Other versions

Prerequisites

This topic summarizes prerequisites to software installation.

Installation package and license files

Your technical account manager (TAM) provides the Tanium™ installation package and license files required to complete the installation. The files include:

  • SetupServer.exe
  • SetupModuleServer.exe
  • SetupZoneServer.exe
  • tanium.license

The installation package for these three servers must have the same build number (for example, all must have build number 7.2.314.3181). To complete the procedures provided in this guide, be sure you can copy these files to the host computers and that you can copy files between the host computers.

The license is bound to hostname(s) you assign to the Tanium™ Server(s). For HA deployments, both hostnames are used in the license data. Let your TAM know if the hostnames provisioned for the servers are changed.

Server host system requirements

The following table summarizes basic requirements for server hosts. For detailed version specifications and sizing guidelines, see Reference: Host system sizing guidelines.

Table 1:   Hardware and software requirements
  Hardware Operating System Software
Tanium Server CPU cores: 4 to 80
Memory: 16 to 512 GB
Disk: 100 GB to 3 TB
  • Windows Server 2016
  • Windows Server 2012r2
  • Windows Server 2012
  • Microsoft Windows 2008 R2 (64-bit)
A web browser is required to use Tanium Console.
Database Server CPU cores: 4 to 32
Memory: 4 to 48 GB
Disk: 125 GB to 750 GB
  • Windows Server 2016
  • Windows Server 2012r2
  • Windows Server 2012
  • Microsoft Windows 2008 R2 (64-bit)
  • Microsoft SQL Server 2017 *
  • Microsoft SQL Server 2016
  • Microsoft SQL Server 2014
  • Microsoft SQL Server 2012
  • Microsoft SQL Server 2008 SP3 (64-bit)
  • PostgreSQL Server 9.5 **

* Tanium 7.2 and later

** Host system sizing for PostgreSQL Server TBD.

Tanium Module Server CPU cores: 4 to 16
Memory: 4 to 48 GB
Disk: 150 GB to 300 GB
  • Windows Server 2016
  • Windows Server 2012r2
  • Windows Server 2012
  • Microsoft Windows 2008 R2 (64-bit)
.NET 4.5 is required for solution modules, such as Tanium Connect.
Tanium Zone Server CPU cores: 4 to 80
Memory: 8 to 256 GB
Disk: 100 GB to 3 TB
  • Windows Server 2016
  • Windows Server 2012r2
  • Windows Server 2012
  • Microsoft Windows 2008 R2 (64-bit)
 

Client host system requirements

The following table summarizes basic requirements endpoint host systems. Hardware resource requirements vary according to the actions that may be taken on the endpoint. For hardware resource guidance, consult with your technical account manager (TAM).

Table 2:   Supported OS versions
Operating system OS Version Tanium Client Version
Microsoft Windows Server
  • Windows Server 2016 *
  • Windows Server 2012, 2012 R2
  • Windows Server 2008, 2008 R2

* Nano Server not supported.

7.2.314.2962,
6.0.314.1540,
6.0.314.1450
Windows Server 2003, 2003R2 6.0.314.1540,
6.0.314.1450
Microsoft Windows Workstation
  • Windows 10
  • Windows 8
  • Windows 7
  • Windows Vista
7.2.314.2962,
6.0.314.1540,
6.0.314.1450
Windows XP (including Embedded) 6.0.314.1540,
6.0.314.1450
macOS
(Intel processor only)
  • macOS 10.13 High Sierra
  • macOS 10.12 Sierra
  • OS X 10.11 El Capitan
  • OS X 10.10 Yosemite
  • OS X 10.9 Mavericks
  • OS X 10.8 Mountain Lion
7.2.314.2962,
6.0.314.1579,
6.0.314.1442
Linux Amazon Linux 2016.09 7.2.314.2962,
6.0.314.1579
Debian 6.x 7.2.314.2962,
6.0.314.1579,
6.0.314.1442
Oracle Enterprise Linux 7.x, 6.x 7.2.314.2962,
6.0.314.1579
Oracle Enterprise Linux 5.x 7.2.314.2962
  • Red Hat Enterprise Linux (RHEL) 7.x, 6.x
  • CentOS 7.x, 6.x
7.2.314.2962,
6.0.314.1579,
6.0.314.1442
  • Red Hat Enterprise Linux (RHEL) 5.x
  • CentOS 5.x
7.2.314.2962,
6.0.314.1579,
6.0.314.1321
  • SUSE Linux Enterprise Server (SLES) 12
  • openSUSE 12.x
7.2.314.2962,
6.0.314.1579
  • SUSE Linux Enterprise Server (SLES) 11
  • openSUSE 11.x
7.2.314.2962,
6.0.314.1579,
6.0.314.1442
Ubuntu 16.04 LTS 7.2.314.2962,
6.0.314.1579
Ubuntu 14.04 LTS 7.2.314.2962,
6.0.314.1579,
6.0.314.1442
Ubuntu 10.04 LTS 6.0.314.1579,
6.0.314.1442
AIX
  • IBM AIX 7.2
  • IBM AIX 7.1 TL1SP10 and higher *
  • IBM AIX 6.1 TL7SP10 and higher *

