--- sshd_config.factory	2008-09-22 22:14:18 +0400
+++ sshd_config.factory	2008-09-22 22:23:36 +0400
@@ -35,6 +35,7 @@ 
 
 #LoginGraceTime 2m
 #PermitRootLogin without-password
+# -- this policy is extended to group wheel (see a Match below).
 #StrictModes yes
 #MaxAuthTries 6
 
@@ -115,3 +116,7 @@ 
 #	X11Forwarding yes
 #	AllowTcpForwarding no
 #	ForceCommand cvs server
+
+# An extension of the policy "PermitRootLogin without-password":
+Match Group wheel
+    PasswordAuthentication no