on post-fs-data
    mkdir /data/ssh 0750 root shell encryption=Require
    mkdir /data/ssh/empty 0600 root shell