Tanium Appliance Installation Guide

170 Pages·2017·6.31 MB·English

by  Tanium Inc.

Tanium Appliance Installation Guide
Version 1.0.0
September 25, 2017
The informationinthisdocumentissubjecttochange withoutnotice. Further, the information
provided inthisdocumentisprovided “asis” and isbelieved tobe accurate, butispresented
withoutanywarrantyof anykind, expressorimplied, exceptasprovided inTanium’s
customersalestermsand conditions. Unlesssootherwise provided, Tanium assumesno
liabilitywhatsoever, and innoeventshall Tanium oritssuppliersbe liable foranyindirect,
special, consequential, orincidental damages, includingwithoutlimitation, lostprofitsorloss
ordamage todata arisingoutof the use orinabilitytouse thisdocument, evenif Tanium Inc.
hasbeenadvised of the possibilityof suchdamages. 
AnyIP addressesused inthisdocumentare notintended tobe actual addresses. Any
examples, command displayoutput, network topologydiagrams, and otherfiguresincluded in
thisdocumentare shownforillustrative purposesonly. Anyuse of actual IP addressesin
illustrative contentisunintentional and coincidental. 
Please visithttps://docs.tanium.com forthe mostcurrentTanium productdocumentation. 
Tanium isa trademark of Tanium, Inc. inthe U.S. and othercountries. Third-partytrademarks
mentioned are the propertyof theirrespective owners. 
© 2017 Tanium Inc. All rightsreserved.
©2017TaniumInc.AllRightsReserved Page2
Table of contents
Overview 9
Topology 10
Prerequisites 11
License 11
SSL certificates 11
Network connectivityand firewall 11
Internetaccess (director byproxy) 12
Getting started 15
Configuring network, host, andusersettings 16
Configure temporarybootstrap network settings 16
Before you begin 16
Configure the temporarysettings 16
Configure network and hostsettings 17
Before you begin 17
Configure the network and hostsettings 18
Configure user access 19
Before you begin 20
Change the defaultpasswords 20
Add SSHkeys for the tancopyaccount 20
Installing aTanium All-in-Onerole 28
Before you begin 28
Installthe TaniumServer All-in-One role 29
Nextsteps 31
©2017TaniumInc.AllRightsReserved Page3
Installing Tanium Server 32
Before you begin 32
InstallTaniumServer 33
Nextsteps 35
Installing Tanium ModuleServer 36
Before you begin 36
Add required SSH keys 36
Installthe TaniumModule Server 41
Configure the TaniumServer to use the remote Module Server 42
Enable the remote Module Server 44
Nextsteps 44
Installing Tanium ZoneServer 45
Overview 45
Before you begin 46
Installthe TaniumZone Server 46
Installthe Zone Server 47
Importthe TaniumServer publickeyfile to the Zone Server 48
Installthe Zone Server hub 52
Editthe Zone Server List 54
Nextsteps 55
Installing thelicensefile 56
Before you begin 56
Upload the license file 56
Installthe license 59
Nextsteps 61
©2017TaniumInc.AllRightsReserved Page4
Verifying thedeployment 62
Loginto the TaniumConsole 62
Deploythe TaniumClientto your lab computers 63
Before you begin 63
Installthe TaniumClientDeploymentTool 64
Deploythe TaniumClient 66
Verifythe basicdeployment 67
Verifythe Zone Server deployment 68
Installing Tanium Serverinanactive-activecluster 71
Overview 71
HA cluster requirements and limitations 72
Before you begin 73
Add required SSH keys 73
Setup the IPsectunnel 77
Deploythe HA cluster 81
Verifythe installation 83
Upgrading Tanium serversoftware 86
Before you begin 86
Upgrade Taniumserver software 86
Troubleshooting theinstallation 89
Run the Health Check 89
Restartservices or networking 90
Restartservices 91
Restartnetworking 91
Reviewlogs 92
©2017TaniumInc.AllRightsReserved Page5
Reviewthe configuration 93
Run TaniumSupportGatherer 94
