Unlike listing individual restrictions and missing any new capabilities
that get added to sshd, this is future proof.