Do not allow root to login via ssh using a password. While we already have measures in place to make it difficult to setup password based login via ssh, this adds another layer addressing the root user. Cloud instances should only used key based login.
Depending on the protocol version for SSH we need to set either ChallengeResponseAuthentication or KbdInteractiveAuthentication to "no". Prior to this change we only set ChallengeResponseAuthentication allowing password based login when the SSHv2 protocol is used. We now modify newer config files appropriately.