Correct the profile removal and SSH authentication privilege wording (#895)

src/pages/manage/peers/ssh.mdx

@@ -76,11 +76,13 @@ On the machine you want to access via SSH, enable the NetBird SSH server.
 
   On a machine where you do not have those rights, which is the normal case for a
   managed workstation, you cannot enable the SSH server yourself: an administrator
-  has to run the command, or push
-  [`allowServerSSH`](/client/mdm-integration#policy-keys-reference) through MDM,
-  which the client applies itself and so needs nothing from you. A switch that is
-  already on stays operable, because turning these settings off never requires
-  privileges.
+  has to run the command. For the SSH server itself there is also
+  [`allowServerSSH`](/client/mdm-integration#policy-keys-reference), which the client
+  applies from MDM policy and so needs nothing from you; root login and SSH
+  authentication have no policy key and must be set on the machine. A switch already in its safe
+  state stays operable: you can turn the SSH server off, turn root login off, or
+  re-enable SSH authentication without privileges. Only the change that could hand out
+  a shell needs them.
 </Note>
 
 <p>
@@ -98,6 +100,7 @@ sudo netbird up --allow-server-ssh
 For additional SSH server features, use these flags:
 
 ```bash
+sudo netbird down
 sudo netbird up --allow-server-ssh \
   --enable-ssh-local-port-forwarding \
   --enable-ssh-remote-port-forwarding \