Change /etc/ssh/sshd_config. The AllowUsers and Match Address changes made in this example may need adjusting for local requirements:
root@localhost:/etc/ssh# diff sshd_config{.org,}
27c27
< PermitRootLogin yes
---
> PermitRootLogin no
51a52
> PasswordAuthentication no
87c88,100
< UsePAM yes
---
> UsePAM no
>
> # Blue Light changes to improve performance
> UseDNS no
> GSSAPIAuthentication no
> Compression yes
>
> # Blue Light extras
> AllowUsers root
> Match Address 192.168.10.0/24
> PermitRootLogin without-password
> Match Address 10.42.0.1
> PermitRootLogin without-password
Change /etc/default/ssh
root@localhost:/etc/default# diff ssh{.org,}5c5< SSHD_OPTS=---> SSHD_OPTS=-u0
Enable the new configuration by service ssh restart