Ack... sshd does not use login by default. Well crap, but at least the process (and possibly filesize) restrictions are in effect, which will be good enough. I might play with UseLogin to see if that adds the extra layer to the onion. Thanks, Hans and George.