Crying wolf over OpenSSH

The thing I find missing for ssh is an easy way to say that only a subset of users on the machine can do remote ssh logins. I have machines with lots of users, but only a few of those need to do remote ssh. And of course those machines are hammered by brute-force attacks all the time, so restricting possible valid logins to the people who know what they are doing and can be relied-upon to have strong passwords would be a huge help.

The normal install is an everyone or nobody affair.