systemd unit runs a tunneling tool
What this means
The systemd unit “‹unit name›” runs a command referencing a tunneling tool (“‹exec start›”). A reverse tunnel that reaches back out through a service like ngrok or cloudflared survives reboots and bypasses inbound firewall rules entirely, since it's an outbound connection — which is why it's both a legitimate way to expose a service and a common attacker persistence pattern. The two look identical from here, so this is high rather than critical: if you deliberately installed cloudflared, autossh, or a similar tunnel, this is expected and you can accept the risk for this rule.
How to fix it
If you didn't set this up yourself: systemctl disable --now <unit> and remove the unit file from /etc/systemd/system/, then rotate any credentials the box had access to.
Check it yourself
Run a scan and look for BLWK-PERSIST-001 in the results:
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads systemd_units and reports this check when:
exec_start matches "ngrok|cloudflared|serveo|localtunnel|ssh -R"If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
Related checks
- Shell history recording is suppressed ·
BLWK-EVASION-001 - File modified since baseline: ‹path› ·
BLWK-FIM-001 - File deleted since baseline: ‹path› ·
BLWK-FIM-002 - Not covered by the file-integrity baseline: ‹path› ·
BLWK-FIM-003 - Credential file modified since baseline: ‹path› ·
BLWK-FIM-004 - Credential file deleted since baseline: ‹path› ·
BLWK-FIM-005