• Add Remote SSH User to PSMP server
• PSMPAPP_ account Authentication Failure and PSMP disconnected

Control PSMPSRV service

/etc/init.d/psmpsrv {start|stop|restart|status} [{psmp|psmpadb}]

Add Remote SSH User to PSMP Server

2 Add the following parameter to the file:
PSMP_MaintenanceUsers <username>,<username>

This example will allow the following administrative users: user1, all users that end with "user2", all users that starts with "user3" and all users that include "user4".
PSMP_MaintenanceUsers <user1>,<*user2>,<user3*>,<*user4*>

3 Save the changes and close the sshd_config configuration file. 

4 Create a new user and assign it to wheel group

useradd root1

passwd root1

usermod -aG wheel root1

5 Restart the sshd service for these changes to take affect:

/etc/init.d/sshd restart 

5 After logged in with root1, Sudo -i to switch to root account.

Note: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Administrating-the-PSMP.htm?Highlight=PSMP%20administration

PSMPAPP_ account Authentication Failure and PSMP disconnected

[root@psmp conf]# vi /etc/opt/CARKpsmp/conf/basic_psmpserver.conf
[Main]
PSMPServerVaultFile="/etc/opt/CARKpsmp/vault/vault.ini"
PSMPServerCredFile="/etc/opt/CARKpsmp/vault/psmpappuser.cred"
PSMPServerGWCredFile="/etc/opt/CARKpsmp/vault/psmpgwuser.cred"
LogsFolder="/var/opt/CARKpsmp/logs"
LocalParmsFileFolder="/var/opt/CARKpsmp"
TempFolder="/var/opt/CARKpsmp/temp"
PSMPConfigurationSafe="PVWAConfig"
PSMPConfigurationFolder="Root"
PSMPPVConfigurationFileName="PVConfiguration.xml"
PSMPPoliciesConfigurationFileName="Policies.xml"
PSMPServerId="PSMPServer"
PSMPTempFolder="/var/opt/CARKpsmp/temp"

We will need to reset psmpappuser.cred file and vault psmpapp_psmp password.

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpappuser.cred
Vault Username [mandatory] ==> PSMPAPP_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpgwuser.cred
Vault Username [mandatory] ==> PSMPGW_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

C:\CyberArk\Password Vault Web Access\Env>

WINSCP to upload those two files to PSMP server to replace those at /etc/opt/CARKpsmp/vault/

PSMP_ADB_psmp suspended

[root@psmp conf]# cat /etc/opt/CARKpsmpadb/conf/basic_psmpadbridge.conf
[Main]
AppProviderParmsSafe="PSMPADBridgeConf"
AppProviderVaultParmsFolder=Root
AppProviderVaultParmsFile="main_psmpadbridge.conf.linux.11.04"
AppProviderVaultFile="/etc/opt/CARKpsmp/vault/vault.ini"
AppProviderCredFile="/etc/opt/CARKpsmpadb/vault/psmpadbridgeserveruser.cred"
LogsFolder="/var/opt/CARKpsmpadb/logs"
LocalParmsFileFolder="/var/opt/CARKpsmpadb"
TempFolder="/var/opt/CARKpsmpadb/tmp"
AdvancedFIPSCryptography="No"
PIMConfigurationSafe="PVWAConfig"
PIMConfigurationFolder="Root"
PIMPVConfigurationFileName="PVConfiguration.xml"
PIMPoliciesConfigurationFileName="Policies.xml"

Activate user PSMP_ADB_psmp and update it password.

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe psmpadbridgeserveru
ser.cred
Vault Username [mandatory] ==> PSMP_ADB_psmp
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No
] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User
/No) [No] ==>
Command ended successfully

[root@psmp vault]# cp /home/root1/psmpadbridgeserveruser.cred .
cp: overwrite ‘./psmpadbridgeserveruser.cred’? y
[root@psmp vault]# /etc/init.d/psmpsrv restart
Stopping PSM SSH Proxy....
PSM SSH Proxy was stopped successfully.
Starting PSM SSH Proxy...
PSM SSH Proxy was started successfully.
PSMP ADBridge is already stopped.
Starting PSMP ADBridge...
PSMP ADBridge was started successfully.
[root@psmp vault]#

It also can use registration tool to overwrite the environment created in the vault:
https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20INST/PSMP_EnivromentManager.htm

It is recommended to change the default PSMAppUser and PSMPGWUser parameter values to unique values to prevent overwriting previous installations.

