--- orig/etc/ssh/sshd_config.sed
+++ mod/etc/ssh/sshd_config.sed
@@ -9,3 +9,9 @@
     s/^#//
     s/yes$/no/
 }
+
+# do not allow root login with password
+/^#\?PermitRootLogin[[:space:]]\+/ {
+    s/^#//
+    s/yes$/without-password/
+}
