[yocto] how to disable shell access

[Insop Song]

All,

We usually want to block shell access for the product that we release,
but want to have a way to log in for debugging and troubleshoot.

I want to ask how other developers are doing this.

So two main questions:

1. how to change the default password of root?

2. how to block shell access but to open for debugging access
For this, I could think of that we could block ssh access and only open console.
Or opening ssh for a hidden port only.

I look forward to hearing from your experiences.

Thank you,

ISS