As per security best practices one should not allow root login over SSH with password or keys. Instead, sudo should be used.
However, if one wants to use SSH (SFTP) for remote editing of server configuration files, like ones living in /etc (Apache, Cron, you name it), how this should be done?
Can root-accesible file remote editing over SFTP be compatible with the security best practices
How one should set file permissions, user groups and such that the security best practices are followed
Currently I use passphrase protected public key authentication to login as root, but I am not sure if there is something more secure I could do, so that root facing SSH logins could be disabled altogether.
The server is Ubuntu 12.04.