diff --git a/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh b/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
index f6e28b37..9cbfac66 100644
--- a/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
+++ b/confluent_osdeploy/suse16/profiles/server/scripts/prechroot.sh
@@ -26,12 +26,7 @@ if [ -e "$instnmcfg" ]; then
 	cp $instnmcfg /mnt/etc/NetworkManager/system-connections/
 fi
 
-#run_remote setupssh.sh
-cp /etc/ssh/ssh*key* /mnt/etc/ssh/
-mkdir -p /mnt/etc/ssh/sshd_config.d/
-cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
-mkdir -p /mnt/root/.ssh/
-cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+run_remote setupssh.sh
 
 echo Port 22 >> /etc/ssh/sshd_config.d/00-chroot.conf
 echo Port 2222 >> /etc/ssh/sshd_config.d/00-chroot.conf
diff --git a/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh b/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh
new file mode 100644
index 00000000..ad4c1bde
--- /dev/null
+++ b/confluent_osdeploy/suse16/profiles/server/scripts/setupssh.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Carry over install-time ssh material into installed system
+
+mkdir -p /mnt/root/.ssh/
+chmod 700 /mnt/root/.ssh/
+cp /root/.ssh/authorized_keys /mnt/root/.ssh/
+chmod 600 /mnt/root/.ssh/authorized_keys
+cp /etc/ssh/ssh*key* /mnt/etc/ssh/
+mkdir -p /mnt/etc/ssh/sshd_config.d/
+# pre.sh put the host certificates confluent signed into this drop-in
+cp /etc/ssh/sshd_config.d/20_hostkeys.conf /mnt/etc/ssh/sshd_config.d/
+# the initramfs wrote the confluent CA into the installer's known hosts
+cp /etc/ssh/ssh_known_hosts /mnt/etc/ssh/
+
+# Enable ~/.shosts, for the sake of root user, who is forbidden from using shosts.equiv
+cat >> /mnt/etc/ssh/sshd_config.d/90-confluent.conf << EOF
+IgnoreRhosts no
+HostbasedAuthentication yes
+HostbasedUsesNameFromPacketOnly yes
+EOF
+
+sshconf=/mnt/etc/ssh/ssh_config
+if [ -d /mnt/etc/ssh/ssh_config.d/ ]; then
+    sshconf=/mnt/etc/ssh/ssh_config.d/01-confluent.conf
+fi
+echo Host '*' >> $sshconf
+echo "    HostbasedAuthentication yes" >> $sshconf
+echo "    EnableSSHKeysign yes" >> $sshconf
+# Limit the attempts of using host key. This prevents client from using 3 or 4
+# authentication attempts through host based attempts
+echo "    HostbasedKeyTypes *ed25519*" >> $sshconf
+
+# In SUSE platform, setuid for ssh-keysign is required for host based,
+# and also must be opted into. 16 moved the helper to libexec.
+keysign=/usr/libexec/ssh/ssh-keysign
+if [ ! -e /mnt$keysign ]; then
+    keysign=/usr/lib/ssh/ssh-keysign
+fi
+echo $keysign root:root 4711 >> /mnt/etc/permissions.local
+chmod 4711 /mnt$keysign
+
+# Download list of nodes from confluent, and put it into shosts.equiv (for most users) and .shosts (for root)
+python3 /opt/confluent/bin/apiclient /confluent-api/self/nodelist | sed -e 's/^- //' > /mnt/etc/ssh/shosts.equiv
+cp /mnt/etc/ssh/shosts.equiv /mnt/root/.shosts