Installing Tanium Zone Server

The Tanium™ Zone Server role installation creates the Tanium Zone Server and configuration database. The workflow described here also installs the Tanium Zone Server Hub Add-On and configures the Zone Server Hub to listen for connections from the Zone Server.

Overview

In Tanium deployments, Tanium™ Clients initiate communication with the Tanium™ Server. Your enterprise network security policies likely do not allow endpoints that reside in the untrusted network to initiate connections to resources that reside in the internal network, such as the Tanium Server. To enable the Tanium Server to manage these endpoints, you can deploy one or more Tanium Zone Servers in the DMZ to proxy communication from the external endpoints.

The figure below illustrates Zone Server communication. The Zone Server is installed as a service, typically on an existing, shared device in the DMZ. It communicates with the Tanium Server through a Zone Server Hub process that you install as an add-on to the Tanium Server appliance. You set up external clients to register with the Zone Server as if it were the primary Tanium Server.

To optimize performance as much as possible, the Zone Server is designed to cache sensor definitions, configuration information, and the files packaged in actions. It provides these resources to clients without having to re-request them from the Tanium Server.

When using Tanium to manage external clients, be mindful that they might not have the same access to internal resources as internal clients. Target actions so that external clients are not instructed to attempt to access resources on the internal network, like an Active Directory server, or package files staged on an internal URL.

Figure  1:  Zone Server deployment

Before you begin

Make sure:

Install the Tanium Zone Server

This section provides procedures for the following workflow:

  1. Deploy one or more Zone Server appliances in the DMZ.
  2. Install the Zone Server hub add-on on the Tanium Server appliance and configure a Zone Server list that defines the Zone Servers with which it can communicate.

Install the Zone Server

  1. Log into the Zone Server appliance as the user tanadmin.

    The TanOS console displays the tanadmin menu.

  2. Enter 1 to go to the Tanium Installation menu.
  3. Enter 4 to install the Tanium Zone Server.
  4. When prompted, specify the Tanium platform version you want to install.

The installation is completed in about 30 seconds.

Import the Tanium Server public key file to the Zone Server

  1. On your management computer, set up an SFTP client such as WinSCP to connect to the Tanium Zone Server appliance:
    1. Specify tancopy for user name.
    2. Click the Advanced button.
    3. Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance in Completing the initial setup (hardware appliances).
  2. Use SFTP to copy the tanium.pub file to the /incoming directory on the Zone Server appliance.
  3. Log into the Zone Server appliance as the user tanadmin.
  4. Enter 2 to go to the Tanium Operations menu.
  5. Enter I and then follow the prompts to copy the Tanium Server public key file (tanium.pub) into the Zone Server installation directory.

Install the Zone Server hub

After you have installed the Tanium Server role on a Tanium Appliance, you can install the Zone Server Hub Add-On.

  1. Log into the Tanium Server appliance as the user tanadmin.
  2. Enter 1 to go to the Tanium Installation menu.
  3. Enter A and then follow the prompts to install the Tanium Zone Server Hub Add-On.

The installation is completed in about 30 seconds.

Edit the Zone Server List

  1. Log into the Zone Server Hub appliance as the user tanadmin.
  2. Enter 2 to go to the Tanium Operations menu.
  3. Enter 2 to go to the Configuration Settings menu.
  4. Enter 11 to edit the zoneserverlist.txt file.
  5. Add the IP address or FQDN for each Zone Server and save the file.

Last updated: 11/8/2018 3:04 PM | Feedback