/opt/CARKpsmp/bin/envmanager "CreateEnv" -AcceptEULA "Y" -CredFile "/tmp/user.cred" -PSMPAppUser "PSMPAppUser_PSMP1" -PSMPGWUser "PSMPGWUser _PSMP1"

• CyberArk PSMP - PSM for SSH Installation
• CyberArk PAS PSM Installation - Part 4

Username Format

Use the PSMP server/address for the Computer/Address section. The Username can be blank to prompt for username or enter the username of the CyberArk end-user.

For example, my lab PSMP server is psmp.51sectest.dev / 192.168.2.27

Username format is as follows : username@Unix-username#domain@Unix-Machine-IP-Address

username – CyberArk username
Unix-username – privileged user allowed to login to the server
Domain – logon domain as registered in CyberArk gui
Unix-Machine-IP-Address – Target server IP address

CyberArk Configuration

CyberArk user connect to the server a remote server (E.g. 40.115.97.97 ) with privileged account netsec :

Hostname : psmp.51sectest.dev / 192.168.2.27  (PSMP server ip)

For example, using Vault user administrator 's privileged account netsec to log into remote target server 40.115.97.97

Putty session to log in with hostname / ip set to 192.168.2.27:

login as: administrator
[email protected]'s password:
Target user is required (to use domain account, specify <target_user>#<domain_ad           dress>).
Target user: netsec
Target machine address is required (to use port, specify <target_address>#<targe           t_port>).
Target machine address: 40.115.97.97

This session is being recorded
Using username "netsec".
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-1032-azure x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Jul 27 17:16:03 UTC 2020

  System load:  0.0               Processes:           115
  Usage of /:   4.7% of 28.90GB   Users logged in:     0
  Memory usage: 36%               IP address for eth0: 10.0.1.4
  Swap usage:   0%

 * "If you've been waiting for the perfect Kubernetes dev solution for
   macOS, the wait is over. Learn how to install Microk8s on macOS."

   https://www.techrepublic.com/article/how-to-install-microk8s-on-macos/

 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

0 packages can be updated.
0 updates are security updates.


Last login: Mon Jul 27 14:51:55 2020 from 160.32.192.89
netsec@ubuntu18-1:~$

Here is setting with username : administrator@[email protected]

If it is domain 51sectest.dev's user test1, the username will be still in the same format: test1@[email protected], no need to change it to [email protected]@[email protected]

PuTTY setup

1  Menu Session -> Set Host Name

2  Menu Connection -> Data -> set Auto-login username
Auto-login username : administrator@[email protected]

Using username "administrator@[email protected]".
administrator@[email protected]@192.168.2.27's password:

This session is being recorded
Using username "netsec".
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-1032-azure x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Jul 27 17:23:25 UTC 2020

  System load:  0.0               Processes:           112
  Usage of /:   4.7% of 28.90GB   Users logged in:     0
  Memory usage: 36%               IP address for eth0: 10.0.1.4
  Swap usage:   0%

 * "If you've been waiting for the perfect Kubernetes dev solution for
   macOS, the wait is over. Learn how to install Microk8s on macOS."

   https://www.techrepublic.com/article/how-to-install-microk8s-on-macos/

 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

0 packages can be updated.
0 updates are security updates.


Last login: Mon Jul 27 17:16:04 2020 from 160.32.192.89
netsec@ubuntu18-1:~$
netsec@ubuntu18-1:~$

SecureCRT setup

Menu SSH2 -> set Hostname and Username parameter

Sign in KubeSail with Your GitHub Account

Create a new Template

apiVersion: apps/v1
kind: Deployment
metadata:
  name: new
  labels:
    app: webssh
spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  replicas: 1
  selector:
    matchLabels:
      app: webssh
  template:
    metadata:
      labels:
        app: webssh
    spec:
      containers:
        - name: api
          image: jakewalker/webssh
          imagePullPolicy: Always
          ports:
            - name: http-ports
              containerPort: 8888

Launch APP from Template and Configure Network

Configure Cloudflare Workers 

addEventListener(
  "fetch",event => {
     let url=new URL(event.request.url);
     url.hostname="webssh.51sec.usw1.kubesail.org";
     let request=new Request(url,event.request);
     event. respondWith(
       fetch(request)
     )
  }
)

