SSH and SNMP Blocked

[mikeytag]

I am attempting to restrict access to servers in my farm and as a test
attempted the following with just one instance.
I first changed my "default" group to include the
following:

user: 919814621061
group: scalr-ssh2

and

user: 919814621061
group: scalr-snmp

I was assuming this would make sure that Scalr could access ssh and
snmp even if I block it from the security group. However upon doing
this Scalr immediately loses SNMP contact with the instance, and a
"Synchronize to All" shows that SSH is blocked as well because I got
this error:

Apr 3 22:14:45 ec2-72-44-39-234 logger: SCALR(instance-init.sh):
ec2_submit_event(hostInit): Cannot upload keys on 'i-9e3c5cf7'. Failed
to connect to '72.44.39.234:22'.

So, any ideas from the amazing Scalr devs would be excellent. I don't
mind if I have to put a bunch of static ips into my default security
group for Scalr. I think you guys are hosted at The Planet right? I am
assuming you probably have static ips. However, some kind of fix that
doesn't require ips would be excellent, because it would have to
constantly be updated as you guys added/removed servers etc.

Any ideas?

[Alex Kovalyov]

Our lead developer claims userid:group rules stopped working couple
months ago. We're going to file this issue in AWS forums. Until then,
if you have an evidence of a working userid:group rule invocation,
please share :)

Current IPs of Scalr servers that you can expect connections from are
174.132.108.66 and 174.132.97.130

[mikeytag]

Thank you soooo much Alex. I will implement the ip check now.
The only userid:group roles that I do see working are my default ones
because if I start up a server in another farm, but in my account I
have access to all ports.
I'll try to do some more testing though.
Thanks,
Mike

[Alex Kovalyov]

174.129.220.222 must also be added if you want scalr to collect stats
for your farm.

On 7 апр, 23:58, mikeytag <mikey...@gmail.com> wrote:

[kenja]

Alex,

Has there been any update from the AWS forums? I'd like to lock down
my farm, too, but I hate to do it with an IP check, as that is likely
to break the farm at some point in the future.

Thanks,
Ken

[mikeytag]

Thanks Alex. I updated my security group with the new ip. Any word on
the userid:group rules?

On Apr 8, 2:06 pm, Alex Kovalyov <alex.koval...@gmail.com> wrote:

[kenja]

So Mikey -

Are you just adding those three IPs to each security group for ports
22 and 161-162? Then deleting the 0.0.0.0/0 permission? Have you
tested it to make sure it scales okay?

I hate to do that as it is sure to break the farm at some point, but
hopefully the dev team will fix the userid:group permissions soon.

Kenja