Skill: vegasbrianc/security-dashboard (version 1.2.1)

--- name: security-dashboard description: Real-time security monitoring dashboard for OpenClaw and Linux server infrastructure. Monitors gateway status, network security, public exposure, system updates, SSH access, TLS certificates, and resource usage. --- # Security Dashboard Skill Real-time security monitoring dashboard for OpenClaw and Linux server infrastructure. ## Features - **OpenClaw Security:** Gateway status, binding, authentication, sessions, version tracking - **Network Security:** Tailscale status, public ports, firewall, active connections - **Public Exposure:** Port binding analysis, dashboard security, exposure level assessment - **System Security:** Updates, uptime, load, failed login attempts - **SSH & Access:** Password auth status, fail2ban, banned IPs, active sessions - **Certificates & TLS:** Caddy status, TLS configuration, WireGuard encryption - **Resource Security:** CPU/memory/disk usage, config file permissions ## Installation ### 1. Install the Skill ```bash cd /root/clawd/skills/security-dashboard sudo ./scripts/install.sh ``` This will: - **Ask user preference:** Run as dedicated user (recommended) or root - Create `openclaw-dashboard` user with limited sudo privileges (if non-root) - Create systemd service with security hardening - Configure localhost binding (127.0.0.1 only) - Start the dashboard on port 18791 - Enable auto-start on boot **Security Note:** Running as a dedicated user with limited sudo is recommended. The dashboard only needs sudo for security checks (fail2ban, firewall, systemctl status) - not full root access. ### 2. Access the Dashboard **Localhost only (secure by default):** Via SSH port forwarding: ```bash ssh -L 18791:localhost:18791 root@YOUR_SERVER_IP ``` Then visit: http://localhost:18791 ## Usage ### Start/Stop/Restart ```bash sudo systemctl start security-dashboard sudo systemctl stop security-dashboard sudo systemctl restart security-dashboard ``` ### Check Status ```bash sudo systemctl status security-dashboard ``` ### View Logs ```bash sudo journalctl -u security-dashboard -f ``` ### API Endpoint Get raw security metrics: ```bash curl http://localhost:18791/api/security | jq ``` ## Security Hardening The dashboard follows security best practices to minimize attack surface: ### Dedicated User (Recommended) The install script creates a `openclaw-dashboard` user with **limited sudo privileges**: - ✅ No shell access (`/bin/false`) - ✅ No home directory - ✅ Only specific sudo commands allowed (fail2ban, firewall, systemctl status) - ✅ Cannot execute arbitrary commands ### Systemd Hardening Service runs with security restrictions: ```ini NoNewPrivileges=true # Cannot escalate privileges PrivateTmp=true # Isolated tmp directory ProtectSystem=strict # Read-only filesystem except skill dir ProtectHome=true # No access to /home ReadWritePaths=... # Only skill directory is writable Restart=on-failure # Restart only on crashes (not always) ``` ### Network Binding - **Default:** `127.0.0.1` (localhost only) - Not accessible from network without SSH tunnel or VPN - No public exposure risk ### Running as Root (Not Recommended) If you choose `root` during install: - ⚠️ Full system access if compromised - ⚠️ No privilege separation - ⚠️ Only suitable for trusted, isolated environments Use the dedicated user option for production deployments. ## Configuration ### Change Port Edit `/root/clawd/skills/security-dashboard/server.js`: ```javascript const PORT = 18791; // Change this ``` Then restart: ```bash sudo systemctl restart security-dashboard ``` ### Change Binding **Default:** `127.0.0.1` (localhost only - secure) **Alternative:** `0.0.0.0` (all interfaces - only with Tailscale!) Edit `server.js` line 445: ```javascript server.listen(PORT, '127.0.0.1', () => { // Change '127.0.0.1' to '0.0.0.0' if needed }); ``` ⚠️ **Security Warning:** Only bind to `0.0.0.0` if behind Tailscale or firewall! ### Customize Metrics Add custom checks in `server.js`: - `getOpenClawMetrics()` - OpenClaw-specific