sshd PermitRootLogin no
sudo group - doesn't need a passwd