Comment 1 for bug 25570

From /usr/share/doc/openssh-server/README.Debian.gz:

========================================================================
PermitRootLogin set to yes
--------------------------

This is now the default setting (in line with upstream), and people
who asked for an automatically-generated configuration file when
upgrading from potato (or on a new install) will have this setting in
their /etc/ssh/sshd_config file.

Should you wish to change this setting, edit /etc/ssh/sshd_config, and
change:
PermitRootLogin yes
to:
PermitRootLogin no

Having PermitRootLogin set to yes means that an attacker that knows
the root password can ssh in directly (without having to go via a user
account). If you set it to no, then they must compromise a normal user
account. In the vast majority of cases, this does not give added
security; remember that any account you su to root from is equivalent
to root - compromising this account gives an attacker access to root
easily. If you only ever log in as root from the physical console,
then you probably want to set this value to no.

As an aside, PermitRootLogin can also be set to "without-password" or
"forced-commands-only" - see sshd(8) for more details.

DO NOT FILE BUG REPORTS SAYING YOU THINK THIS DEFAULT IS INCORRECT!

The argument above is somewhat condensed; I have had this discussion
at great length with many people. If you think the default is
incorrect, and feel strongly enough to want to argue with me about it,
then send me email to <email address hidden>. I will close bug reports
claiming the default is incorrect.
========================================================================

I agree with Matthew on this and will not be changing the upstream default in
our packages. Sorry. You're of course welcome to change it on your own systems.

(With regard to your comments, the delay on failed login attempts generally
makes dictionary attacks on anything but the worst root passwords impractical;
and no, PermitEmptyPasswords does not let you log in when the root password is
*locked* as opposed to empty, as it is by default.)