Unconditionally forbid root SSH login
Disable X11 forwarding

See
<https://security.stackexchange.com/questions/14815/security-concerns-with-x11-forwarding>.
Document SSH daemon configuration