企微管家 Claw
企业安全解决方案

# 1. 查看当前版本
openclaw version

# 2. 触发就地更新（SIGUSR1 热重启）
openclaw update

# 3. 更新前备份
cp -r ~/.openclaw ~/.openclaw.bak.$(date +%Y%m%d)

# 4. 更新后验证
openclaw doctor --non-interactive

[企业内网] ──VPN──▶ [OpenClaw 127.0.0.1:PORT]  ✅
[外部访问] ──SSH隧道──▶ [OpenClaw 127.0.0.1:PORT]  ✅
[公网直连] ──────▶ [OpenClaw 0.0.0.0:PORT]  ❌ 禁止

# 验证 Gateway 绑定地址（应为 127.0.0.1）
ss -tlnp | grep <gateway_port>

# 每日自动扫描（cron）
nmap -sT -p <port> <public_ip> | grep -q "open" && \
  echo "⚠️ OpenClaw 暴露公网！" | 企微告警推送

{
  "tools": {
    "exec": {
      "security": "allowlist",  // 仅允许白名单命令
      "ask": "on-miss",         // 非白名单命令需审批
      "host": "sandbox"         // 强制在 Docker 沙箱执行
    },
    "fs": {
      "workspaceOnly": true     // 文件操作限定在 workspace
    }
  }
}

docker run --read-only \
  --network none \
  -v ~/.openclaw/workspace:/workspace \
  --memory 512m --cpus 1.0 \
  openclaw-sandbox:bookworm-slim

# 专用低权限服务账号
sudo useradd -r -s /bin/false openclaw-svc
sudo -u openclaw-svc openclaw gateway start

{
  "tools": {
    "deny": ["clawhub.install", "clawhub.update"]
  }
}

#!/bin/bash
DANGEROUS_PATTERNS=("curl.*|.*sh" "wget.*|.*sh" "\.zip" "unzip"
  "chmod.*+x" "sudo" "password|passwd|密码" "rm -rf")

for pattern in "${DANGEROUS_PATTERNS[@]}"; do
  grep -rqi "$pattern" "$1" && \
    echo "⚠️ 危险模式: $pattern" && exit 1
done
echo "✅ 扫描通过"

1. openclaw gateway stop          # 立即停止 Gateway
2. openclaw config set gateway.auth.token $(openssl rand -hex 32)
3. rm ~/.openclaw/credentials/*-allowFrom.json  # 吊销所有 Pairing
4. 审查最近 24h 操作日志
5. 确认无数据外泄后重新启动

每天 08:00   → openclaw doctor --non-interactive
每周一 09:00 → 检查 OpenClaw 版本更新
每周三 10:00 → 审查上周审计日志摘要
每月 01 日   → 全量安全巡检（暴露面 + Skill + 凭证轮换）

# 确认来自官方 npm registry
npm info openclaw dist.tarball  # 应为 registry.npmjs.org
npm info openclaw version       # 确认为 latest

# CI/CD 校验包哈希（与官方发布一致）
npm pack openclaw | sha256sum

sudo /usr/libexec/ApplicationFirewall/socketfilterfw \
  --blockapp $(which node)

# 每日自动扫描 + 告警
nmap -sT -p <port> <public_ip> | grep "open" && \
  echo "CRITICAL: Gateway 暴露公网" | 企微推送

# 创建专用低权限账号
sudo dscl . -create /Users/openclaw-svc
sudo dscl . -create /Users/openclaw-svc UserShell /usr/bin/false
sudo dscl . -create /Users/openclaw-svc UniqueID 510

# 配合 launchd 以服务账号运行
# /Library/LaunchDaemons/ai.openclaw.gateway.plist
# <key>UserName</key><string>openclaw-svc</string>

# 验证
ps aux | grep openclaw  # 确认非 root/admin

❌ curl ... | bash / wget ... | sh
❌ 要求下载 .zip 文件后解压执行
❌ 要求用户输入密码或密钥
❌ chmod +x + 执行未知二进制
❌ rm -rf 非 workspace 路径
❌ sudo / 提权操作

{
  "tools": {
    "web": {
      "fetch": {
        "allowedDomains": [
          "*.anthropic.com", "openrouter.ai",
          "api.github.com", "qyapi.weixin.qq.com",
          "doc.weixin.qq.com",
          "generativelanguage.googleapis.com",
          "api.telegram.org"
        ]
      }
    }
  }
}

~/.openclaw/logs/*.log {
    daily
    rotate 180
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

# 日志完整性保护（防篡改）
sha256sum ~/.openclaw/logs/gateway.log \
  >> ~/.openclaw/logs/integrity.sha256