Proxy server settings

Tanium as a Service deployments include a customer-specific proxy server that allows the destinations that are required for Tanium modules to work. To request additional allowed entries, contact Tanium Support at [email protected].

Some organizations use proxy servers for traffic between internal servers and the Internet. If your organization uses proxies and its security policy does not allow Tanium Core Platform servers to access Internet locations directly, you can configure access through the proxies. The Tanium Server connects to the Internet to download content updates from Tanium and to download necessary files from other trusted suppliers. The Tanium Module Server connects to the Internet to download module software updates from Tanium. Individual Tanium modules might also have requirements to access the Internet.

The Tanium Server and Module Server use the Tanium Downloader (TDownloader) utility to securely download files. To configure access through proxies, configure TDownloader settings on both servers.

To configure Tanium Client 7.4 or later to connect through a Hypertext Transfer Protocol Secure (HTTPS) proxy server to the Tanium Server or Tanium Zone Server, see Tanium Client User Guide: Connect through an HTTPS proxy server.

For a list of sites that Tanium Core Platform servers access, see Internet URLs required.

A destination server might have its own requirements, such as certificate authentication or user authentication. For information about configuring advanced options for these requirements, see Tanium Support KB: TDownloader.

Figure 1: Tanium deployment with proxy server

Tanium Appliance: Configure proxy settings

In most cases, use the Tanium Console to configure proxy settings. In some circumstances, you might need to configure proxy settings before you have access to the Tanium Console. If necessary, you can configure proxy settings on the Tanium Server or Module Server host.

The proxy server configuration is stored in configuration files on the Tanium Server. Active-active Tanium Servers do not automatically synchronize the configuration files. If you change these settings in active-active deployments, be sure to perform the procedure on both Tanium Servers in the cluster.

Sign into the TanOS console as the user tanadmin.
Enter 2 to go to the Tanium Operations menu.
Enter 2 to go to the Tanium Configuration Settings menu.
Enter 2 to go to the Tanium Server TDL Settings menu or enter 5 to go to the Module Server TDL Settings menu.
Use the menu to edit proxy server settings.

Table 1: Tanium Server TDownloader (TDL) settings
Settings	Guidelines
BypassCRLCheckHostList	Use this setting to list servers that the Tanium Server can trust without checking a certificate revocation list (CRL). The Tanium Server performs a CRL check on all servers that are not in this list, and does not download files from a server that fails the check. Specify the servers by FQDN or IP address. You must enter IPv6 addresses within square brackets (for example, [2001:db8::1]).
BypassProxyHostList	Must be set with a comma-separated list of FQDN or IP addresses that specify all Tanium Servers and the Module Server, 127.0.0.1, and localhost. You must enter IPv6 addresses within square brackets (for example, [2001:db8::1]). Specify literal values. Tanium Core Platform 7.0.314.6242 and later supports wildcards. Note: Enhancements have been made in recent releases to automatically bypass the proxy server for these host addresses: 7.0.314.6573+ — Automatically bypass 127.0.0.1 and localhost. 7.1.314.3204+ — Automatically bypass 127.0.0.1 and localhost. 7.2.314.3181+ — Automatically bypass Tanium Server, 127.0.0.1, and localhost. 7.3.314.2866+ — Automatically bypass Tanium Server, 127.0.0.1, and localhost.
LogVerbosityLevel	Specify one of the following decimal values for the log verbosity level: 0: Logging disabled. 1: Normal log level. 41: Recommended during troubleshooting. >= 91: Most detailed log level. Enable for short periods of time only.
ProxyServer	IP address of the proxy server. Note: By default, TDownloader resolves the proxy server address as an IPv4 address. If the proxy server has an IPv6 address, you must enter it within brackets (for example, [2001:db8::1]) and configure the TDownloader setting ForceIPV6 to 1.
ProxyPort	Proxy server listening port.
ProxyType	The options are Basic, NTLM, or None.
ProxyUserid	For a proxy server that requires authentication, enter the user ID to establish the connection with the proxy server.
ProxyPassword	For a proxy server that requires authentication, enter the password of the ProxyUserid user to establish the connection with the proxy server.
TrustedCertPath	Path to the Transport Layer Security (TLS) certificate authority (CA) bundle of trusted certificates.
TrustedHostList	By default, the Tanium Server validates the SSL/TLS certificate of remote servers when establishing connections to them (such as for downloading files). To bypass certificate validation for specific servers, enter their FQDN or IP address. Tanium Core Platform 7.0.314.6242 and later support wildcards. You must enter IPv6 addresses within square brackets (for example, `[2001:db8::1]`). In an active-active deployment, you do not need to add the Tanium Servers to the list. The servers automatically trust each other, as well as traffic from 127.0.0.1 or localhost. Contact Tanium Support before modifying this setting.
ForceIPV6	Add this setting manually if you need it, but only with guidance from Tanium Support ([email protected]). In deployments where traffic between Tanium Core Platform servers and the Internet traverses a proxy server, TDownloader resolves the proxy address as an IPv4 address by default. If the proxy server has an IPv6 address, add the ForceIPV6 setting with a value of 1.

