Not entirely sure why but here is where it stands:
- all shell users made cannot be used immediately. Have to deactivate the user then reactive the user, forcing the password update.
- have to manually add the user to sshusers group (adduser foobar sshusers)
- /etc/ssh/sshd_config is required to have AllowGroups sshusers set. This appears not to be set by default.