You need to install the dropbear-ssh package. That provides an SSH server which is password protected and allows you to disable the telnet server (from the web interface settings page). The default root password is humax and changing it requires a bit of work at the moment - you need to update the /mod/etc/dropbear/passwd file to insert a new password hash (or it could be the shadow file - can't remember offhand). Someone should write an update to the package to allow for simpler password changes.
Is that a dropbear specific thing? In my experience of other Linux-based devices (namely a certain fruit/pastry related one!), which has SSH as standard, you just log in with the default password, then use the passwd command to change it.