was fixed in version 2026.1.29.

So the rules for this guide are simple: the gateway stays on localhost, you reach it through SSH or Tailscale, and you keep OpenClaw updated.

What you need#

• A server running Ubuntu 24.04 or Debian 12 or 13, with 4 GB of memory or more. Installs are widely reported to fail on 1 GB servers and to be tight on 2 GB. How much RAM does my VPS need? explains how to check.
• SSH access with a key. Connect with SSH covers it.
• An API key from a model provider OpenClaw supports.

OpenClaw needs Node.js 24.16 or newer, or 26.1 or newer. The installer below brings its own, so you don't need to install Node first.

Create a user for OpenClaw#

Don't run OpenClaw as root. As root, create a user for it and let its services run without anyone logged in:

apt update && apt install -y curl git
useradd --create-home --shell /bin/bash openclaw
loginctl enable-linger openclaw

The gateway runs as a systemd user service. Lingering is what starts that service at boot and keeps it running after you log out.

Switch to the new user:

su - openclaw

systemctl --user needs to know where the user's runtime directory is, which a su session doesn't set. Add it to the user's shell, along with OpenClaw's folder:

cat >> ~/.bashrc <<'EOF'
export PATH="$HOME/.openclaw/bin:$PATH"
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
EOF
source ~/.bashrc

Install OpenClaw#

Still as the openclaw user, run the official installer. This one installs OpenClaw and a private copy of Node.js under ~/.openclaw, without root, and doesn't start the setup wizard:

curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install-cli.sh | bash -s -- --no-onboard
openclaw --version

If you'd rather read the script first, download it, look through it, then run it with bash install-cli.sh --no-onboard.

Don't install OpenClaw in Docker for this setup unless you know why you want to. Inside a container its default bind changes from loopback to 0.0.0.0, and a port you publish with Docker can bypass ufw.

Set up your model and start the gateway#

Run the setup wizard with the option that installs the gateway as a service:

openclaw onboard --install-daemon

It asks for your model provider and key, and sets up the gateway. When it gets to the gateway's settings, keep the defaults: bind to loopback, port 18789, token authentication, Tailscale exposure off. It generates the token for you.

Check the gateway is running:

openclaw gateway status
systemctl --user status openclaw-gateway.service

Then print the token you'll need for the Control UI:

openclaw gateway auth-token --show

If it says there's no token, run openclaw doctor --generate-gateway-token, restart the gateway with openclaw gateway restart, and show it again.

Open the Control UI through an SSH tunnel#

On your own computer, open a tunnel that forwards port 18789 on your machine to port 18789 on the server's localhost:

ssh -N -L 18789:127.0.0.1:18789 root@203.0.113.10

Use your server's address, and your own user if you don't log in as root. Leave that window open, then browse to http://localhost:18789 and paste the token into the Gateway secret field. The browser keeps it for that tab.

That's the whole trick: nothing on the server listens publicly, and only someone who can log in over SSH can reach the gateway.

Or reach it over Tailscale#

If you want the Control UI from your phone, or without opening a tunnel each time, OpenClaw's documentation recommends Tailscale Serve: the gateway stays on loopback, and Tailscale makes it reachable inside your private tailnet only. Follow OpenClaw's Tailscale guide for the settings. Avoid Tailscale Funnel unless you mean to put the gateway on the public internet.

Lock down the rest of the server#

The gateway is private, but the server still needs the basics:

• Firewall: allow SSH and nothing else you don't use. Firewall with ufw covers the server side, and on VPSNine the panel firewall can block ports before traffic reaches the server.
• SSH: keys only, no passwords. Work through the SSH hardening checklist.
• System updates: turn on automatic security updates.
• What the agent can do: OpenClaw can run commands as the openclaw user. Giving that user sudo hands your assistant the whole server, so think twice before you do.

Back it up#

OpenClaw keeps its config, credentials and the agent's workspace under ~/.openclaw by default. To take a consistent copy, stop the gateway, archive the folder and start it again:

systemctl --user stop openclaw-gateway.service
tar -czf ~/openclaw-backup-$(date +%F).tar.gz -C ~ .openclaw
systemctl --user start openclaw-gateway.service

The archive holds your model keys, so treat it like a password. Copy it off the server; a backup on the same disk doesn't survive the disk. Backups you should run shows how to schedule it.

Update#

OpenClaw releases often, and security fixes arrive in those releases. As the openclaw user:

openclaw update --dry-run
openclaw update

openclaw update works out how it was installed, checks the new version while the old gateway keeps running, then switches over and restarts the gateway. openclaw update status shows where it stands. Afterwards, openclaw doctor migrates the config if it needs to and checks everything is healthy. Take a backup before a big version jump.

When it goes wrong#

• Failed to connect to bus from systemctl --user: XDG_RUNTIME_DIR isn't set in this session. Log in as openclaw with su - openclaw after adding the line above, or export it by hand.
• The gateway stops when you log out: lingering is off. As root, run loginctl enable-linger openclaw.
• The Control UI doesn't load: the tunnel isn't open, or the gateway isn't running. Check openclaw gateway status on the server, and that the ssh -N -L window is still open.
• The Control UI rejects you: the token is wrong or was regenerated. Show it again with openclaw gateway auth-token --show.
• The install is killed halfway: the server ran out of memory. Add swap or move to a bigger plan.

Doing it on VPSNine#

The OpenClaw one-click app does the first half of this guide on the server's first boot: it creates the openclaw user with lingering on, adds the shell settings, and runs the official installer. Nothing listens publicly when it's done.

Log in, run su - openclaw, and carry on from Set up your model and start the gateway. The one-click app needs the Standard plan or bigger.