Ezoic Hosting Change

Own VPS Hosting

root@5fbe841d1f40:/# cd /etc/nginx/conf.d
root@5fbe841d1f40:/etc/nginx/conf.d# nano wordpress.conf 

server {
    listen       80;
    server_name  51sec.org www.51sec.org 132.145.98.41;

location / {
    proxy_pass       http://132.145.98.41:10000;
    proxy_redirect             off;
    proxy_http_version         1.1;
    proxy_set_header Upgrade   $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host      $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

root@5fbe841d1f40:/etc/nginx/conf.d# service nginx restart

Edit functions.php #Edit functions.php

• FTP to the site, and get a copy of the active theme’s functions.php file. You’re going to edit it in a simple text editor and upload it back to the site.
• Add these two lines to the file, immediately after the initial “<?php” line:

References

• Rancher is an amazing GUI for managing and installing Kubernetes clusters. It addresses the operational and security challenges of managing multiple Kubernetes clusters across any infrastructure, while providing DevOps teams with integrated tools for running containerized workloads.
• K3s is designed to be a single binary of less than 40MB that completely implements the Kubernetes API. In order to achieve this, they removed a lot of extra drivers that didn't need to be part of the core and are easily replaced with add-ons.

curl -fsSL get.docker.com | sh

docker run -d -v /data/docker/rancher-server/var/lib/rancher/:/var/lib/rancher/ --restart=unless-stopped --name rancher-server -p 80:80 -p 443:443 rancher/rancher:stable

curl -sfL https://get.k3s.io | sh -

vim /etc/systemd/system/multi-user.target.wants/k3s.service

[Unit]
Description=Lightweight Kubernetes
Documentation=https://k3s.io
After=network-online.target

[Service]
Type=notify
EnvironmentFile=/etc/systemd/system/k3s.service.env
ExecStartPre=-/sbin/modprobe br_netfilter
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/local/bin/k3s server

/usr/local/bin/k3s server --docker --no-deploy traefik

systemctl daemon-reload

service k3s restart

k3s kubectl get node

root@K3S-1:~# vim /etc/systemd/system/multi-user.target.wants/k3s.service
root@K3S-1:~# systemctl daemon-reload
root@K3S-1:~# service k3s restart
root@K3S-1:~# k3s kubectl get node
NAME    STATUS   ROLES    AGE   VERSION
k3s-1   Ready    master   58s   v1.18.6+k3s1
root@K3S-1:~#

curl --insecure -sfL https://52.152.236.147/v3/import/jr42wvdhk4w94htxxtf5hv424rsjjz6hzq9vl2lj8q9dnb8dgcwgzn.yaml | kubectl apply -f -

root@K3S-1:~# curl --insecure -sfL https://52.152.236.147/v3/import/6tx4vblm9464jc4wnvj5kx87qsxxkqxcrmn575msq55j6j2bvdzcvk.yaml | kubectl apply -f -
error: no objects passed to apply
root@K3S-1:~# curl --insecure -sfL https://52.152.236.147/v3/import/6tx4vblm9464jc4wnvj5kx87qsxxkqxcrmn575msq55j6j2bvdzcvk.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: proxy-clusterrole-kubeapiserver
rules:
- apiGroups: [""]
  resources:
  - nodes/metrics
  - nodes/proxy
  - nodes/stats
  - nodes/log
  - nodes/spec
...(Omitted)...
      - name: k8s-ssl
        hostPath:
          path: /etc/kubernetes
          type: DirectoryOrCreate
      - name: var-run
        hostPath:
          path: /var/run
          type: DirectoryOrCreate
      - name: run
        hostPath:
          path: /run
          type: DirectoryOrCreate
      - name: cattle-credentials
        secret:
          secretName: cattle-credentials-26fff6d
          defaultMode: 320
      - hostPath:
          path: /etc/docker/certs.d
          type: DirectoryOrCreate
        name: docker-certs
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
root@K3S-1:~# curl --insecure -sfL https://52.152.236.147/v3/import/6tx4vblm9464jc4wnvj5kx87qsxxkqxcrmn575msq55j6j2bvdzcvk.yaml | kubectl apply -f -
clusterrole.rbac.authorization.k8s.io/proxy-clusterrole-kubeapiserver created
clusterrolebinding.rbac.authorization.k8s.io/proxy-role-binding-kubernetes-master created
namespace/cattle-system created
serviceaccount/cattle created
clusterrolebinding.rbac.authorization.k8s.io/cattle-admin-binding created
secret/cattle-credentials-26fff6d created
clusterrole.rbac.authorization.k8s.io/cattle-admin created
deployment.apps/cattle-cluster-agent created
daemonset.apps/cattle-node-agent created
root@K3S-1:~#

