Security

Understand Monarch's firewall, authentication options, SSH hardening, and privileged-access controls.

Monarch ships with a deny-by-default host firewall and provides setup flows for fingerprint, FIDO2, and SSH key authentication.

Firewall

UFW is enabled by default with these baseline rules:

• deny unsolicited incoming connections;
• allow outgoing connections;
• allow LocalSend on TCP and UDP port 53317;
• apply firewall integration for Docker networking.

Inspect the active rules with:

sudo ufw status verbose

Authentication

Open Monarch Menu → Settings → Security.

Option	What it configures
Fingerprint	Fingerprint authentication for sudo, polkit prompts, and the Noctalia lock screen
FIDO2	A hardware security key for sudo and polkit prompts
SSH Server	OpenSSH with authorized keys, password authentication disabled, and a rate-limited UFW rule
Sudoless Docker	Persistent direct access to the root Docker daemon
Mask Chat Windows	Hide common messaging windows from Niri screen captures; see Screen sharing privacy

The fingerprint entry is only shown when compatible hardware is detected. Password authentication remains available as a fallback for local authentication.

SSH setup can authorize a pasted public key or fetch the public keys attached to a GitHub account:

monarch setup security sshd --gh-keys <github-username>

The setup refuses to start an unfiltered SSH server when UFW is missing or inactive.

To remove an authentication feature, open Monarch Menu → Software → Remove software → Security.

Passwordless sudo

Actions → Toggle → Passwordless Sudo temporarily lets every process running as your user execute commands as root without a password. The default duration is 15 minutes, it can be disabled early by running the action again, and a reboot removes the rule.

From a terminal, choose a duration in minutes:

monarch sudo passwordless 10

During that window, a compromised application, script, or AI agent in your session has unrestricted root access. Enable it only for a short, supervised task.

Sudoless Docker

Sudoless Docker adds your account to the persistent docker group and takes effect after a reboot. It lets any process in your session control the root Docker daemon, mount the host filesystem, and effectively take over the machine without another authentication prompt.

Membership in the Docker group is root-equivalent. Keep Monarch's authenticated Docker workflow unless you specifically need persistent direct access and accept that security model.