Disable root ssh

**1. What is the goal of these changes?**

This will replace #69.

**2. List the machine(s) and file(s)/setting(s) to be changed**
The production server. See below for files.

**3. Give exact commands or use marked screenshots to show GUI-based changes**
1. Log into server via ssh, as root
2. Create a normal user account: `adduser username`. Set a strong password. Record the username and password in the "password safe".
3. Add the new user to the `sudo` group: `usermod -a -G sudo username`
4. Edit `/etc/ssh/sshd_config` to change `PermitRootLogin yes` to `PermitRootLogin no` and to include `AllowUsers username`
5. Run `service ssh restart`. *Important: it is now impossible for root to open an ssh session to the server. Do **not** close the current root session until the results are complete and verified. We would be locked out of the server.*
6. Open another SSH session using the new username/password. Run `su -` and then `whoami` to verify ability to assume root privileges.
7. If the user successfully became root in the previous step, close the root ssh session.

**4. What production services will be affected by the changes?**
*The accessibility with the new login you give the server.

**5. What files or other data should be backed up before making these changes?**
Verify that an up-to-date full system backup (Acronis) is available.

**6. Approximately how long will it take to make the changes?**
It should take to long to fix these changes only if you don't logout of the root ssh server.

**7. List steps for testing that the goal is met, and nothing was broken**
Verify that root can no longer ssh into the server. (Due to the dangerous nature of changes, much was already verified under step 3 above.

**8. List steps for safely backing out of these changes in case of difficulties**
If we lock ourselves out of the server, restoring a full system backup would put as back as before.

**9. Summarize the messages to be sent to customers and/or staff before, during (if needed), and after these changes**
Just an ops log update to staff.