NIST CSF Tiers

• Tier 1 – Partial: Organizational cybersecurity risk is not formalized and managed in an ad hoc and sometimes reactive manner. There is also limited awareness of cybersecurity risk management.
• Tier 2 – Risk-Informed: There may not be an organizational-wide policy for security risk management. Management handles cybersecurity risk management based on risks as they happen.
• Tier 3 – Repeatable: A formal organizational risk management process is followed by a defined security policy.
• Tier 4 – Adaptable: An organization at this stage will adapt its cybersecurity policies based on lessons learned and analytics-driven to provide insights and best practices. The organization is constantly learning from the security events that do occur in the organization and will share that information with a larger network.

Maturity Levels

References

• BUILDING CYBERSECURITYCAPABILITY, MATURITY,RESILIENCE (CMMI Institute & ISACA)
• Free NIST CSF Maturity Tool

Enable Multisite in wp-config.php

Enable Network from Wordpress Admin Portal

Change wp-config.php and .htaccess

define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', true);
define('DOMAIN_CURRENT_SITE', 'My Website');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1);

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]

References

• HOW TO INSTALL AND SET UP A WORDPRESS MULTISITE

Generate a Cert Signing Request for the Vault

Install your Vault Server Organization SSL Cert

References

Appendix

C:\Program Files (x86)\PrivateArk\Server>CACert.exe /?
Usage: CACert <command> [command parameters]
       If no command parameter is specified, you will be prompted for input.
CACert commands:
request         - Prepares certificate signing request (CSR) file
install         - Installs certificate to be used by the vault
uninstall       - Uninstalls the current vault certificate
import          - Imports and installs a certificate from a ".pfx" file
show            - Shows current vault certificate information
renew           - Renews the current vault certificate
setca           - Handles CA certificates store

Option preceeded with '*' is mandatory
"request" command options:
* /ReqOutFile      - Name of the request output file
  /ReqOutPrvFile   - Private key output file (default is server private key)
  /KeyBitLen       - Bit length of output private key (default is 2048)
  /Country         - Country Name (2 letters code)
  /State           - State or Province Name (full name)
  /Locality        - Locality Name (eg, city)
  /Org             - Organization Name (eg, company)
  /OrgUnit         - Organizational Unit Name (eg, section)
* /CommonName      - Common Name (eg, DNS name of the vault)
  /SubjAlt         - Subject alternative names (eg, "DNS:www.cyber-ark.com, IP:1
92.168.41.1")
"install" command options:
* /CertFileName    - Full path of the certificate file to install
"uninstall" command options:
  /Quiet           - Uninstalls the vault certificate without user confirmation
"import" command options:
* /InFile          - Full path of the file that contains the key and certificate
 to import (.pfx)
  /Password        - Password of the .pfx file
"show" command options:
  /OutFormat       - Output format: TEXT, PEM OR DER (default is TEXT)
"renew" command options:
* /RenOutFile      - Certificate renewal output file name
"setca" command options:
  /CertStore       - Certificate store to work with. If parameter is ommited, th
e vault trusted client CA's store is selected
  /List            - Lists subjects of certificates in a store
  /Add             - Name of certificate file to add to the store
  /Remove          - Name of certificate file to remove from the store

C:\Program Files (x86)\PrivateArk\Server>

• Administrator on a Windows server
• Root on a UNIX server
• Cisco Enable on a Cisco device
• Embedded passwords found in applications and scripts

Lab Topology

High Availability or Load Balancing

VAULT = "51sec Vault"                
Address=192.168.2.21,172.17.2.21
Port=1858

You can have multiple CPM installed in a distributed environment, unfortunately it does not support high availability. It can be configured load balancing manually, which means you can use one CPM to manage certain amounts safes or accounts, and another CPM can handle other amount of safes and accounts. Typical implementation is one CPM handles Windows accounts, another CPM handles *NIX accounts.

For PSM - HA / Load Balancing

You can install multiple PSMs. For example, PSM1 and PSM2. You can find out your PSM server names from PVWA - Administration - Options -  Privileged Session Management - Configured PSM Servers 

1. Manual PSM failover.

Change your platform's settings to use different PSM server.

