disallow ssh from the outside, except for to tower server

[mglantz]

No description provided.

[teemu-u]

Done e4d5889

[mglantz]

As it turned out, Amazon does not allow public IP addresses as sources, this complicates the lab instructions. We'll have to give it some thought about how to solve this without complicating the lab instructions too much.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html
"When you specify a security group as the source or destination for a rule, the rule affects all instances associated with the security group. Incoming traffic is allowed based on the private IP addresses of the instances that are associated with the source security group (and not the public IP or Elastic IP addresses). "

[teemu-u]

Needs some refactoring on the lab environment and instructions