add new state for benchmark minion

salt/benchmarks/configs/sshd-hardening.conf

@@ -0,0 +1,17 @@
+# Forbid any root SSH login
+PermitRootLogin no
+
+# Only allow public key auth for all users
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+PubkeyAuthentication yes
+
+# Restrict who can SSH in - allow PSF users and system admins
+AllowGroups psf-users sudo admin
+
+# Where to read user keys from
+AuthorizedKeysFile .ssh/authorized_keys
+
+# Keep PAM enabled for account/session modules (e.g., limits)
+UsePAM yes

salt/benchmarks/init.sls

@@ -0,0 +1,13 @@
+/etc/ssh/sshd_config.d/99-hardening.conf:
+  file.managed:
+    - source: salt://benchmarks/configs/sshd-hardening.conf
+    - user: root
+    - group: root
+    - mode: "0644"
+
+ssh-reload-benchmarks:
+  service.running:
+    - name: ssh
+    - reload: True
+    - watch:
+      - file: /etc/ssh/sshd_config.d/99-hardening.conf

salt/top.sls

@@ -36,6 +36,10 @@ base:
     - pgbouncer
     - buildbot
 
+  'benchmarks':
+    - match: nodegroup
+    - benchmarks
+
   'cdn-logs':
     - match: nodegroup
     - cdn-logs