Ban all SSH commands and let puppet start those

Commands should be idempotent to ensure cluster health over time.