As specified in man xdm, I tried setting xlogin.Login.allowRootLogin: false in /etc/X11/xdm/Xresources but it doesnt work; root can still login via xdm.