aegis-cloudflared-tunnel-hardening

Scope & Objectives

Audit one Linux host running the Cloudflare Tunnel daemon (cloudflared) — or the config-as-code repository that declares it. Eight domains, in priority order:

1. Daemon discovery & run mode — locate every cloudflared systemd unit; classify token-based mode (cloudflared tunnel run --token ...) vs config-file mode (config.yml + tunnel credentials JSON); detect undocumented or duplicate tunnels on one host.
2. Identity-material exposure — tunnel tokens embedded in unit files or environment variables, credentials JSONs (/etc/cloudflared/<UUID>.json), and the account-level cert.pem; permissions and placement. Whoever holds this material controls your tunnel.
3. Ingress precision — the ingress: table in config.yml is the tunnel's ACL: hostname→service mappings, terminal catch-all correctness, path-routing subtleties, origin targets pointing at LAN IPs, noTLSVerify: true hops, unix-socket targets.
4. Origin binding discipline — apps fronted by the tunnel MUST NOT also be reachable directly (wildcard binds, published container ports, missing firewall). Direct-to-origin access skips every Cloudflare protection.
5. Edge-layer controls inventory — WAF, rate limiting, bot fight, Zero Trust Access policies, Service Tokens, mTLS origin pull. These are configured in the Cloudflare dashboard and are INVISIBLE from the host/repo; record them strictly as interview questions.
6. Real visitor IP handling — the application must derive client IP from CF-Connecting-IP while trusting ONLY the Cloudflare/cloudflared proxy addresses; otherwise the value is client-spoofable.
7. Egress interplay — cloudflared needs outbound connectivity (443, plus UDP/7844 QUIC to regional edges); verify the egress-filtering design permits it AND treats Cloudflare ranges as an approved-destination example.
8. Operational hygiene — auto-update posture tradeoffs, metrics endpoint binding, log verbosity leaking sensitive data, multi-tunnel-per-host review, single-replica availability risk, containerized variants.

Out of scope (cross-references): firewall design and default-deny construction → FW/firewall-edge; token lifecycle, storage classes, rotation mechanics → TOK/api-token-security and HSECRET/host-secrets; TLS termination and cache/header behavior at proxies → TLS/tls-proxy; application-level authorization and request-forgery classes → AUTHZ/authz-access-control, PROTO/http-protocol; supply-chain pinning policy → SUPPLY/supply-chain; baseline sandboxing primitives → BASE/linux-baseline.

Operating rules: