>prevent logins period, except via ssh keys. > That's also much more convenient. No fuss, no mess. :-)