on post-fs-data
mkdir /data/ssh 0750 root shell encryption=Require
mkdir /data/ssh/empty 0600 root shell