- iptables geoip whitelist for ssh - NOPASSWD for efibootmgr, allowing easy reboot into windows from laptop/phone - no fastfetch for remote shells