Or you just disable SSH and make them manually enable it after they know the implications of said actions.