It should be possible to call Propellor.Property.Ssh.permitRootLogin with "forced-commands-only" and "without-password", in addition to "True" or "False". It requires to change the type of the function (and maybe to create a new datatype?)...
permitRootLogin :: Bool -> Property NoInfo