hopefully avoids some logic gaps where lock-down didn't happen
PermitRootLogin
sshd_config
it was only being set if the setting existed
mostly as-is, taken from `rattail.fablib` subpackage