By default OS X ships with the root user set so you can't login. Many people know that you assign a password to the root user and viola you can now login. What is disappointing is that Apple by default does not configure SSH to prevent REMOTE login by root. It's a simple configuration change to the /etc/sshd_config file. There are two ways to do it. I prefer to add the following line:

AllowUsers      username

There is also the possibility of using DenyUsers and putting root in that list, but by using AllowUsers you further limit who has access.