|
|
#!/bin/bash |
|
|
|
|
|
############################################################################### |
|
|
# OpenClaw 配置安全修复脚本 (v2 - 精简版) |
|
|
# |
|
|
# 用途：仅修复真正有价值的安全问题 |
|
|
# 执行前请确认已备份：./deploy.sh backup |
|
|
# |
|
|
# 已排除的"误报"（用户确认无需修复）： |
|
|
# - gateway.bind = "lan" → 实际绑定 Tailscale，安全 |
|
|
# - dangerouslyDisableDeviceAuth = true → 已知权衡，Tailscale 环境下可接受 |
|
|
# - 无 rateLimit → Tailscale 封闭网络 + 强 token，风险极低 |
|
|
# - MemoryLimit 废弃 → 实际 service 文件不存在此参数 |
|
|
############################################################################### |
|
|
|
|
|
set -e |
|
|
|
|
|
WORKSPACE="/root/.openclaw/workspace" |
|
|
CONFIG_FILE="/root/.openclaw/workspace/openclaw-config.json" |
|
|
TIMESTAMP=$(date +%Y%m%d-%H%M%S) |
|
|
|
|
|
echo "🔧 OpenClaw 配置安全修复脚本 (精简版)" |
|
|
echo "======================================" |
|
|
echo "" |
|
|
echo "📋 仅修复以下问题:" |
|
|
echo " 1. 添加 plugins.allow 白名单（良好安全习惯）" |
|
|
echo "" |
|
|
echo "⚠️ 已排除（用户确认无需修复）:" |
|
|
echo " - gateway.bind (Tailscale 环境安全)" |
|
|
echo " - dangerouslyDisableDeviceAuth (已知权衡)" |
|
|
echo " - rateLimit (威胁模型不匹配)" |
|
|
echo " - MemoryLimit (实际不存在)" |
|
|
echo "" |
|
|
read -p "确认继续？(y/N): " confirm |
|
|
|
|
|
if [[ ! $confirm =~ ^[Yy]$ ]]; then |
|
|
echo "❌ 已取消" |
|
|
exit 0 |
|
|
fi |
|
|
|
|
|
# 备份当前配置 |
|
|
echo "" |
|
|
echo "📦 备份当前配置..." |
|
|
cp "$CONFIG_FILE" "${CONFIG_FILE}.backup.${TIMESTAMP}" |
|
|
echo "✅ 备份完成：${CONFIG_FILE}.backup.${TIMESTAMP}" |
|
|
echo "" |
|
|
|
|
|
# 修复：设置 plugins.allow |
|
|
echo "🔒 修复：配置插件白名单" |
|
|
node -e " |
|
|
const fs = require('fs'); |
|
|
const config = JSON.parse(fs.readFileSync('$CONFIG_FILE', 'utf8')); |
|
|
config.plugins.allow = ['telegram', 'qwen-portal-auth', 'memos-cloud-openclaw-plugin']; |
|
|
fs.writeFileSync('$CONFIG_FILE', JSON.stringify(config, null, 2)); |
|
|
" |
|
|
echo "✅ 完成" |
|
|
echo "" |
|
|
|
|
|
echo "======================================" |
|
|
echo "✅ 修复完成！" |
|
|
echo "" |
|
|
echo "📋 下一步操作:" |
|
|
echo "1. 检查配置变更：git diff $CONFIG_FILE" |
|
|
echo "2. 重启服务：./deploy.sh restart" |
|
|
echo "3. 验证状态：./deploy.sh health" |
|
|
echo "4. 安全审计：openclaw security audit --deep" |
|
|
echo "" |
|
|
echo "⚠️ 如需回滚:" |
|
|
echo "cp ${CONFIG_FILE}.backup.${TIMESTAMP} $CONFIG_FILE" |
|
|
echo "./deploy.sh restart" |
|
|
echo ""
|
|
|
|
