Right now, the documentation is written to suggest that using the web console requires allowing SSH connections from literally anywhere. That can't possibly be true. There should be an easy way to leave SSH firewalled off, other than from the web console.