ssh: tighter settings
key-only means 99% of failures will be illegitimate