{...}: {
    services.openssh.enable = true;
    services.openssh.permitRootLogin = "prohibit-password";
}