Make sure user services are only run as ceres. Since openssh uses pam login, ssh root@watchIp would open a new systemd user session and start asteroid-launcher or other services as root