Windows: Configure proxy settings

The proxy server configuration is stored in configuration files on the Tanium Server. Tanium Servers do not automatically synchronize the configuration files among active-active peers. If you change these settings in active-active deployments, be sure to perform the procedure on both Tanium Servers.

The Windows Registry entry for proxy server settings is found in the following location for on the Tanium Server host and Tanium Module Server host:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Tanium\Tanium Server

Table 2: TDownloader settings
Name	Type	Data
BypassCRLCheckHostList	REG_SZ	Use this setting to list servers that the Tanium Server can trust without checking a certificate revocation list (CRL). The Tanium Server performs a CRL check on all servers that are not in this list, and does not download files from a server that fails the check. Specify the servers by FQDN or IP address. You must enter IPv6 addresses within square brackets (for example, [2001:db8::1]).
BypassProxyHostList	REG_SZ	Must be set with a comma-separated list of FQDN or IP addresses that specify all Tanium Servers and the Module Server, 127.0.0.1, and localhost. You must enter IPv6 addresses within square brackets (for example, [2001:db8::1]).. Specify literal values. Tanium Core Platform 7.0.314.6242 and later supports wildcards. Note: Enhancements have been made in recent releases to automatically bypass the proxy server for these host addresses: 7.0.314.6573+ — Automatically bypass 127.0.0.1 and localhost. 7.1.314.3204+ — Automatically bypass 127.0.0.1 and localhost. 7.2.314.3181+ — Automatically bypass Tanium Server, 127.0.0.1, and localhost. 7.3.314.2866+ — Automatically bypass Tanium Server, 127.0.0.1, and localhost.
ProxyServer	REG_SZ	IP address of the proxy server. Note: By default, TDownloader resolves the proxy server address as an IPv4 address. If the proxy server has an IPv6 address, you must enter it within brackets (for example, [2001:db8::1]) and configure the TDownloader setting ForceIPV6 to 1.
ProxyPort	REG_SZ	Proxy server listening port.
ProxyType	REG_SZ	The options are Basic, NTLM, or None.
ProxyUserid	REG_SZ	For a proxy server that requires authentication, enter the user ID to establish the connection with the proxy server.
ProxyPassword	REG_SZ	The corresponding password.
TrustedHostList	REG_SZ	By default, the Tanium Server validates the SSL/TLS certificate of remote servers when establishing connections to them (such as for downloading files). To bypass certificate validation for specific servers, enter their FQDN or IP address. Tanium Core Platform 7.0.314.6242 and later support wildcards. You must enter IPv6 addresses within square brackets (for example, `[2001:db8::1]`). In an active-active deployment, you do not need to add the Tanium Servers to the list. The servers automatically trust each other, as well as traffic from 127.0.0.1 or localhost. Contact Tanium Support before modifying this setting.

By default, TDownloader resolves a proxy server hostname as an IPv4 address. Tanium Core Platform 7.3 and later support IPv6. If necessary, you can override the default by adding a setting to the TDownloader registry in the following location:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Tanium\Downloader

Table 3: TDownloader Registry Key setting
Name	Type	Data
LogVerbosityLevel	REG_DWORD	Specify one of the following decimal values for the log verbosity level: 0: Logging disabled. 1: Log level during normal operation. 41: Best practice log level during troubleshooting. 91 or higher: Enable the most detailed log levels for short periods of time only.
ForceIPV6	REG_DWORD	Add this registry key manually if you need it, but first contact Tanium Support at [email protected] for guidance. By default, TDownloader resolves the proxy server address as an IPv4 address. If the proxy server has an IPv6 address, add the ForceIPV6 key and set its value to 1.