only open ssh by default if we're not going to define specific permissions for it later