ClawdBot：设置指南 + 如何避免被黑
ClawdBot: Setup Guide + How to NOT Get Hacked
ClawdBot：设置指南 + 如何避免被黑
ClawdBot is an open-source AI assistant that runs on your own server and connects to messaging apps like Telegram, WhatsApp, or Discord. You text it, it texts back. It can read your emails, manage files, run shell commands, and act on your behalf.
ClawdBot 是一款开源的人工智能助手，运行在你的服务器上，并连接到 Telegram、WhatsApp 或 Discord 等消息应用。你发短信，它回复。它可以读取你的邮件、管理文件、运行 shell 命令，并代表你行动。
This is obviously dangerous. You’re giving an AI shell access to a server, API tokens to your email and calendar, and an interface anyone can potentially message. A scan of ClawdBot instances running on VPS providers shows many with the gateway port open with zero authentication. API keys, email access, file permissions — exposed directly to the internet. Most setup guides focus on getting it running. This one shows you also how to not get hacked.
这显然很危险。你赋予了 AI 壳层服务器访问权限，给你的邮件和日历提供 API 令牌，以及任何人都可以发送消息的界面。对 VPS 提供商运行的 ClawdBot 实例扫描显示，许多实例网关端口开启且没有认证。API 密钥、电子邮件访问、文件权限——这些都直接暴露在互联网上。大多数安装指南都侧重于让它运行起来。这本书还教你如何避免被黑。
The Setup (Secure Version)
设置（安全版本）
From fresh Ubuntu VPS to hardened private AI server. Do it in this order.
从全新的 Ubuntu VPS 到加固的私有 AI 服务器。按这个顺序来。
1) Lock Down SSH 1）锁定 SSH
→ Keys only, no passwords, no root login.
→ 只用密钥，不设密码，不登录 root 权限。
sudo nano /etc/ssh/sshd_config # Set explicitly: PasswordAuthentication no
PermitRootLogin no
sudo sshd -t && sudo systemctl reload ssh
2) Default-Deny Firewall 2）默认拒绝防火墙
→ Block everything incoming by default.
→ 默认屏蔽所有进来信息。
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
3) Brute-Force Protection
3）暴力破解防护
→ Auto-ban IPs after failed login attempts.
→ 登录失败后自动封禁 IP。
sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban
4) Install Tailscale 4）安装尾秤
→ Your private VPN mesh network. This is what makes everything reachable only from your devices.
→ 你的私人 VPN 网状网络。这就是为什么所有设备只能通过你的设备访问。
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
5) SSH Only via Tailscale
5） 仅通过 Tailscale 进行 SSH
→ No more public SSH exposure.
→ 不再公开暴露于 SSH。
# Verify Tailscale is working first! tailscale status # Allow SSH only from Tailscale network sudo ufw allow from 100.64.0.0/10 to any port 22 proto tcp # Remove the public SSH rule sudo ufw delete allow OpenSSH
6) Web Ports Private Too
6）网页端口也私有
→ ClawdBot gateway only accessible from your devices.
→ ClawdBot 网关只能从你的设备访问。
sudo ufw allow from 100.64.0.0/10 to any port 443 proto tcp
sudo ufw allow from 100.64.0.0/10 to any port 80 proto tcp
7) Install Node.js 22 7）安装 Node.js 22
→ ClawdBot requires version 22+. Ubuntu’s default is older.
→ ClawdBot 需要版本 22+。Ubuntu 的默认版本比较老。
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
apt install -y nodejs
8) Install ClawdBot 8） 安装 ClawdBot
npm install -g clawdbot && clawdbot doctor
9) Lock ClawdBot to Owner Only
9） 仅限所有者锁定爪子
→ Only you can message the bot. Add this to your ClawdBot config:
→ 只有你能给机器人发消息。把这个加到你的 ClawdBot 配置里：
{ "dmPolicy": "allowlist", "allowFrom": ["YOUR_TELEGRAM_ID"], "groupPolicy": "allowlist" }
Never add ClawdBot to group chats. Every person in that chat can issue commands to your server through the bot.
永远不要把 ClawdBot 加入群聊。聊天里的每个人都可以通过机器人向你的服务器下达命令。
10) Enable Sandbox Mode 10）启用沙盒模式
→ Runs risky operations in a container instead of your actual system.
→ 在容器中运行高风险作，而不是你的实际系统。
Check the security docs and enable isolation. If something goes wrong, the blast radius is contained.
检查安全文档并启用隔离。如果出现问题，爆炸半径会被控制。
11) Whitelist Commands 11）白名单命令
→ Don’t let the agent run arbitrary commands. Explicitly list only what it needs:
→ 不要让代理随意执行命令。只明确列出它需要的：
{ "allowedCommands": ["git", "npm", "curl"], "blockedCommands": ["rm -rf", "sudo", "chmod"] }
If the agent gets hijacked through prompt injection, it can only execute what you’ve whitelisted.