Examine OS processes and files 95
Performasoftware reset 100
Managing useraccess 102
Change TanOS user passwords 102
Change the tanadmin password 103
Resetthe tanuser password 104
Resetthe tanfactorypassword 105
Manage SSHkeys 105
Before you begin 106
Generate keys 106
Add authorized keys 107
Displaypublickeys 108
Configure the localauthentication service 109
Add alocaluser 109
Setauser password 111
Delete auser 111
Disable the localauthentication service 112
Configuring syslog 113
Configuring SNMP 117
Reference: Certificateandkeyfiles 120
Before you begin 120
InstallaCA certificate file 120
Upload the CA certificate file 121
©2017TaniumInc.AllRightsReserved Page6
Installthe SOAPcertificate file 123
Manage contentsigningkeys 126
Download the contentsigningkeyutility 126
Download the TaniumServer publickeyfile 127
Importthe Taniumpublic/private keypair 128
Upload the publicand private keyfiles 128
Replace the publicand private keys 131
Reference: Tanium ServiceControl menu 132
Reference: Serverconfigurationfiles 135
TaniumServer.ini reference 138
TaniumModuleServer.ini reference 140
TaniumZoneServer.ini reference 141
Reference: ApplianceMaintenancemenu 143
Back up and restore 143
Back up 143
Restore 145
Performasoftware reset 145
Upgrade the TanOS shell 147
Clean SFTPand cores directories 148
Rebootor shutdown 149
Reboot 149
Shutdown 149
Reference: Applianceconfiguration 151
Modifythe hostname and DNS configuration 151
Modifythe IPv4 address configuration 152
©2017TaniumInc.AllRightsReserved Page7
Modifythe NTPconfiguration 152
Modifythe time zone configuration 153
Change fromastaticIP address to DHCP(VM-only) 153
Reference: Filesharemounts 154
Reference: Appliancesecurity 157
Enable/disable factoryreset 157
Manage the SSHtrusted hostlist 159
Reference: Diagnosticmenus 160
Use the TaniumSupportmenu 161
Use the Status menus 162
Displaysystemstatus 163
DisplayTaniumstatus 164
Displayappliance status 164
Reference: Tanium Appliancespecifications 166
TaniumServer Appliance (small) 166
TaniumServer Appliance (medium) 166
TaniumServer Appliance (large) 167
TaniumServer Appliance (extralarge) 167
TaniumModule Server Appliance (small, medium, large) 168
TaniumModule Server Appliance (extralarge) 168
Changelog 170
©2017TaniumInc.AllRightsReserved Page8
Overview
You can deployaTanium® Appliance in anyof the followingAppliance roles:
TaniumServer
l
The core server thatcommunicates with clients. The TaniumServer also runs the UI
console and APIservices and communicates with allother platformand solution
components, as wellas the content.tanium.comservers thathostTaniumcontent
packs and Taniumsolution module importpackages. The TaniumServer depends on
adatabase server thatis installed when the TaniumServer Role is installed.
TaniumModule Server
l
A dedicated server to run application services and store files for Taniumsolution
modules. Itis installed on aseparate appliance to preventintentionalor accidental
scripts fromhavingadirectimpacton the TaniumServer.
All-in-One
l
TaniumServer, TaniumModule Server, and database server on the same appliance.
An All-in-One deploymentis supported onlyfor proof-of-concept(POC) deployments.
TaniumZone Server
l
A server typicallydeployed in an enterprise DMZ network to proxytrafficbetween
TaniumClients thatreside on limited-access networks and aTaniumServer that
resides on the trusted core network.
©2017TaniumInc.AllRightsReserved Page9
Topology
In an enterprise production deployment, the Tanium® Server and TaniumModule Server
reside on separate TaniumAppliances.
Figure 1: Enterpriseproductionorenterpriselabdeployment
©2017TaniumInc.AllRightsReserved Page10