sshd: disallow password login unless from the local network