allow ssh in base profile but not workstation unless virtualized