* 64-bit only, requires xlC.rte 12.1.0.1 or greater.

6.0.314.1437
Solaris
  • Oracle Solaris 11 SPARC *
  • Oracle Solaris 11 x86 *
  • Oracle Solaris 10 U8 SPARC or higher *
  • Oracle Solaris 10 U8 x86 or higher *

* Requires SUNWgccruntime.

6.0.314.1321

Tanium in cloud service environments

The Tanium Server and Tanium Client generally support the same operating systems listed above when virtualized in cloud service environments. Tanium customers have used our software in:

  • Amazon Web Services (AWS)
  • Google Cloud Platform (GCP)
  • Microsoft Azure
  • Oracle Cloud Infrastructure (OCI)

Use of Tanium in cloud environments entails important architectural considerations that can be unique from one deployment to another. Work with your TAM when planning to deploy or expand into such environments.

Network connectivity and firewall

Tanium components use TCP/IP to communicate over IPv4 networks. IPv6 is not supported. You must work with your network administrator to ensure that the Tanium components are provisioned IP addresses and that DNS can be used to resolve hostnames.

The table below summarizes the Tanium processes and default values for ports used in Tanium Core Platform communication. Host and network firewalls might need to be configured to allow the specified processes to send/receive TCP via the ports listed. The Tanium installer opens required ports in the Windows host firewall. You must work with your network security administrator to ensure the platform components can communicate through any security barriers (such as firewalls) in their communication path. For a detailed explanation, see Reference: Network ports.

Your security administrator might also need to create rules to exempt or exclude Tanium processes that run on the host computers from blocking by antivirus or processing by encryption or other security and management stack software. For details, see Reference: Host system security exceptions.

Table 3:   Network communication ports used by Tanium components
Component Process Inbound Port Destination Port
Tanium Server TaniumReceiver.exe 443, 17472 80, 443, 1433 or 5432, 17472 (HA), 17477
SQL Server or PostgreSQL Server Sqlservr.exe or postgres.exe 1433 or 5432  
Tanium Module Server TaniumModuleServer.exe 17477 80, 443
Tanium Zone Server TaniumZoneServer.exe 17472  
Tanium Zone Server Hub TaniumZoneServer.exe   17472
Tanium Client TaniumClient.exe 17472 17472
Tanium Client Deployment Tool (CDT) TaniumClientDeploy.exe   22, 135, 445
Unmanaged endpoint CDT platform-specific methods (during deployment only) 22, 135, 445  

Internet access (direct or by proxy)

During installation, the Tanium Server installer (SetupServer.exe) prompts you to download SQL Server Native Client and SQL Server CLI Utilities if you have not already done so. To enable the download, the host computer must be able to connect to http://download.microsoft.com.

During both installation and ongoing operations, the Tanium Server must be able to connect to https://content.tanium.com to import updates to Tanium core components and modules. The Tanium Server may need to connect to additional locations, based on the components you import.

The following table lists URLs that are accessed by Tanium Server.

Import type Components URLs
Any Any https://content.tanium.com
http://*.digicert.com

Module import fails if the Certificate Revocation List is blocked or inaccessible.

Content Initial Content http://linux-usb.org
Managed Applications (login required) http://ardownload.adobe.com/

http://airdownload.adobe.com/

http://download.macromedia.com/

http://dl.google.com/

https://download.mozilla.org/

https://secure-appldnld.apple.com/

Windows Security Patch Management http://download.windowsupdate.com
IR Gatherer https://download.sysinternals.com
Modules IR https://download.sysinternals.com
Patch http://download.windowsupdate.com
IOC Detect https://download.sysinternals.com
Labs Content EMET https://download.microsoft.com
IR Memory https://github.com/google/rekall-profiles/raw/gh-pages/v1.0/*
MSERT https://definitionupdates.microsoft.com
Stinger http://downloadcenter.mcafee.com
Symantec https://support.symantec.com

Notes:

  • If a Tanium content pack or solution module is not listed, it means no additional URLs are required for it.
  • Previous Tanium Server versions required access to http://curl.haxx.se. Tanium Server 7.0 and later do not require access to this site.

If your enterprise security policy does not allow Tanium Server to access these locations directly, you can use proxy servers. See Reference: Proxy server settings.

If your enterprise network uses SSL intercept technologies, such as man-in-the-middle (MITM) proxies, you must configure them so that they do not prevent the Tanium Server and Tanium Module Server from downloading files from these locations.

If you plan to deploy Tanium into an air-gapped environment, consult with your TAM.

SSL certificates

The connections to the Tanium™ Console or SOAP and REST APIs, the connections between Tanium Server and Tanium Module Server, and connections to the Module Server are secured with SSL/TLS certificate and key exchanges.

When you run the installation wizards, you are prompted to generate a self-signed certificate or specify the location of an existing certificate and key that was issued by a commercial Certificate Authority (CA) or your own enterprise CA. We recommend that you use the self-signed certificate option when you complete the initial installation steps provided in this guide. Doing this facilitates troubleshooting by separating potential installation issues and SSL issues. After you have verified the deployment, you can copy the certificates issued by the commercial or enterprise CA in place of the self-signed certificate, as described in Reference: SSL certificates.

Administrator account privileges

Work with your Microsoft Active Directory administrator to provision the accounts needed for installation.

Table 4:   Administrator accounts used during installation
Host System Administrator Account Required Group or Privileges Purpose
Tanium Server host AD service account* Administrator**, Interactive Logon*** Installs the software and starts the Tanium Server service. The service runs in the context of the Local System or the AD account, depending on the option you select when you run the installer.
Tanium Module Server host AD service account* Administrator Installs the software and starts the Tanium Module Server service. The service runs in the context of the Local System account.
SQL Server host AD service account Sysadmin on the SQL Server When the installer is run from the Tanium Server, this service user connects remotely to the SQL Server and creates the tanium and tanium_archive databases.
AD service account DBO on Tanium DB After the Tanium databases have been created, you can downgrade the service account role from sysadmin. The account must have db_owner role membership for the Tanium databases. We also recommend View server state permission. This dynamic management view enables the Tanium Server to access data faster than the DBO role alone.
PostgreSQL Server host AD service account Administrator** When the installer is run from the Tanium Server, this service user connects remotely to the PostgreSQL Server and creates the tanium and tanium_archive databases.
Tanium Zone Server host AD service account* Administrator** Installs the software and starts the Tanium Zone Server service. The service runs in the context of the Local System or the AD account, depending on the option you select when you run the installer.
Tanium Client Deployment Tool host Local System or AD Administrator Connects to the endpoint and installs Tanium Client software.
Tanium Client host Local System Administrator On Windows, the service runs in the context of the Local System account.

*It is possible to use Local System in a POC deployment, but it is not supported for a production deployment.

** For installation and upgrades, the service account for the Tanium Server must have Administrator privileges. After installation or upgrade, you can reduce permissions to user-level permissions.

***Interactive Logon is required only during installation of the Tanium Server. It can be revoked after installation.

Last updated: 5/22/2018 3:02 PM | Feedback