To whitelist password logins in ssh you can match username and give them yes after you set no (for all). But i see no reason for password logons in ssh, console is safe enough (for me).

Right - so console/tty login is restricted by pam and its settings. So disabling ssh root logins means you can still log in as root there.

To lock root you can use passwd -l

If locking root I would keep root shell so i could sudo to root.

So my normal setup would be to create my admin user with sudo rights, set «PasswordAuthentication no» in sshd config and lock root with «sudo passwd -l root» Remember to add a pubkey to admin users authorizedkeys, and give it a secure but typable password

My root is now only available through sudo, and i can use password on console. Instead of locking root you can give it secure typable password. This way root can log in from console so you dont need sudo for root access from console.

It boils down to what you like and what risks you take compared to usable system. You can always recover a locked root account if you have access to single-user-mode or a live cd . Disk encryption makes livecd a difficult option.

Just turn off password logins from anything but console. For all users. No matter where it runs.

It becomes second to nature pretty fast, but you should have a system for storing / rotating keys.