.ssh must be own by root