Root login shouldn't be your normal entrance. For maintenance stuff use sudo-capable regular user account with public key authentication. If there's some software that requires root login and you cannot do anything about it, enable root login and allow it only from the specific IPs.