NoMachine hardening

NoMachine provides the graphical administration path to the Rocky Linux host. Network access stays behind WireGuard, and login uses two steps: the user's normal system password followed by a time-based one-time password.

trusted private network
        |
        v
NoMachine NX
        |
        v
system password
        |
        v
PAM
        |
        v
TOTP

The TOTP requirement is an additional service-authentication boundary rather than a substitute for private network exposure controls.

Separate PAM boundary

NoMachine and SSH do not share the same first-factor policy. SSH requires a public key and uses PAM only for its TOTP step. NoMachine retains its normal password-backed authentication and adds pam_google_authenticator afterward through NoMachine's own PAM service definition.

The two services do share the same per-user TOTP enrollment. This avoids maintaining two authenticator entries for the same host account while keeping the service-specific first factors independent. A TOTP rotation therefore affects both private administration paths.

SELinux-aware TOTP state

The authenticator state lives in a private per-user directory labeled auth_home_t. The label applies to the directory as well as the secret file so replay-protection and rate-limit updates can create temporary sibling files without weakening SELinux.

This is the same state location used by SSH. SELinux remains enforcing; authentication failures caused by labeling or write policy are diagnosed rather than bypassed.

Lockout-safe rollout

PAM changes are made while an already-authenticated NoMachine session remains open. A completely fresh client connection must then complete the full password-plus-TOTP sequence before the original session is closed.

That test distinguishes a real new authentication from an existing desktop session that merely remained connected through the configuration change. It also preserves a recovery path for PAM mistakes, authenticator mismatches, or SELinux labeling problems.

Layered administration model

The resulting private administration paths are intentionally different:

WireGuard -> SSH       -> public key      -> TOTP
WireGuard -> NoMachine -> system password -> TOTP

WireGuard limits where management services are reachable. Each service then applies its own first factor before reaching the shared TOTP boundary. Neither service is exposed directly through the public firewalld zone.