Strict root access can be necessary for taking backups and so on, but can be very dangerous thing to have. Luckily the direct root access can be secured quite a bit by using ssh keys and authorized_keys file.
First of all, allow the root login in sshd_config but allow it only to execute the predefined set of commands: put
PermitRootLogin forced-commands-only to /etc/ssh/sshd_config or wherever your sshd config is stored. This disables password authentication for root, forces it to use ssh keys and even then only allows the commands you defined.
Then login to your client which needs to has this direct root access, and create there a new ssh key:
ssh-keygen -t rsa. Make that key passwordless if needed by scripts.
Next, copy this newly created ssh key to your server with
ssh-copy-id -i ~/.ssh/id_rsa.pub root@yourserver (if root login is still enabled), if not, just copypaste the contents ~/.ssh/id_rsa.pub to
Now, let's assume your client needs to run
/root/bin/startup_skynet.sh as root via ssh. Your existing authorized_keys file looks something like this at this point:
Modify it to be
no-pty,no-X11-forwarding,no-agent-forwarding,no-port-forwarding,command="/root/bin/startup_skynet.sh" ssh-rsa FASBFAFfasdföjasfABGVEAGUPEGDJfsadnö2314235dfbösadköjsdfösdklf==
and save it.
Then try to execute from your client something like
ssh root@myserver ls - this should fail. Then go on and execute
ssh root@myserver /root/bin/startup_skynet.sh - now this should work.
This way direct root logins can be much more secure. As security is a layered thing and not something a single feature would provide, you can still do more. If you have a limited subset of users who need to connect, you might as well use
AllowUsers parameter in sshd_config to allow connection from a predefined set of ip addresses, something like
AllowUsers email@example.com firstname.lastname@example.org johndoe would allow root from 192.168.1.2 and 192.168.1.3 and johndoe from everywhere.