It is desireable to allow root logins from within the local network, but not from outside. Please add new option: PermitRootLoginListenAddress That would restrict root logins only from specific addresses (CIDR)
Check the sshd_config(5) man page and look for the 'Match' keyword.
Mass move of RESOLVED bugs to CLOSED now that 5.3 is out.