cloudflare / cloudflare/cloudflared

Reduce cloudflared service priveleges on linux💡

Open
#1,276 0 comments 5 reactions 0 assignees View on GitHub
Priority: Normal Type: Feature Request
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the feature you'd like**
I think having the linux services (at least for cloudflared) to run at reduced privileges, rather than root.
At a minimum I think The following params should be added to the service though adding others from the service file example would be preferable
Environment="TUNNEL_TOKEN=" - Move the Tunnel token out of the command line which keeps it out of `ps`
DynamicUser=true - Has systemd create a user on service start

I have the below running in production successfully on many RHEL 8 and 9 machines
https://github.com/flpydsk/cloudflared-configs/blob/master/cloudflared.service

The goal of this is to reduce the attack surface and unnecessary priveleges

**Describe alternatives you've considered**
I already use my own services, I am of the opinion that having all the services run in this way is a good idea

**Additional context**
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.