Installing the Tanium Zone Server

Install a Tanium Zone Server in your DMZ to proxy communication from external endpoints to the Tanium Server. You can install the Zone Server Hub on the same host as the Tanium Server or on a dedicated host. You can deploy two Zone Servers and two Zone Server Hubs in an active-active high availability (HA) configuration to ensure continuous availability in the event of an outage or scheduled maintenance. For details about the Zone Server, Zone Server Hub, and deployment options, see Tanium Zone Server.

Before you begin

Ensure that you meet the following requirements before installing the Zone Server:

Install the Tanium Zone Server

This section provides procedures for the following workflow:

  1. Run the installer on the Zone Server Hub host computer. In this example, the Tanium Server host computer is also the Zone Server Hub host computer.

  2. Run the installer on one or more Zone Server host computers in the DMZ.

The Tanium Zone Server installer takes the following actions:

  • Opens TCP port 17472 in the local host computer Windows Firewall.
  • Installs Tanium Zone Server Hub or Zone Server on the local host computer and starts the service.

Install the Zone Server Hub

Perform the following steps for each Zone Server Hub.

  1. Sign in as an administrator user on the internal network host system where you will install the Zone Server Hub.
  2. Copy the installation package file (SetupZoneServer.exe) to a temporary location on the hub host.
  3. (Fresh installations only) Copy the initialization file (tanium-init.dat) from the Tanium Server to a temporary location on the hub host if you will install the hub on a dedicated host. If you will install the hub on the Tanium Server host, you can find the file in the Tanium Server installation folder.
  4. Right-click SetupZoneServer.exe and select Run as administrator.
  5. Complete the installation wizard. The following table provides guidelines for key settings.

  6. SettingsGuidelines
    Choose Install LocationThe default is C:\Program Files\Tanium\Tanium Zone Server.
    Zone Server TypeSelect Zone Server Hub.
    Choose Service Account for Tanium Zone ServerSpecify Account: Define a service account to run the Tanium Zone Server service on the local host computer:
    • User Name: Enter only the account name portion, such as taniumsvc.
    • Domain: Enter the fully qualified domain name, such as example.com.
    • Password: Enter the account password.
    Local System Account: Select this option to install software and run the service in the context of the Local System account. Because this account grants higher operating system privileges than are necessary for Zone Server operations, the best practice is to not select this option for production deployments.
    Initialization File(Fresh installations only) Specify the file path of the tanium-init.dat file.
    Server AddressSpecify the FQDN or IP address of the Tanium Server. You must enter IPv6 addresses within square brackets (for example, [2001:db8::1]).
    Server PortThe inbound port on which the Zone Server Hub receives traffic from the Tanium Server and Zone Server. The default is 17472.

  7. (Non-local hub only) If the Zone Server Hub resides on a different host than the Tanium Server, sign into the Tanium Server CLI and configure the AllowedHubs setting:

    1. Navigate to the hub installation folder:

      $ cd <Zone Server Hub>

    2. Enable (best practice) or disable enforcement of the AllowedHubs setting. The default value 1 specifies that the Tanium Server enforces the setting: only hubs listed in AllowedHubs can communicate with the Tanium Server. The value 0 enables any hub to communicate with the Tanium Server regardless of the AllowedHubs setting.

      $ TaniumZoneServer config set EnforceAllowedHubs [1|0]

    3. If you enabled enforcement of AllowedHubs, configure it as follows, where <hub1,hub2...> is a comma-separated list of hubs that are authorized to communicate with this Tanium Server. Specify the hubs by FQDN or IP address. The default value is 127.0.0.1 (localhost).

      $ TaniumZoneServer config set AllowedHubs <hub1,hub2...>

  8. (Non-local hub only) If the Zone Server Hub resides on a different host than the Tanium Server, enable the file cache and set its maximum size: see Manage caching on the Zone Server and Zone Server Hub.

Install the Zone Server

Perform the following steps for each Zone Server.

  1. Sign into the Tanium Zone Server host computer as an administrator user.
  2. Copy the installation package file (SetupZoneServer.exe) to a temporary location on the Zone Server.
  3. (Fresh installation only) Copy the initialization file (tanium-init.dat) from the Tanium Server to a temporary location on the Zone Server.
  4. Right-click the SetupZoneServer.exe file and select Run as administrator.
  5. Complete the installation wizard. The following table provides guidelines for key settings.

  6. SettingsGuidelines
    Choose Install LocationThe default is C:\Program Files (x86)\Tanium\Tanium Zone Server.
    Zone Server TypeSelect Zone Server.
    Choose Service Account for Tanium Zone ServerSpecify Account: Define a service account to run the Tanium Zone Server service on the local host computer:
    • User Name: Enter only the account name portion, such as taniumsvc.
    • Domain: Enter the fully qualified domain name, such as example.com.
    • Password: Enter the account password.
    Local System Account: Select this option to install software and run the service in the context of the Local System account. Because this account grants higher operating system privileges than are necessary for Zone Server operations, the best practice is to not select this option for production deployments.
    Initialization File(Fresh installations only) Specify the file path of the tanium-init.dat file.
    IP addresses or FQDNs of allowed Zone Server HubsEnter a comma-separated list of IP addresses or FQDNs for the Zone Server Hubs that are authorized to communicate with this Zone Server. In an HA deployment, specify both Zone Server Hubs.

