Should lock down ssh to the bastion only.