Completing the initial setup (cloud-based Tanium Appliance)
Contact Tanium Support to obtain a Tanium Appliance image file for use in a customer cloud.
Requirements
License |
Contact Tanium Support to obtain a valid license. Tanium Support must know the fully qualified domain name (FQDN) for each Tanium Server appliance in your deployment to generate your license file. |
Cloud provider |
|
Deploy the virtual image to the cloud provider
Contact Tanium Support to obtain a Tanium Appliance image file for use in a customer cloud. When you configure the image with your cloud provider, you must specify an encryption key pair to initially connect to the image. You can use an existing key pair or generate a new key pair.
Considerations for specific cloud providers
Microsoft Azure
For a Microsoft Azure deployment, you must change the initial user name from azureuser to tanadmin before you deploy the image.
Google Cloud Platform or IBM Cloud
Use the following steps to prepare the virtual image:
-
Create a cloud storage bucket with appropriate security, and upload the TanOS artifact file (tar.gz for Google Cloud Platform or qcow2 for IBM Cloud) to the bucket.
- Create an image from the artifact file in cloud storage.
-
Create a VM for each TanOS appliance using the image that you created.
The default boot disk size is inadequate for a production Tanium Appliance. At least 500GB of storage is recommended. Increase the size of the boot disk when you create the VM (Google Cloud Platform), or add a new disk to the VM (Google Cloud Platform or IBM Cloud). If you use an additional disk, you must increase the storage on the Tanium Appliance after initial setup. See Increase storage.
Additionally, for Google Cloud Platform, you must set up an SSH key for the tanadmin user account, even if you primarily plan to use other user accounts with the tanadmin role. See Configure SSH keys.
For more information, see the Google Cloud Platform or IBM Cloud documentation.
(FIPS-compliant organizations) Enable FIPS 140-2 mode before initial setup
Enabling Federal Information Processing Standards (FIPS) mode causes the appliance to use a FIPS-validated cryptographic module for all cryptographic operations. It also ensures that services like SSH use only cryptographic algorithms that FIPS 140-2 allows.
If FIPS mode is required for your organization, you can enable it before you continue with initial setup so that the password and keys that you configure during setup are FIPS-compliant.
Enable FIPS mode only if you are required to do so for your organization.
- In Tanium Core Platform 7.5.6.1095 and later, enabling FIPS mode in TanOS also puts the Tanium Platform in FIPS mode.
- You can later disable FIPS mode if it is not required and it was inadvertently enabled during setup. See Enable or disable FIPS 140-2 mode.
-
Sign in to the TanOS console as the tanadmin user.
- Enter M and follow the prompt to enable FIPS 140-2 mode and reboot the appliance, and then continue initial setup.
Perform full initial configuration
- Make sure your virtual image is configured to use an encryption key pair, and that the private key is set up on your local computer.
- Sign in to your cloud provider and use an SSH client to connect to the TanOS console as a user with the tanadmin role. If prompted to accept the key fingerprint, enter yes.
View screen
- Enter T and follow the prompts to set one or more NTP servers.
View screen
- Enter E, press Enter, and then use the spacebar to page through the end-user license agreement (EULA).
- When complete, enter Q, enter your email address, and enter yes to accept the EULA.
The email address is stored locally only. It is not used externally for any reason.
-
Enter F to confirm that you finished initial configuration and to end the session.
View screen
The console configures SSH keys and IPSec settings, and then notifies you that the initial configuration is complete.
Access TanOS remotely
To access your Tanium Appliances remotely, note the following requirements.
- Your local
management computer
must be connected to a subnet that can reach the appliance IP address. - Your management computer must have an SSH client application or terminal emulator that can make a client connection to the appliance.
- You must have an SSH client such as PuTTY to sign in to the TanOS console. For PuTTY, use version 0.71 or later.
- You must have an SSH key generator such as ssh-keygen to generate keys for the tancopy user.
- You must have an SFTP client such as WinSCP to copy files to and from the appliance. For WinSCP, use version 5.15.2 or later.
Watch the tutorial about how to configure WinSCP for the Tanium Appliance.
Add TanOS system users
Create additional TanOS system users based on tanadmin (privileged) and tanuser (restricted) profiles.
Create more than one privileged user with the tanadmin role in case you forget the password for the built-in tanadmin user.
