Debian security: need recipe for blocking root ssh access AND all ssh password access

[Tom Browder <tom.browder@gmail.com>]

I have several remote Debian 7 servers and would like to secure it in
the following manner:

1. root will not be allowed any external access (access is only via a
user becoming root while logged in)

2. after initial setup, no ssh access will be allowed via a password

I have seen much documentation on securing such a host, but I don't
want to be an expert--I just need a recipe.

Many thanks.

Best regards,

-Tom