​

Security Services

​

Available Services

​

Usage Examples

​

Identity & Access Management

npx create-better-openclaw \
  --services authentik,vaultwarden,postgresql,redis \
  --yes

​

Security Monitoring

npx create-better-openclaw \
  --services crowdsec,grafana,prometheus \
  --yes

​

Penetration Testing Suite

npx create-better-openclaw \
  --services hexstrike,pentagi,pentestagent \
  --yes

​

Smart Contract Security

npx create-better-openclaw \
  --services solidityguard,redis \
  --yes

​

Security Categories

​

Identity & Access Management

• Authentik: Enterprise SSO and identity provider
• Vaultwarden: Password management and secrets storage

​

Intrusion Prevention

• CrowdSec: Collaborative IPS with threat intelligence

​

Penetration Testing

• HexStrike AI: MCP-based pentesting platform (150+ tools)
• PentAGI: Autonomous AI pentesting agents
• PentestAgent: AI-powered security assessments

​

Smart Contract Security

• SolidityGuard: Solidity vulnerability scanner

​

Service Comparison

​

Authentik Configuration

​

Initial Setup

1. Access web UI at http://localhost:9015
2. Complete initial setup wizard
3. Configure authentication flow
4. Add applications
5. Create user groups
6. Set up providers (SAML/OIDC)

​

SSO Integration

# Add application to Authentik
# Configure OIDC provider
# Get client ID and secret
# Configure app to use Authentik for auth

​

Multi-Factor Authentication

• TOTP (Time-based One-Time Password)
• WebAuthn (hardware keys)
• SMS (with external provider)
• Email verification
• Push notifications

​

Vaultwarden Configuration

​

Admin Panel

​

User Registration

# Allow signups
SIGNUPS_ALLOWED=true

# Or use invite-only mode
SIGNUPS_ALLOWED=false

​

HTTPS Setup (Required for Browser Extensions)

# Use Caddy or Traefik for HTTPS
npx create-better-openclaw \
  --services vaultwarden,caddy \
  --proxy caddy \
  --domain vault.example.com \
  --yes

​

CrowdSec Configuration

​

Install Collections

# List available collections
docker exec crowdsec cscli collections list

# Install collection
docker exec crowdsec cscli collections install crowdsecurity/nginx

​

Add Bouncers

# Install firewall bouncer
docker exec crowdsec cscli bouncers add firewall-bouncer

# Install nginx bouncer
docker exec crowdsec cscli bouncers add nginx-bouncer

​

View Decisions

# View active bans
docker exec crowdsec cscli decisions list

# View alerts
docker exec crowdsec cscli alerts list

​

Penetration Testing with HexStrike

​

MCP Integration

# HexStrike exposes 150+ pentesting tools via MCP
# OpenClaw agents can invoke tools through the MCP protocol

​

Available Tool Categories

• Network scanning (nmap, masscan)
• Web application testing (sqlmap, xsstrike)
• Password cracking (hashcat, john)
• Exploitation frameworks (metasploit)
• Reconnaissance (theHarvester, recon-ng)
• Wireless testing (aircrack-ng)

​

Safety Considerations

​

PentAGI Autonomous Testing

​

Agent Workflow

1. Reconnaissance: Gather information about target
2. Scanning: Identify open ports and services
3. Enumeration: Discover vulnerabilities
4. Exploitation: Attempt to exploit findings
5. Reporting: Generate detailed security report

​

Configuration

# Configure target scope
# Set testing parameters
# Define rules of engagement
# Enable/disable aggressive checks

​

SolidityGuard Smart Contract Analysis

​

Supported Checks

• Reentrancy vulnerabilities
• Integer overflow/underflow
• Access control issues
• Gas optimization
• Unchecked external calls
• Front-running risks

​

Usage

# Upload Solidity contract
# Run automated analysis
# Review vulnerability report
# Apply recommended fixes

​

Best Practices

​

Identity & Access Management

1. MFA: Always enable multi-factor authentication
2. Strong Passwords: Enforce password complexity
3. Regular Audits: Review access logs regularly
4. Least Privilege: Grant minimal necessary permissions
5. Session Management: Configure appropriate session timeouts

​

Password Management

1. HTTPS: Always use HTTPS for Vaultwarden
2. Backups: Regular backups of password database
3. Master Password: Use strong master password
4. 2FA: Enable two-factor authentication
5. Organization: Use folders and collections

​

Intrusion Prevention

1. Regular Updates: Keep CrowdSec scenarios updated
2. Log Collection: Ensure all services send logs
3. Bouncer Deployment: Deploy bouncers on all entry points
4. Alert Response: Define incident response procedures
5. Whitelisting: Maintain whitelist of trusted IPs

​

Penetration Testing

1. Authorization: Only test authorized systems
2. Documentation: Document all testing activities
3. Scope: Clearly define testing scope
4. Backup: Ensure backups exist before testing
5. Reporting: Generate detailed findings reports

​

Security Hardening

​

Network Security

# Use Docker networks for isolation
# Configure firewall rules
# Enable rate limiting
# Use reverse proxy with SSL/TLS
# Implement network segmentation

​

Application Security

# Keep services updated
# Use strong authentication
# Enable audit logging
# Configure CORS properly
# Validate all inputs

​

Container Security

# Use official images
# Scan images for vulnerabilities
# Run containers as non-root
# Limit container resources
# Enable security profiles (AppArmor/SELinux)

​

Compliance

​

GDPR Compliance

• Data encryption at rest and in transit
• User data export capabilities
• Right to deletion
• Audit logging
• Data processing agreements

​

SOC 2 Considerations

• Access control and authentication
• Encryption standards
• Monitoring and alerting
• Incident response procedures
• Regular security assessments

​

Integration Examples

​

Complete Security Stack

npx create-better-openclaw \
  --services authentik,vaultwarden,crowdsec,postgresql,redis,grafana \
  --yes

​

AI-Powered Security Testing

npx create-better-openclaw \
  --services hexstrike,pentagi,redis \
  --yes

​

Identity + Secrets Management

npx create-better-openclaw \
  --services authentik,vaultwarden,postgresql,redis,caddy \
  --proxy caddy \
  --yes