Completing the initial setup (Tanium Cloud Appliance)

This topic is only available in the Tanium Cloud Appliance version of the Tanium Appliance Deployment Guide.

Obtain a virtual appliance image file and virtual appliance license from Tanium Support. For more information, see Contact Tanium Support.

Requirements

License Obtain a valid license from Tanium Support. Tanium Support must know the fully qualified domain name (FQDN) for each Tanium Server appliance in your deployment to generate your license file.
Cloud provider
  • Amazon Web Services
  • Microsoft Azure
  • IBM Private Cloud

Deploy the virtual image to the cloud provider

Contact Tanium Support to obtain a TanOS Cloud Appliance image. When you configure the image with your cloud provider, you must specify a encryption key pair to initially connect to the image. You can use an existing key pair or generate a new key pair.



Remote access to TanOS

Network and host settings enable the appliance to establish connections with other computers in your local network and with other servers and hosts on the Internet. Specify appropriate settings for the network in which the appliance is deployed.

  • Your local "management computer" must be connected to a subnet that can reach the appliance IP address.
  • Your management computer must have an SSH client application or terminal emulator that can make a client connection to the appliance.
  • You must have an SSH client such as PuTTY to sign into the TanOS console. For PuTTY, use version 0.71 or later.
  • You must have an SSH key generator such as ssh-keygen to generate keys for the tancopy user.
  • You must have an SFTP client such as WinSCP to copy files to and from the appliance. For WinSCP, use version 5.15.2 or later.

Watch the tutorial on setting up WinSCP for the Tanium Appliance on the Tanium Community website.

Configure network and host settings

  1. Make sure your virtual image is configured to use an encryption key pair, and that the private key is set up on your local computer.
  2. Sign in to your cloud provider and use an SSH client to connect to the TanOS console as a user with the tanadmin role. ClosedView screen
  3. When prompted, indicate that you want to complete the initial configuration. ClosedView screen
  4. Use the spacebar to page through the end-user license agreement (EULA). When complete, press the Q key, enter your email address, and enter YES to accept it.

    The email address is stored locally only. It is not used externally for any reason.

  5. When prompted, enter the one-time password that appears on the screen for the tanadmin and tanuser users. ClosedView screen
  6. Make a note of the one-time password. You must provide the password the next time you sign in. At that time, you will be prompted to specify a new password.

    The console configures SSH keys and IPSec settings, and then notifies you that the initial configuration is complete. Press the Enter key to terminate the session. ClosedView screen

Configure user access

TanOS has built-in user accounts to access the appliance operating system and perform tasks.

Before you install a Tanium Appliance role, you must configure new passwords or add SSH keys to authenticate access for the following accounts:

  • tanuser: Can make an SSH connection with SSH key authentication or password authentication to the TanOS console and access temporary settings and status menus only.
  • tanadmin: Can make an SSH connection with SSH key authentication or password authentication to the TanOS console and access all menus. By default, the tanadmin user is configured to use key authentication only. Any user with the tanadmin role is a highest-level administrator in TanOS.
  • tancopy: Can make an SFTP connection with SSH key authentication to TanOS and copy files to and from the /incoming and /outgoing directories.

TanOS does not support self-service password reset methods. If you forget your password, you must ask a tanadmin user to reset it for you. You can avoid this risk by setting up SSH key authentication.

Watch the tutorial on how to configure SSH key authentication for the Tanium Appliance on the Tanium Community website.

Before you begin

  • Be ready to specify new passwords for the tanuser and tanadmin accounts. The password string must be at least 10 characters long and have at least 1 uppercase character, 1 lowercase character, 1 numeric character, and 1 non-alphanumeric character.
  • You must have an SSH client to sign into the TanOS console and an SFTP client to copy files to and from the appliance.
  • You must have an SSH key generator to generate keys for the tancopy user.

Change the default passwords

  1. Open an SSH connection to the TanOS console as tanadmin and follow the prompts to change the password. ClosedView screen
  2. After the password changes, the tanadmin menu appears. Enter Z to sign out.
  3. Open an SSH connection to the TanOS console as tanuser and follow the prompts to change the password. ClosedView screen
  4. After the password changes, the tanuser menu appears. Enter Z to sign out.

You can disable password access for any user except the tanadmin special user. When you disable password access for a user, the user can only sign in through SSH using the configured SSH private key. For steps, see Disable password access.

Add SSH keys

You must set up an SSH key for the tancopy user. Tanium strongly recommends that you set up SSH key authentication for TanOS user accounts.

Add SSH keys for the tancopy user

You must set up an SSH key for the tancopy user. The SSH key is used to transfer files via SFTP to the /incoming and /outgoing folders.

This procedure adds an authorized key for the tancopy user to the appliance configuration. The purpose of this key is to enable you to use an SFTP client on your management computer to copy files to the /incoming and from the /outgoing directories on the appliance. In the Tanium Module Server and redundant cluster installations, you are instructed to add a different authorized key for the tancopy user. Be careful not to mistake one for the other. The authorized keys serve different purposes. Both are required.
  1. Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
    • Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
    • Specify a passphrase that is easy to remember.
    • Save the private key to a location that you can access when you set up your SFTP client.
  2. Copy all of the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.

