sudo sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

sed edits the file in place (-i): the pattern ^#PermitRootLogin.* matches the commented-out default line and rewrites it as PermitRootLogin no, which refuses direct root logins. Admins then use a normal user plus sudo instead, so brute-forcing root becomes pointless. Run sudo sshd -t and restart ssh afterward.