If you have login on your console or ssh, you can edit the file /etc/wfe/conf/settings. Change the reset_pwd value from 0 to 1. When you login via WebAdmin the next time, the initial licence agreement screen is displayed.There you can change all passwords. By the way, it is not possible to login via ssh as root. YOu only can login withe the loginuser and make su - to become root.
You can't login as root on SSH; you can su to root...
SSH is not enabled by default
Since you have access to much of the OS, you can tune the security to whatever your stringent requirements are (Email alerts when something gets changed, can only login during certain times, etc.)