diff --git a/README.adoc b/README.adoc
index d1c0c94..0f59855 100644
--- a/README.adoc
+++ b/README.adoc
@@ -30,7 +30,6 @@ If you don't want to wait, you could also try to compile the examples and run th
 After QEMU opens up, you can start playing with the kernel modules:
 
 ....
-root
 insmod /hello.ko
 insmod /hello2.ko
 rmmod hello
@@ -268,7 +267,6 @@ But on the other hand maybe you are interested in observing the interrupts gener
 When debugging a module, it becomes tedious to wait for build and re-type:
 
 ....
-root
 /modulename.sh
 ....
 
@@ -851,8 +849,6 @@ But TODO I don't think you can see where you are in the kernel source code and l
 
 Step debug userland processes to understand how they are talking to the kernel.
 
-First ensure that <<networking>> is enabled.
-
 Then in guest:
 
 ....
@@ -1919,13 +1915,23 @@ We us this exact procedure to connect to <<gdbserver>>.
 
 https://unix.stackexchange.com/questions/124681/how-to-ssh-from-host-to-guest-using-qemu/307557#307557
 
-Uses OpenSSH's `sshd`, enable with the option:
+Not enabled by default due to the build / runtime overhead. To enable, build with:
 
 ....
-BR2_PACKAGE_OPENSSH=y
+./build -B 'BR2_PACKAGE_OPENSSH=y'
 ....
 
-Not enabled by default due to the build / runtime overhead, but it was tested and worked at the time of this commit.
+Then inside the guest turn on sshd:
+
+....
+/sshd.sh
+....
+
+and finally on host:
+
+....
+ssh root@localhost -p 45456
+....
 
 ===== gem5 host to guest networking
 
@@ -3178,6 +3184,34 @@ diff -u .config.olg .config
 
 Then copy and paste the diff additions to link:br2[] to make them permanent.
 
+=== Change user
+
+At startup, we login automatically as the `root` user as explained at: https://unix.stackexchange.com/questions/299408/how-to-login-automatically-without-typing-root-in-buildroot-x86-64-qemu/300152#300152
+
+If you want to switch to another user to test some permissions, we have already created an `user0` user through the link:user_table[] file, and you can just login as that user with:
+
+....
+login user0
+....
+
+and password:
+
+....
+a
+....
+
+Then test that the user changed with:
+
+....
+id
+....
+
+which gives:
+
+....
+uid=1000(user0) gid=1000(user0) groups=1000(user0)
+....
+
 === ccache
 
 We have link:https://buildroot.org/downloads/manual/manual.html#ccache[enabled ccached] builds by default.
diff --git a/build-usage.adoc b/build-usage.adoc
index 4299a2f..4e421b2 100644
--- a/build-usage.adoc
+++ b/build-usage.adoc
@@ -13,7 +13,7 @@
 |`-b` |`BR2_FILE`           | Also use the given Buildroot configuration fragment file.
                               Pass multiple times to use multiple fragment files.
 |`-B` |`BR2_CONFIG`         | Add a single Buildroot option to the current build.
-                              Example: `-B 'BR2_TARGET_ROOTFS_EXT2_SIZE="500M"'`
+                              Example: `-B 'BR2_TARGET_ROOTFS_EXT2_SIZE="512M"'`
 |`-c` |`BR2_FILE`           | Also use the given Buildroot configuration fragment file.
                               Pass multiple times to use multiple fragment files.
 |`-C` |                     | Skip the Buildroot configuration. Saves a few seconds,
diff --git a/rootfs_overlay/etc/inittab b/rootfs_overlay/etc/inittab
index a2fec3b..143927d 100644
--- a/rootfs_overlay/etc/inittab
+++ b/rootfs_overlay/etc/inittab
@@ -8,7 +8,7 @@
 ::sysinit:/etc/init.d/rcS
 # https://unix.stackexchange.com/questions/299408/how-to-login-automatically-without-typing-root-in-buildroot-x86-64-qemu
 #console::respawn:/bin/sh
-console::respawn:/sbin/getty -n -L console 0 vt100
+console::respawn:/sbin/getty -n -L -l /loginroot.sh console 0 vt100
 ::ctrlaltdel:/sbin/reboot
 ::shutdown:/etc/init.d/rcK
 ::shutdown:/sbin/swapoff -a
diff --git a/rootfs_overlay/etc/ssh/sshd_config b/rootfs_overlay/etc/ssh/sshd_config
new file mode 100644
index 0000000..eaf6432
--- /dev/null
+++ b/rootfs_overlay/etc/ssh/sshd_config
@@ -0,0 +1,4 @@
+AuthorizedKeysFile	.ssh/authorized_keys
+Subsystem	sftp	/usr/libexec/sftp-server
+PermitRootLogin yes
+PermitEmptyPasswords yes
diff --git a/rootfs_overlay/gdbserver.sh b/rootfs_overlay/gdbserver.sh
index 5272a5b..ae12295 100755
--- a/rootfs_overlay/gdbserver.sh
+++ b/rootfs_overlay/gdbserver.sh
@@ -1,2 +1,3 @@
 #!/bin/sh
+/sbin/ifup -a
 gdbserver :45455 "$@"
diff --git a/rootfs_overlay/loginroot.sh b/rootfs_overlay/loginroot.sh
new file mode 100755
index 0000000..fe8718b
--- /dev/null
+++ b/rootfs_overlay/loginroot.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /bin/login root
diff --git a/rootfs_overlay/sshd.sh b/rootfs_overlay/sshd.sh
new file mode 100755
index 0000000..5729e09
--- /dev/null
+++ b/rootfs_overlay/sshd.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+/sbin/ifup -a
+/usr/bin/ssh-keygen -A
+/usr/sbin/sshd
diff --git a/rootfs_post_build_script b/rootfs_post_build_script
index 570fc37..3edc4c7 100755
--- a/rootfs_post_build_script
+++ b/rootfs_post_build_script
@@ -15,4 +15,5 @@ rm -rf \
   "${target_dir}/etc/init.d/S01logging" \
   "${target_dir}/etc/init.d/S20urandom" \
   "${target_dir}/etc/init.d/S40network" \
+  "${target_dir}/etc/init.d/S50sshd" \
 ;
diff --git a/run b/run
index 7b9364a..8cbe7c0 100755
--- a/run
+++ b/run
@@ -165,7 +165,7 @@ ${debug_vm} \
 -gdb tcp::1234 \
 -m ${memory} \
 -monitor telnet::45454,server,nowait \
--netdev user,hostfwd=tcp::45455-:45455,id=net0 \
+-netdev user,hostfwd=tcp::45455-:45455,hostfwd=tcp::45456-:22,id=net0 \
 -smp ${cpus} \
 -virtfs local,path=9p,mount_tag=host_scratch,security_model=mapped,id=host_scratch \
 -virtfs local,path=${out_dir}/build,mount_tag=host_out,security_model=mapped,id=host_out \