- Sign in to the TanOS console as a user with the tanadmin role.
- Enter C to go to the User Administration menu.
View screen
- Enter U to manage TanOS users.
View screen
- Enter A and follow the prompts to add a system user.
View screen
Configure SSH keys
TanOS has built-in and customer-created user accounts to access the appliance operating system and perform tasks.
Before you install a Tanium Appliance role, you must add SSH keys to authenticate access for the tancopy built-in user. tancopy can make an SFTP connection with SSH key authentication to TanOS and copy files to and from the /incoming and /outgoing directories.
TanOS does not support self-service password reset methods. If you forget your password, you must ask a user with the tanadmin role to reset it for you. You can avoid this risk by setting up SSH key authentication.
Watch the tutorial about how to configure SSH key authentication for the Tanium Appliance.
Before you begin
- You must have an SSH client to sign in to the TanOS console, and an SFTP client to copy files to and from the appliance.
- You must have an SSH key generator to generate keys for the tancopy user.
Add SSH keys
You must set up an SSH key for the tancopy user.
Add SSH keys for the tancopy user
You must set up an SSH key for the tancopy user. The SSH key is used when you transfer files through SFTP to the /incoming and /outgoing directories.
- Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
- Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
- Specify a passphrase that is easy to remember.
- Save the private key to a location that you can access when you set up your SFTP client.
- Copy the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.
In an SSH key exchange, the keys must match exactly, including line endings.
- Sign in to the TanOS console as a user with the tanadmin role.
- Enter C to go to the User Administration menu.
- Enter U to manage TanOS users.
- Enter the line number for the tancopy user to go to the user administration menu for this user.
View screen
- Enter A to go to the Authorized Keys menu.
View screen
- Enter A and follow the prompts to add the contents of the public key generated in Step 1.
View screen
- To test, on your management computer, set up an SFTP client such as WinSCP to connect to the Tanium Server appliance:
- Specify tancopy for user name.
- Click Advanced.
- Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
- Save the configuration and click Login to initiate the connection.
You should be able to connect to the appliance and see the /incoming and /outgoing directories.
- Specify tancopy for user name.
Add SSH keys for TanOS users
It is a best practice to also set up SSH key authentication for TanOS user accounts.
For Google Cloud Platform, you must set up an SSH key for the tanadmin user account, even if you primarily plan to use other user accounts with the tanadmin role.
As an alternative to the following procedure, you can use ssh-copy-id to add an SSH public key to any TanOS user with the tanadmin profile.
- Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
- Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
- Specify a passphrase that is easy to remember.
- Save the private key to a location that you can access when you set up your SFTP client.
- Copy all of the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.
In an SSH key exchange, the keys must match exactly, including line endings.
- Sign in to the TanOS console as a user with the tanadmin role.
- Enter C to go to the User Administration menu.
View screen
- Enter U to manage TanOS users.
- Enter the line number of the user account that you want to manage.
View screen
- Enter A to go to the Authorized Keys menu.
View screen
- Enter A and follow the prompts to paste the public key generated in Step 1.
View screen
- To test, on your management computer, set up an SSH client such as PuTTY to connect to the Tanium Server appliance:
- Specify the Tanium Server IP address, port 22, and SSH connection type.
- Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
- Open the SSH session and enter the tanadmin user name.
- You are prompted for the SSH key passphrase instead of the tanadmin password.
View screen
Export the grub key
The grub key can be used during the boot sequence to diagnose and recover from failure conditions. You can export the key and store it in a safe location. During recovery, you need to provide the key.
- Sign in to the TanOS console as a user with the tanadmin role.
- Enter A to go to the Appliance Configuration menu.
View screen
- Enter X to go to the Advanced Configuration menu.
View screen
- Enter 6 and follow the prompts to export the grub key to the /outgoing folder.
View screen
-
Use SFTP to copy the file from the /outgoing directory to your local computer.
What to do next
- To save time, complete advanced network configuration before you install Tanium Servers. See Reference: Appliance configuration.
- In an IBM Cloud deployment, add an additional disk to increase the storage volume before you continue with array or role installation. For instructions, see Increase storage.
- When these steps are completed, you can continue with the installation of an Appliance Array.
Last updated: 5/30/2023 3:34 PM | Feedback