port some minor tweaks from tboerger's minimal box
require acceptance of EULA on first ssh