By default, the root user is able to SSH to each appliance in the Filr system. You can disable this access on each appliance so that only the vaadmin user can SSH to the system.
See Changing Passwords and SSH Access for vaadmin and root
in the Filr 3.4.1: Administrative UI Reference.