More important is to routinely rotate strong root passwords. What most people neglect to mention, when denying root access to an SSH server, is that people then login with a second account, (you still need ssh), and then su - to root. So, all you've really done is moved the difficultly in logging onto the server from the root account, to the secondary account+root account. Your security is now based on the strength of that bi-pair of passwords. As others have mentioned, moving logins to RSA keys (very easy) is probably a better approach.