yep, and there is soooo many bots on the net bruteforcing ssh logins to root out there... so many distros by default still have root allowed, my hosting service, for example, the password is strong but out of the box a fresh install on a node is on port 22 with root allowed.

I change it, of course, and this is recommended procedure. It makes me nervous to disable root, and then go further and disable password login altogether, in case I break the firewall or SSH configuration and have to start from scratch. But then, I forget that my host has a rescue thing that would let me go in and allow password login again if I lost the certificate.

But yeah, it's gonna be in my guide. I wrote a guide to doing a chemical extraction many years ago (14!). I am going to write a guide to setting up a witness next (maybe next week, depends on priorities and necessity). The only irritating bit is needing to explain the preliminary setup for several distros but once python, pip and docker are installed the rest is the same.