如果代理通过提示注入被劫持，它只能执行你白名单上的内容。
12) Scope API Tokens 12）范围 API 令牌
→ When connecting GitHub, Gmail, Google Drive: do not use full-access tokens.
→ 连接 GitHub、Gmail、Google Drive 时：不要使用全权限令牌。
Get Lukas Niessen’s stories in your inbox
将卢卡斯·尼森的故事发送到您的邮箱
Join Medium for free to get updates from this writer.
免费加入 Medium，获取作者的最新动态。
Give minimum permissions. Read-only where possible. If something goes wrong, damage is limited to what that specific token could do.
只给最低限度的权限。尽可能只读。如果出现问题，伤害会限制在该特定代币能造成的影响范围内。
13) Fix Credential Permissions
13）修复凭证权限
→ Don’t leave secrets world-readable.
→ 不要让秘密被全世界都读懂。
chmod 700 ~/.clawdbot/credentials chmod 600 .env
14) Run Security Audit 14）进行安全审计
→ Catches issues you missed. Don’t skip this.
→ 发现你错过的问题。别错过这个。
clawdbot security audit --deep
If this fails, do not deploy. Fix whatever it flags first.
如果失败了，就不要部署。先修复它标记的部分。
Verify Everything 核实所有内容
sudo ufw status
ss -tulnp
tailscale status
clawdbot doctor
Result should be: 结果应为：
- No public SSH 没有公共 SSH
- No public web ports 没有公开网页端口
-
Server only reachable via Tailscale
服务器只能通过 Tailscale 访问 -
Bot responds only to you
机器人只对你有反应
Create Telegram Bot 创建 Telegram 机器人
-
Open Telegram, search for @BotFather
打开 Telegram，搜索@BotFather -
Send /newbot, follow prompts
发送 /newbot，按照提示作 -
Copy the token it gives you
复制它给你的标记 -
Get your user ID from @userinfobot
从@userinfobot 获取你的用户 ID。 - Enter both in clawdbot onboard --install-daemon 两者都 clawdbot onboard --install-daemon 输入
Approve Pairing 批准配对
After setup, message your bot on Telegram. It won’t respond yet.
设置好后，在 Telegram 上给你的机器人发消息。它还没有响应。
clawdbot pairing list telegram
clawdbot pairing approve telegram YOUR_CODE
Now it should respond. 现在它应该会响应。
A Note on Prompt Injection
关于提示注入的说明
Someone in the ClawdBot community tested this. They sent an email from a random address to an account ClawdBot had access to. The email contained hidden instructions. ClawdBot followed them and deleted all emails. Including the trash folder.
ClawdBot 社区有人测试过这个。他们从一个随机地址发了一封邮件，发给 ClawdBot 能访问的一个账户。邮件中隐藏了指令。ClawdBot 跟踪了他们并删除了所有邮件。包括垃圾桶。
This wasn’t theoretical. It happened.
这不是理论上的。事情发生了。
Claude Opus 4.5 is specifically recommended because Anthropic trained it to resist prompt injection (internal testing shows ~99% resistance). That helps, but it’s one layer. The command whitelisting, sandboxing, and scoped API tokens are the others.
Claude Opus 4.5 之所以被特别推荐，是因为 Anthropic 训练它能抵抗快速注射（内部测试显示 ~99% 的抵抗力）。这有帮助，但只是一层。命令白名单、沙箱和作用域 API 令牌是其他选择。
Common Errors 常见错误
“no auth configured” — Re-run clawdbot onboard and set up authentication again.
“未配置认证”——重新运行 clawdbot 并重新设置认证。
Bot not responding — You forgot to approve pairing. Run clawdbot pairing list telegram then approve.
机器人未响应——你忘了批准配对。先跑 clawdbot pairing list telegram ，然后批准。
“node: command not found” — Node.js isn’t installed. Run the nodesource install command.
“node： not found command”——Node.js 未安装。运行 nodesource 安装命令。
Gateway won’t start — Run clawdbot doctor to see what’s broken.
门户无法启动——跑爪机器人医生看看哪里坏了。
Resources 资源
-
Docs: https://docs.clawd.bot
医生：https://docs.clawd.bot -
Security guide: https://docs.clawd.bot/gateway/security
安全指南：https://docs.clawd.bot/gateway/security -
Getting started: https://docs.clawd.bot/start/getting-started
入门指南：https://docs.clawd.bot/start/getting-started -
Troubleshooting: https://docs.clawd.bot/help/troubleshooting
排查：https://docs.clawd.bot/help/troubleshooting -
GitHub: https://github.com/clawdbot/clawdbot
GitHub：https://github.com/clawdbot/clawdbot