PVWA - Administration - Platform Management - <Platform Name> - UI & Workflows - Privileged Session Management - ID

For PSM name, you can check the basic_psm.ini at folder : C:\Program Files (x86)\CyberArk\PSM

[Main]
PSMVaultFile="C:\Program Files (x86)\CyberArk\PSM\Vault\Vault.ini"
PSMAppCredFile="C:\Program Files (x86)\CyberArk\PSM\Vault\psmapp.cred"
PSMGWCredFile="C:\Program Files (x86)\CyberArk\PSM\Vault\psmgw.cred"
LogsFolder="C:\Program Files (x86)\CyberArk\PSM\Logs"
TempFolder="C:\Program Files (x86)\CyberArk\PSM\Temp"
PSMServerId="PSM-BCP-PSMP01"
PSMServerAdminId="PSMA-BCP-PSMP01"
ConfigurationSafe="PVWAConfig"
ConfigurationFolder=Root
PVConfigurationFileName=PVConfiguration.xml
PoliciesConfigurationFileName=Policies.xml

2. Auto PSM Loadbalancing

First, you might need to configure your loadbalacer with one virutal PSM dns name to use your multiple PSM servers.

Go to "PVWA - Administration - Options -  Privileged Session Management - Configured PSM Servers "

Copy existing PSM server and paste as a new PSM server and change it to your new virtual PSM farm server name

Expand PSM-Farm. Select Connection Details > Server and change the IP address to that of your PSM Farm virtual hostname, PSM-Farm.51sec.local. Click on Apply and OK to save the changes.

Edit all target platforms to change the PSM ID to PSM-Farm.

Note: There is a key step relating to RDP service certificate. You will need to assign a certificate to the Remote Desktop Services deployment in support of the PSM Farm virtual hostname. Here are the steps:

1. Sign in to PSM Server Comp01c or Comp01d.
2. Open Server Manager and select Remote Desktop Services in the left navigation pane.
3. In Deployment Overview select Tasks > Edit Deployment Properties. In the Configure the deployment window, select Certificates > Select existing certificates > Choose a different certificate. Browse to C:\CyberArkInstallationFiles.

4. Select the pre-generated cert file with the .pfx extension and click Open. In the Password: field, enter Cyberark1, select the box to “Allow the certificate to be added to the Trusted Root Certification Authorities…” and select OK to close the Deployment Properties window.

For Vault - HA (DR)

Failover High Level Steps from primary Vault server to DR vault server
1. Make sure your active vault server DR user is enabled and password has been changed, for example, changed to Cyberark1
2. Install PADR software on secondary (DR) vault server. Before this, Vault Server and Vault Client  should has been installed. DR vault server has been manually stopped.
3. During installing PADR, it will ask active vault server's ip, username (DR) and password to be used to do replication.
4. Stop active vault server to simulate a failure to enable automatically failover. It will take 5 minutes for DR server PADR service to detect this failure (5 times).
5. DR vault server should launch it by PADR service.


====================================================================

Failback from DR vault server to primary vault server:


1. Make sure your active DR vault server's DR user is enabled and password has been reset to Cyberark1.
2. If there is no PADR installed before on Primary vault server, install PADR software first. Primary vault server should be still in the stopped status. It will create user.ini for DR account during PADR installation. Reboot Primary vault server.

Note: If PADR installed, before start the service, use createcredfile.exe reset user.ini DR password to Cyberark1.

3. Start PADR service, verify padr.log file to check all changes have been replicated over. Your primary vault PADR service will use DR account to verify the connectivity to DR site. If it is successful, it will replicate DR database to primary vault. If it failed, it will try five times in five minutes, after that, it will start failover process to start Vault server. We do not want this happen. We want PADR service replicate database from DR vault. In this case, since DR vault server is up and running, it must be DR user account password issue. You will need to reset DR user password on DR Vault and recreate user.ini file on Primary Vault using CreateCredFile.exe.
4. Once verified all replication succeed, Edit PADR.ini. At this moment, Primary Vault Server is still stopped.

a. Set EnableFailover=No
b. Add the following line: ActivateManualFailover=Yes . Save and exit the file.

Backup - PAReplicate

Backup.cmd File at C:\Program Files (x86)\PrivateArk\Replicate

PAReplicate.exe vault.ini /logonFromFile user.ini /fullbackup /tsparmfile tsparm.ini

DR Failover

Prod Failback