Yeah, it's pretty common practice to disable the root account from SSH access/never log in as root.

Linode has a pretty good getting-started guide for basic Ubuntu VPS security: http://library.linode.com/securing-your-server