Should definitely block .ssh reading too...