> For the complete documentation index, see [llms.txt](https://docs.monarchlinux.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monarchlinux.com/system/security.md).

# Security

Understand Monarch's firewall, authentication options, SSH hardening, and privileged-access controls.

Monarch ships with a deny-by-default host firewall and provides setup flows for fingerprint, FIDO2, and SSH key authentication.

## Firewall

UFW is enabled by default with these baseline rules:

* deny unsolicited incoming connections;
* allow outgoing connections;
* allow LocalSend on TCP and UDP port 53317;
* apply firewall integration for Docker networking.

Inspect the active rules with:

```bash
sudo ufw status verbose
```

## Authentication

Open **Monarch Menu → Settings → Security**.

| Option                | What it configures                                                                                                               |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Fingerprint**       | Fingerprint authentication for `sudo`, polkit prompts, and the Noctalia lock screen                                              |
| **FIDO2**             | A hardware security key for `sudo` and polkit prompts                                                                            |
| **SSH Server**        | OpenSSH with authorized keys, password authentication disabled, and a rate-limited UFW rule                                      |
| **Sudoless Docker**   | Persistent direct access to the root Docker daemon                                                                               |
| **Mask Chat Windows** | Hide common messaging windows from Niri screen captures; see [Screen sharing privacy](/everyday-tasks/screen-sharing-privacy.md) |

The fingerprint entry is only shown when compatible hardware is detected. Password authentication remains available as a fallback for local authentication.

SSH setup can authorize a pasted public key or fetch the public keys attached to a GitHub account:

```bash
monarch setup security sshd --gh-keys <github-username>
```

The setup refuses to start an unfiltered SSH server when UFW is missing or inactive.

To remove an authentication feature, open **Monarch Menu → Software → Remove software → Security**.

## Passwordless sudo

**Actions → Toggle → Passwordless Sudo** temporarily lets every process running as your user execute commands as root without a password. The default duration is 15 minutes, it can be disabled early by running the action again, and a reboot removes the rule.

From a terminal, choose a duration in minutes:

```bash
monarch sudo passwordless 10
```

{% hint style="danger" %}
During that window, a compromised application, script, or AI agent in your session has unrestricted root access. Enable it only for a short, supervised task.
{% endhint %}

## Sudoless Docker

Sudoless Docker adds your account to the persistent `docker` group and takes effect after a reboot. It lets any process in your session control the root Docker daemon, mount the host filesystem, and effectively take over the machine without another authentication prompt.

{% hint style="danger" %}
Membership in the Docker group is root-equivalent. Keep Monarch's authenticated Docker workflow unless you specifically need persistent direct access and accept that security model.
{% endhint %}