metrics - `getNetworkMetrics()` - Network security - `getSystemMetrics()` - System-level checks - `getPublicExposure()` - Port/binding analysis ## Dashboard Sections ### 🦞 OpenClaw Security - Gateway running/stopped status - Binding configuration (loopback/public) - Auth token length and mode - Active sessions + subagents - Skills count - Current version + update availability ### 🌐 Network Security - Tailscale connection status + IP - Public ports count - Firewall status (UFW/firewalld) - Active TCP connections ### 🌍 Public Exposure - Exposure level (Excellent/Minimal/Warning/High) - Public port details (service names) - Kanban board binding - Security dashboard binding - OpenClaw gateway binding - Tailscale active/inactive - Security recommendations ### 🖥️ System Security - Updates available - Server uptime - Load average - Failed SSH logins (24h) - Root processes count ### 🔑 SSH & Access Control - SSH service status - Password authentication (enabled/disabled) - fail2ban status - Banned IPs count - Active SSH sessions ### 📜 Certificates & TLS - Caddy status - Public TLS enabled/disabled - Tailscale WireGuard encryption ### 📊 Resource Security - CPU usage percentage - Memory usage percentage - Disk usage percentage - Config file permissions (should be 600) ## Security Alerts Dashboard generates real-time alerts: **Critical (Red):** - Weak gateway token (< 32 chars) - SSH password authentication enabled - Insecure config permissions (not 600) - **Firewall inactive** (UFW/firewalld not running) - **fail2ban inactive** (SSH brute-force protection disabled) **Warning (Yellow):** - Tailscale disconnected - 20+ system updates available - 10+ failed login attempts in 24h - Disk > 80% full **Info (Blue):** - Gateway exposed without Tailscale - Non-standard configurations ## Integration Points ### Morning Briefing Add security status to morning report: ```bash curl -s http://localhost:18791/api/security | jq '.status' ``` ### Heartbeat Checks Monitor for critical alerts: ```bash curl -s http://localhost:18791/api/security | \ jq '.alerts[] | select(.level == "critical")' ``` ### Alerting Integration Pipe alerts to notification systems: ```bash ./scripts/check-alerts.sh | xargs -I {} notify-send "Security Alert" "{}" ``` ## Architecture **Backend:** Node.js HTTP server **Frontend:** Vanilla JavaScript (no frameworks) **Port:** 18791 (configurable) **Binding:** 127.0.0.1 (localhost only) **Service:** systemd unit **Files:** - `server.js` - Main backend (metrics collection + API) - `public/index.html` - Dashboard UI - `lib/` - Shared utilities (if needed) ## Dependencies - Node.js (v18+) - `systemctl` - Service management - `ss` - Socket statistics - `ufw` or `firewalld` - Firewall check - `tailscale` - VPN status (optional) - `fail2ban` - Ban tracking (optional) - `openclaw` - Gateway monitoring All dependencies are standard Linux utilities except OpenClaw. ## Troubleshooting ### Dashboard not loading 1. Check service status: ```bash sudo systemctl status security-dashboard ``` 2. Check logs: ```bash sudo journalctl -u security-dashboard -n 50 ``` 3. Verify port is listening: ```bash ss -tlnp | grep 18791 ``` 4. Test API directly: ```bash curl http://localhost:18791/api/security ``` ### Gateway Status "Unknown" - Verify OpenClaw gateway is running: ```bash pgrep -f openclaw-gateway ``` - Check OpenClaw config exists: ```bash cat ~/.openclaw/openclaw.json ``` ### Metrics showing "Unknown" - Commands may require sudo permissions - Check script execution permissions - Verify paths exist (sessions, skills, etc.) ## Uninstall ```bash sudo systemctl stop security-dashboard sudo systemctl disable security-dashboard sudo rm /etc/systemd/system/security-dashboard.service sudo systemctl daemon-reload ``` Then remove skill directory: ```bash rm -rf /root/clawd/skills/security-dashboard ``` ## Publishing To publish to ClawdHub: ```bash clawdhub publish security-dashboard ``` ## License MIT ## Author Created by Erdma for Brian Christner's infrastructure monitoring.


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)