phantom, portal, vault

Phantom Notes.md

@@ -176,7 +176,7 @@ sudo vim /etc/yum.repos.d/redhat-rhui.repo
 # Find rhel-7-server-rhui-optional-rpms and change 'enabled' to 1
 sudo yum update
 ```
-Add phantom user to cron allow
+Add phantom user to cron allow ( see salt/cis/rhel7-3_1_1/parameters/id/phantom-0.pvt.xdr.accenturefederalcyber.com.yaml in xdr-cis-benchmarks git repo. )
 `vim /etc/cron.allow` # and add phantom
 
 4. Install the installer

Portal Notes.md

@@ -12,6 +12,8 @@ salt 'customer-portal*' cmd.run 'docker container ls'
 salt 'customer-portal*' cmd.run 'docker restart portal nginx'
 ```
 
+Verify Vault service is running. Logs are sent to Splunk. See Splunk search below in this document. 
+
 ## Deploy Process
 
 For PROD: Stop docker containers on both servers, but upgrade the containers one server at a time. This way you can quickly get the site back up on the previous server. 
@@ -167,7 +169,7 @@ User.objects.filter(email="wesley.a.leonard@accenturefederal.com").delete()
 
 logs are being sent to Splunk. This logging is configured in Salt. 
 
-`index=os source="http*" host="customer-portal-*"`
+`index=os source="journald://docker" host="customer-portal-*"`
 
 Nginx
 ```

Vault Notes.md

@@ -8,14 +8,19 @@ Additional Notes are located here: [msoc-infrastructure - Vault README.md](https
 
 ## How to log into CLI on the Vault server. 
 
-1. login to the web interface
-2. copy token 
-3. run this on vault-1 `vault login`
-4. paste token and login
+- login to the web interface
+- copy token 
+- run this on vault-1 `vault login`
+- paste token and login
+
 
 Auth Error? Try populating the Bash variables.      
 `export VAULT_ADDR=https://vault.pvt.xdrtest.accenturefederalcyber.com`
 
+Connectivity Issue? Try hitting the health endpoint via curl. Unset the proxy variables to avoid using the proxy.
+`env -u http_proxy -u https_proxy -u HTTP_PROXY -u HTTPS_PROXY -u no_proxy -u NO_PROXY curl --insecure https://127.0.0.1/v1/sys/health`
+
+
 1. change made to the service file
 Unknown lvalue 'StartLimitIntervalSec' in section 'Service'