PermitRootLogin no

{% if ssh_root_authorized_ips is defined %}
{% for ip in ssh_root_authorized_ips %}
Match Address {{ ip }}
  PermitRootLogin prohibit-password
{% endfor %}
{% endif %}