    In an SSH key exchange, the keys must match exactly, including line endings.

  3. Sign into the TanOS console as a user with the tanadmin role.
  4. Enter C to go to the User Administration menu. ClosedView screen
  5. Enter U to go to the TanOS User Management menu.
  6. Enter the line number for the tancopy user to go to the user administration menu for this user. ClosedView screen
  7. Enter A to go to the Manage SSH Authorized Keys menu. ClosedView screen
  8. Enter A and follow the prompts to add the contents of the public key generated in Step 1. ClosedView screen
  9. To test it, on your management computer, set up an SFTP client such as WinSCP to connect to the Tanium Server appliance:
    1. Specify tancopy for user name.
    2. Click Advanced.
    3. Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
    4. Save the configuration and click Login to initiate the connection.

      5. You should be able to connect to the appliance and see the /incoming and /outgoing directories.

 

You might see permission denied messages because WinSCP attempts to read the listing of the /incoming directory. This is expected. The user tancopy has permission to write to /incoming but not read /incoming.

Add SSH keys for TanOS users

Tanium strongly recommends that you set up SSH key authentication for TanOS user accounts.

Tips:

  • If you plan to set up multiple appliances through an Appliance Array, use these steps to copy the public key for the tanadmin user on the primary appliance to the tanadmin user accounts on the remaining appliances.
  • You can also use ssh-copy-id to add an SSH public key to any TanOS user with the tanadmin profile.

  1. Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
    • Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
    • Specify a passphrase that is easy to remember.
    • Save the private key to a location that you can access when you set up your SFTP client.
  2. Copy all of the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.

    In an SSH key exchange, the keys must match exactly, including line endings.

  3. Sign into the TanOS console as a user with the tanadmin role.
  4. Enter C to go to the User Administration menu. ClosedView screen

  5. Enter U to go to the TanOS User Management menu.

  6. Enter the line number of the user account that you want to manage. ClosedView screen
  7. Enter A to go to the Authorized Keys menu. ClosedView screen
  8. Enter A and follow the prompts to paste the public key generated in Step 1. ClosedView screen
  9. To test it, on your management computer, set up an SSH client such as PuTTY to connect to the Tanium Server appliance:
    1. Specify the Tanium Server IP address, port 22, and SSH connection type.
    2. Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
    3. Open the SSH session and enter the tanadmin username.
    4. You are prompted for the SSH key passphrase instead of the tanadmin password. ClosedView screen

Upload the license file (Tanium Core Platform 7.3 or earlier)

After you complete the initial network configuration, upload a valid Tanium license file.

These steps only apply to Tanium Core Platform 7.3 or earlier. If you plan to install Tanium Core Platform 7.4 or later, you will use the Tanium Console to upload the license file after you install a Tanium Server role or Tanium All-in-One role.

Before you begin

  • Obtain a valid license from Tanium Support. Use the same license file to activate all Tanium appliances in your deployment. Tanium Support must know the fully qualified domain name (FQDN) for each appliance to generate your license file. For more information, see Contact Tanium Support.
  • You can activate an appliance with a license file if:
    • The license file is named tanium.license.
    • The license is not expired.
    • The FQDN that was specified in the Tanium license generator matches the FQDN of the appliance.
  • You must have added the public key for the tancopy user to the appliance so you can use SFTP to upload the license file.

After you complete the initial network configuration, upload a valid Tanium license file or request an activation key from Tanium.

  1. On your management computer, set up an SFTP client such as WinSCP to connect to the appliance.
  2. Use SFTP to copy your license file (tanium.license) to the /incoming directory on the appliance.
  3. Sign into the TanOS console as a user with the tanadmin role.

    When the tanadmin menu loads, TanOS detects the license and copies it to the appropriate location to activate the appliance.

Export the grub key

The grub key can be used during the boot sequence to diagnose and recover from failure conditions. You can export the key and store it in a safe location. During recovery, you will need to provide the key.

  1. Sign into the TanOS console as a user with the tanadmin role.
  2. Enter A to go to the Appliance Configuration menu. ClosedView screen
  3. Enter X to go to the Advanced Configuration menu. ClosedView screen
  4. Enter 6 and follow the prompts to export the grub key to the /outgoing folder. ClosedView screen
  5. Use SFTP to copy the file from the /outgoing directory to your local computer.

Add TanOS system users

Create additional TanOS system users based on tanadmin (privileged) and tanuser (restricted) profiles. It is useful to have more than one privileged user in case you forget the password for the initial tanadmin user.

  1. Sign into the TanOS console as a user with the tanadmin role.
  2. Enter C to go to the User Administration menu. ClosedView screen
  3. Enter U to go to the TanOS User Management menu. ClosedView screen
  4. Enter A and follow the prompts to add a system user. ClosedView screen

What to do next

  • To save time, Tanium recommends you complete advanced network configuration before you install Tanium servers. See Reference: Appliance configuration.
  • When these steps are completed, or if none of them apply, you can continue with the installation of a Tanium role (for example, All-in-One, Tanium Server, Tanium Module Server, or Tanium Zone Server).