change the way sshd is configured

* use lineinfile for all things we care about
* disable root login via ssh
  * search for any existing PermitRootLogin instances
  * if found, replace with 'PermitRootLogin no', if not add
    'PermitRootLogin no' at the end of the file
* disable password authentication
* make sshd listen to public ip only
* enable sftp subsystem