Leave the default sshd alone. If ssh is not necessary in default VRF, another role should disable it.