NoMachine hardening

NoMachine provides the graphical administration path to the Rocky Linux host. Network access stays behind WireGuard, and login uses two steps: the user's normal system password followed by a time-based one-time password.

trusted private network
        |
        v
NoMachine NX
        |
        v
system password
        |
        v
PAM
        |
        v
TOTP

The TOTP requirement is an additional service-authentication boundary rather than a substitute for private network exposure controls.

Explicit firewall ownership

NoMachine's automatic firewall configuration is disabled with EnableFirewallConfiguration 0, leaving the intended private access rules under explicit firewalld policy. This setting controls automatic firewall changes; it does not disable the graphical service or its password/TOTP checks, and existing firewall allowances still need separate review.

After a host reboot, NoMachine port allowances reappeared in the active public zone even though the saved public policy excluded them. The difference was observable without knowing which process wrote the rules. After automatic firewall management was disabled, the unwanted runtime allowances were removed and NoMachine was restarted. The active and saved public port lists agreed after the restart and on the following day. The security report checks that agreement alongside listening services.

Changing this option requires a NoMachine restart, which terminates running sessions according to the NoMachine configuration reference. An independent administration path is therefore needed when applying it. Service startup, a fresh private login and the firewall state are separate checks; a successful service restart alone does not establish the exposure boundary after a host reboot.

Separate PAM boundary

NoMachine and SSH do not share the same first-factor policy. SSH requires a public key and uses PAM only for its TOTP step. NoMachine retains its normal password-backed authentication and adds pam_google_authenticator afterward through NoMachine's own PAM service definition.

The two services do share the same per-user TOTP enrollment. This avoids maintaining two authenticator entries for the same host account while keeping the service-specific first factors independent. A TOTP rotation therefore affects both private administration paths.

SELinux-aware TOTP state

The authenticator state lives in a private per-user directory labeled auth_home_t. The label applies to the directory as well as the secret file so replay-protection and rate-limit updates can create temporary sibling files without weakening SELinux.

This is the same state location used by SSH. SELinux remains enforcing; authentication failures caused by labeling or write policy are diagnosed rather than bypassed.

Lockout-safe rollout

PAM changes are made while an already-authenticated NoMachine session remains open. A completely fresh client connection must then complete the full password-plus-TOTP sequence before the original session is closed.

That test distinguishes a real new authentication from an existing desktop session that merely remained connected through the configuration change. It also preserves a recovery path for PAM mistakes, authenticator mismatches, or SELinux labeling problems.

Layered administration model

The resulting private administration paths are intentionally different:

WireGuard -> SSH       -> public key      -> TOTP
WireGuard -> NoMachine -> system password -> TOTP

The intended firewall policy admits these connections through WireGuard. Each service then checks its own first factor before the shared TOTP step. A successful private login exercises authentication. Inspecting the active public firewall rules answers the separate question of exposure.