I always make a dedicated sudo (admin) user on every server I administer. That way you can SSH in as that user, then sudo or sudo -s to root for any tasks that need elevated privileges. But then you don't have to PermitRootLogin in your SSH configuration. Unfortunately, you won't be able to login to CWP as that sudoer.