restrict ssh config perms