Would be nice to be able to prevent users from having ssh access, forcing them to be used via console only for disaster recovery scenarios. ( In our environment we don't want the vyos user to be used on a day-to-day basis but do want it for emergency console logins )
This can be done by adding all users to the AllowGroups option in sshd_config except for those that have a 'disable-ssh-access' flag set.