How to @clawdbot on VPS Safely: From Fresh Ubuntu VPS to Hardened Private AI Server in 30 Min

Setting up your own private AI server gives you control, privacy, and power. In this guide, we'll walk through how to take a fresh Ubuntu VPS and turn it into a hardened, private AI server running Clawdbot in just 30 minutes.

1) Lock Down SSH

First things first: security. We need to disable password authentication and root login to prevent unauthorized access.

Goal: Keys only, no passwords, no root login.

sudo nano /etc/ssh/sshd_config

In the file, find and set these explicitly:

PasswordAuthentication no
PermitRootLogin no

Save and exit, then reload the SSH daemon:

sudo sshd -t && sudo systemctl reload ssh

2) Default-Deny Firewall

Next, we'll configure the firewall to block everything by default. This ensures that only the traffic you explicitly allow gets through.

Goal: Block everything incoming by default.

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

3) Brute-Force Protection

Even with SSH keys, it's good practice to ban IPs that try to brute-force their way in.

Goal: Auto-ban IPs after failed login attempts.

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

4) Install Tailscale

We'll use Tailscale to create a private VPN mesh network. This allows you to access your server securely without exposing ports to the open internet.

Goal: Your private VPN mesh network.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

5) SSH Only Via Tailscale

Now that Tailscale is running, we can restrict SSH access to only come from your Tailscale network.

Goal: No more public SSH exposure.

Important: Verify Tailscale is working first!

tailscale status
sudo ufw allow from 100.64.0.0/10 to any port 22 proto tcp

Once you've confirmed you can connect via the Tailscale IP, remove the rule allowing public SSH (if you had one, or just rely on the default deny from step 2).

sudo ufw delete allow OpenSSH

6) Web Ports Private Too

If you're running web apps, keep them private too.

Goal: App only accessible from your devices.

sudo ufw allow from 100.64.0.0/10 to any port 443 proto tcp
sudo ufw allow from 100.64.0.0/10 to any port 80 proto tcp

7) Disable IPv6 (Optional)

If you aren't using IPv6, disabling it can reduce your attack surface.

Goal: Reduces attack surface if unused.

sudo sed -i 's/IPV6=yes/IPV6=no/' /etc/default/ufw
echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p && sudo ufw reload

8) Clawdbot Install

Now for the main event: installing Clawdbot.

Goal: AI assistant on your private server.

npm install -g clawdbot && clawdbot doctor

9) Lock Clawdbot to Owner Only

Make sure your bot only talks to you.

Goal: Only you can message the bot.

Configure your settings (usually in ~/.clawdbot/config.json or similar configuration file depending on version):

{ 
  "dmPolicy": "allowlist", 
  "allowFrom": ["YOUR_TELEGRAM_ID"], 
  "groupPolicy": "allowlist" 
}

10) Fix Credential Permissions

Protect your secrets. File permissions are critical.

Goal: Don't leave secrets world-readable.

chmod 700 ~/.clawdbot/credentials
chmod 600 .env

11) Run Security Audit

Clawdbot comes with a built-in security audit tool. Use it.

Goal: Catches issues you missed - don't skip!

clawdbot security audit --deep

Verify Everything

Before you call it a day, double-check your work:

sudo ufw status
ss -tulnp
tailscale status
clawdbot doctor

Result

When you're done, you should have:

• ✅ No public SSH
• ✅ No public web ports
• ✅ Server only reachable via Tailscale
• ✅ Bot responds only to you
• ✅ Private AI server in 30 min

NOW you can start playing, not before. You buckle your seatbelts before you step on the gas, hmkay?