This guide sets up an Azure Linux VM with the Azure CLI, applies Network Security Group (NSG) hardening, configures Azure Bastion for SSH access, and installs OpenClaw.<\/p>\n
\n \n \n Use your existing public key if you have one:<\/p>\n \n \n Create the NSG and add rules so only the Bastion subnet can SSH into the VM.<\/p>\n \n Create the VNet with the VM subnet (NSG attached), then add the Bastion subnet.<\/p>\n \n The VM has no public IP. SSH access is exclusively through Azure Bastion.<\/p>\n \n Azure Bastion provides managed SSH access to the VM without exposing a public IP. Standard SKU with tunneling is required for CLI-based “`bash theme={“theme”:{“light”:”min-light”,”dark”:”min-dark”}} \n \n After onboarding completes:<\/p>\n Azure Bastion Standard SKU runs approximately $140\/month<\/strong> and the VM (Standard_B2as_v2) runs approximately $55\/month<\/strong>.<\/p>\n To reduce costs:<\/p>\n Delete Bastion when not needed<\/strong> and recreate it when you need SSH access. Bastion is the largest cost component and takes only a few minutes to provision.<\/p>\n<\/li>\n Use the Basic Bastion SKU<\/strong> (~$38\/month) if you only need Portal-based SSH and don’t require CLI tunneling ( To delete all resources created by this guide:<\/p>\n This removes the resource group and everything inside it (VM, VNet, NSG, Bastion, public IP).<\/p>\n Azure OpenClaw on Azure Linux VM This guide sets up an […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-614","post","type-post","status-publish","format-standard","hentry","category-docs"],"_links":{"self":[{"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/posts\/614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/comments?post=614"}],"version-history":[{"count":3,"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/posts\/614\/revisions"}],"predecessor-version":[{"id":768,"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/posts\/614\/revisions\/768"}],"wp:attachment":[{"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/media?parent=614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/categories?post=614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pa.yingzhi8.cn\/index.php\/wp-json\/wp\/v2\/tags?post=614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n az login
\n az extension add -n ssh<\/code><\/p>\nThe `ssh` extension is required for Azure Bastion native SSH tunneling.\n<\/code><\/pre>\n<\/p>\nbash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n az provider register --namespace Microsoft.Compute
\n az provider register --namespace Microsoft.Network<\/code><\/p>\nVerify registration. Wait until both show `Registered`.\n\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz provider show --namespace Microsoft.Compute --query registrationState -o tsv\naz provider show --namespace Microsoft.Network --query registrationState -o tsv\n```\n<\/code><\/pre>\n<\/p>\nbash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n RG=\"rg-openclaw\"
\n LOCATION=\"westus2\"
\n VNET_NAME=\"vnet-openclaw\"
\n VNET_PREFIX=\"10.40.0.0\/16\"
\n VM_SUBNET_NAME=\"snet-openclaw-vm\"
\n VM_SUBNET_PREFIX=\"10.40.2.0\/24\"
\n BASTION_SUBNET_PREFIX=\"10.40.1.0\/26\"
\n NSG_NAME=\"nsg-openclaw-vm\"
\n VM_NAME=\"vm-openclaw\"
\n ADMIN_USERNAME=\"openclaw\"
\n BASTION_NAME=\"bas-openclaw\"
\n BASTION_PIP_NAME=\"pip-openclaw-bastion\"<\/code><\/p>\nAdjust names and CIDR ranges to fit your environment. The Bastion subnet must be at least `\/26`.\n<\/code><\/pre>\n<\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\nSSH_PUB_KEY=\"$(cat ~\/.ssh\/id_ed25519.pub)\"\n```\n\nIf you don't have an SSH key yet, generate one:\n\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\nssh-keygen -t ed25519 -a 100 -f ~\/.ssh\/id_ed25519 -C \"you@example.com\"\nSSH_PUB_KEY=\"$(cat ~\/.ssh\/id_ed25519.pub)\"\n```\n<\/code><\/pre>\n<\/p>\nbash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n VM_SIZE=\"Standard_B2as_v2\"
\n OS_DISK_SIZE_GB=64<\/code><\/p>\nChoose a VM size and OS disk size available in your subscription and region:\n\n* Start smaller for light usage and scale up later\n* Use more vCPU\/RAM\/disk for heavier automation, more channels, or larger model\/tool workloads\n* If a VM size is unavailable in your region or subscription quota, pick the closest available SKU\n\nList VM sizes available in your target region:\n\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz vm list-skus --location \"${LOCATION}\" --resource-type virtualMachines -o table\n```\n\nCheck your current vCPU and disk usage\/quota:\n\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz vm list-usage --location \"${LOCATION}\" -o table\n```\n<\/code><\/pre>\n<\/p>\nDeploy Azure resources<\/h2>\n
bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n az group create -n \"${RG}\" -l \"${LOCATION}\"<\/code>\n <\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz network nsg create \n -g \"${RG}\" -n \"${NSG_NAME}\" -l \"${LOCATION}\"\n\n# Allow SSH from the Bastion subnet only\naz network nsg rule create \n -g \"${RG}\" --nsg-name \"${NSG_NAME}\" \n -n AllowSshFromBastionSubnet --priority 100 \n --access Allow --direction Inbound --protocol Tcp \n --source-address-prefixes \"${BASTION_SUBNET_PREFIX}\" \n --destination-port-ranges 22\n\n# Deny SSH from the public internet\naz network nsg rule create \n -g \"${RG}\" --nsg-name \"${NSG_NAME}\" \n -n DenyInternetSsh --priority 110 \n --access Deny --direction Inbound --protocol Tcp \n --source-address-prefixes Internet \n --destination-port-ranges 22\n\n# Deny SSH from other VNet sources\naz network nsg rule create \n -g \"${RG}\" --nsg-name \"${NSG_NAME}\" \n -n DenyVnetSsh --priority 120 \n --access Deny --direction Inbound --protocol Tcp \n --source-address-prefixes VirtualNetwork \n --destination-port-ranges 22\n```\n\nThe rules are evaluated by priority (lowest number first): Bastion traffic is allowed at 100, then all other SSH is blocked at 110 and 120.\n<\/code><\/pre>\n<\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz network vnet create \n -g \"${RG}\" -n \"${VNET_NAME}\" -l \"${LOCATION}\" \n --address-prefixes \"${VNET_PREFIX}\" \n --subnet-name \"${VM_SUBNET_NAME}\" \n --subnet-prefixes \"${VM_SUBNET_PREFIX}\"\n\n# Attach the NSG to the VM subnet\naz network vnet subnet update \n -g \"${RG}\" --vnet-name \"${VNET_NAME}\" \n -n \"${VM_SUBNET_NAME}\" --nsg \"${NSG_NAME}\"\n\n# AzureBastionSubnet — name is required by Azure\naz network vnet subnet create \n -g \"${RG}\" --vnet-name \"${VNET_NAME}\" \n -n AzureBastionSubnet \n --address-prefixes \"${BASTION_SUBNET_PREFIX}\"\n```\n<\/code><\/pre>\n<\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz vm create \n -g \"${RG}\" -n \"${VM_NAME}\" -l \"${LOCATION}\" \n --image \"Canonical:ubuntu-24_04-lts:server:latest\" \n --size \"${VM_SIZE}\" \n --os-disk-size-gb \"${OS_DISK_SIZE_GB}\" \n --storage-sku StandardSSD_LRS \n --admin-username \"${ADMIN_USERNAME}\" \n --ssh-key-values \"${SSH_PUB_KEY}\" \n --vnet-name \"${VNET_NAME}\" \n --subnet \"${VM_SUBNET_NAME}\" \n --public-ip-address \"\" \n --nsg \"\"\n```\n\n`--public-ip-address \"\"` prevents a public IP from being assigned. `--nsg \"\"` skips creating a per-NIC NSG (the subnet-level NSG handles security).\n\n**Reproducibility:** The command above uses `latest` for the Ubuntu image. To pin a specific version, list available versions and replace `latest`:\n\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz vm image list \n --publisher Canonical --offer ubuntu-24_04-lts \n --sku server --all -o table\n```\n<\/code><\/pre>\n<\/p>\naz network bastion ssh<\/code>.<\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\naz network public-ip create \n -g \"${RG}\" -n \"${BASTION_PIP_NAME}\" -l \"${LOCATION}\" \n --sku Standard --allocation-method Static\n\naz network bastion create \n -g \"${RG}\" -n \"${BASTION_NAME}\" -l \"${LOCATION}\" \n --vnet-name \"${VNET_NAME}\" \n --public-ip-address \"${BASTION_PIP_NAME}\" \n --sku Standard --enable-tunneling true\n```\n\nBastion provisioning typically takes 5-10 minutes but can take up to 15-30 minutes in some regions.\n<\/code><\/pre>\n<\/p>\n安装 OpenClaw<\/h2>\n
\n VM_ID=”$(az vm show -g “${RG}” -n “${VM_NAME}” –query id -o tsv)”<\/p>\naz network bastion ssh \n --name \"${BASTION_NAME}\" \n --resource-group \"${RG}\" \n --target-resource-id \"${VM_ID}\" \n --auth-type ssh-key \n --username \"${ADMIN_USERNAME}\" \n --ssh-key ~\/.ssh\/id_ed25519\n```\n<\/code><\/pre>\n<\/p>\nbash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n curl -fsSL https:\/\/openclaw.ai\/install.sh -o \/tmp\/install.sh
\n bash \/tmp\/install.sh
\n rm -f \/tmp\/install.sh<\/code><\/p>\nThe installer installs Node LTS and dependencies if not already present, installs OpenClaw, and launches the onboarding wizard. See [Install](\/install) for details.\n<\/code><\/pre>\n<\/p>\n```bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}\nopenclaw gateway status\n```\n\nMost enterprise Azure teams already have GitHub Copilot licenses. If that is your case, we recommend choosing the GitHub Copilot provider in the OpenClaw onboarding wizard. See [GitHub Copilot provider](\/providers\/github-copilot).\n<\/code><\/pre>\n<\/p>\nCost considerations<\/h2>\n
\n
bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\n az vm deallocate -g \"${RG}\" -n \"${VM_NAME}\"
\n az vm start -g \"${RG}\" -n \"${VM_NAME}\" # restart later<\/code><\/p>\n\n
az network bastion ssh<\/code>).<\/p>\n<\/li>\n<\/ul>\nCleanup<\/h2>\n
bash theme={\"theme\":{\"light\":\"min-light\",\"dark\":\"min-dark\"}}
\naz group delete -n \"${RG}\" --yes --no-wait<\/code><\/p>\n下一步<\/h2>\n
\n