  7. (HA only) As a best practice, specify the preferred Zone Server Hub from which the Zone Server receives Tanium Client content, such as action packages (see Tanium Zone Server for details). Sign into the Zone Server CLI (see Tanium Core Platform Deployment Guide: Command-line interface) and run the following commands:

    $ cd <Zone Server>

    $ TaniumZoneServer config set HubPriorityList <hub IP address or FQDN>

  8. If you configure separated SeparatedSubnets.txt or IsolatedSubnets.txt files on the Tanium Server, you must copy the files to the Zone Server as described under Tanium Client User Guide: Configure separated subnets and Tanium Client User Guide: Configure isolated subnets.
  9. (Best Practice) Configure separate ports on the Zone Server for traffic from Zone Server Hubs and Tanium Clients: see Configure ports for traffic from Zone Server Hubs and Tanium Clients.
  10. If necessary to prevent over-consumption of disk space on the Zone Server, configure a maximum file cache size: see Manage caching on the Zone Server and Zone Server Hub.

Configure ports for traffic from Zone Server Hubs and Tanium Clients

By default, the Zone Server uses the same incoming port (default is 17472) for traffic from Zone Server Hubs and Tanium Clients. As a best practice to improve the security of the Zone Server, configure separate ports:

  1. Sign into the Zone Server host as an administrator user.
  2. Access the CLI (see Tanium Core Platform Deployment Reference Guide: Command-line interface).
  3. Navigate to the Zone Server installation folder:

    > cd <Zone Server>

  4. Configure the port for traffic from Tanium Clients:

    > TaniumZoneServer config set ZoneServerPort <port>

  5. Configure the port for traffic from Zone Server Hubs:

    > TaniumZoneServer config set ZoneServerPortForHub <port>

  6. If traffic between the Zone Server and Zone Server Hubs traverses a firewall, configure the firewall to allow only hubs that are in the AllowedHubs list to connect to the port that you specified in the ZoneServerPortForHub setting. For the steps to configure the firewall, see your firewall documentation. To see which hubs are in the AllowedHubs list, run the following command:

    > TaniumZoneServer config get AllowedHubs

  7. Access the Windows Services program and restart the Tanium ZoneServer service.
  8. Delete and recreate the Zone Server Hub-to-Zone Server mappings of the Zone Server for which you configured separate ports.

    For the steps, see Tanium Console User Guide: Delete a Zone Server Hub-to-Zone Server mapping and Tanium Console User Guide: Map Zone Servers to a Zone Server Hub.

Manage caching on the Zone Server and Zone Server Hub

To optimize performance for the Tanium Core Platform, the Zone Server caches package files for actions and files requested through the Tanium Client API. The Zone Server provides these resources to Tanium Clients without having to re-request them from the Tanium Server. In Tanium Core Platform 7.4 or later, this file cache is disabled by default on the Zone Server Hub because in most deployments the hub is installed on the Tanium Server, which has its own cache. However, if the hub is installed on a dedicated host, you must enable it to perform the same caching as the Zone Server. If the cache uses too much disk space on the Zone Server, or on the hub on a dedicated host, you can set a maximum cache size. As a best practice, set the maximum to whichever is the lesser value between 200GB and 60% of available disk space on the drive where the Zone Server or hub is installed. By default, the cache uses a maximum of 20% disk space.

When you set the cache size, the Zone Server or Zone Server Hub automatically removes all the files that are currently in the cache (<Zone Server/hub>\Cache\HotCacheFile).

Manage Zone Server caching

  1. Go to Administration > Global Settings and click New Setting.
  2. Configure the following setting and click Save:
    • Setting Name: Enter zs_hot_cache_limit_in_MB.
    • Setting Value: Enter the maximum storage space in megabytes for the Zone Server cache. The default is 0 (20% of disk space).
    • Affects: Select Server
    • Value Type: Select Numeric

Manage Zone Server Hub caching

If the Zone Server Hub is installed on the Tanium Server, the hub cache is unnecessary. After you upgrade to Tanium Core Platform 7.4 or later from an earlier release, you can delete the hub cache to clear disk space by deleting the <Zone Server Hub>\Cache\HotCacheFile folder.

If the Zone Server Hub is installed on a dedicated host, configure the cache as follows:

  1. Sign into the hub host as an administrator user.
  2. Access the hub CLI (see Tanium Core Platform Deployment Reference Guide: Command-line interface) and run the following commands:

    $ cd <Zone Server Hub>

    $ TaniumZoneServer config set EnableFileCache 1

  3. Open the Windows Services program and restart the Tanium ZoneServer service.
  4. Sign into the Tanium Console.
  5. Go to Administration > Global Settings and click New Setting.
  6. Configure the following setting and click Save:
    • Setting Name: Enter hub_hot_cache_limit_in_MB.
    • Setting Value: Enter the maximum storage space in megabytes for the hub cache. The default is 0 (20% of disk space).
    • Affects: Select Server
    • Value Type: Select Numeric

Next steps

  1. Enable trust between the Zone Server Hub and Tanium Server, and map Zone Servers to the hub: see Tanium Console User Guide: Managing Zone Servers and hubs.
  2. Verify the deployment: see Verifying the Tanium Core Platform deployment.