Reference: Proxy server settings
Some organizations use proxy servers for traffic between internal servers and the Internet. If your organization uses proxies and its security policy does not allow Tanium Core Platform servers to access Internet locations directly, you can configure access through the proxies. The Tanium Server connects to the Internet to download content updates from Tanium and necessary files from other trusted suppliers (for a list of sites the Tanium Server accesses, see Internet access (direct or by proxy). The Tanium Module Server connects to the Internet to download solution module software updates from Tanium. Solution modules also might have requirements to access the Internet.
The proxy server configuration is stored in configuration files on the Tanium Server host. Tanium Servers do not automatically sync the configuration files among high availability (HA) peers. If you change these settings in HA deployments, be sure to perform the procedure on all Tanium Servers in the HA cluster.
Basic proxies might require authentication; you can configure the account ID and password. A strictly IP-address-based proxy server allows a specified list of servers to traverse the proxy and access the network or Internet. If this is the case, be sure to add the IP address or hostname of the Tanium Server to the access list of the proxy server.
If the proxy server is set up to use NTLM, and you configured the Tanium Server service on Windows to run in the context of a service account that has sufficient privileges to traverse the proxy server, you do not have to configure the account ID and password.
- Go to Configuration > Common > Proxy Settings.
- Use the Tanium Server Proxy Settings box to specify proxy settings for the Tanium Server connections.
- Optional. To propagate the Tanium Server Proxy Settings to the Module Server Proxy Settings, select Mirror Changes to Module Server.
- Save your changes.
- Use the Module Server Proxy Settings box to specify proxy settings for the Module Server connections if they differ from the proxy settings for the Tanium Server.
- Save your changes.
- Use the Validate Proxy Settings box to test your settings.
- From Tanium—Use predefined settings for a connection to content.tanium.com.
- From Random Site—Use predefined settings for a connection to www.msftncsi.com.
- Specify URL/Hash—Configure your own test settings.
- Click Start Download.
The Tanium Console returns a success or failure message. If the test fails, check that the proxy server is up and is configured as expected. Also, check that the Tanium settings you specified match the settings that the proxy server expects. The TDownloader logs have detailed event messages: see Tanium Core Platform Deployment Reference Guide: Logs.
IP address of the proxy server.
|Proxy User ID||For a basic proxy that requires authentication, enter an account username to establish the connection with the proxy server. This setting does not apply NTLM proxies, which use the credentials of the user context that runs the Tanium Server service.|
|Proxy Type||The options are Basic, NTLM, or None.|
|Port Number||Port number of the proxy server.|
|Proxy Password||For a basic proxy that requires authentication, enter an account password to establish the connection with the proxy server. The password is stored in clear text within the registry. This setting does not apply NTLM proxies, which use the credentials of the user context that runs the Tanium Server service.|
|Bypass Proxy Host List||
You might need to configure exceptions so that connections to specific hosts bypass the proxy server. For example, do not use a proxy server for traffic among Tanium Servers in an active-active cluster.
A proxy server can cause problems with other traffic to a destination Tanium Server. For example, a package configuration can specify file URIs that are local to the Tanium Server to download content. It is important to bypass the proxy server for these URIs, or else the download will fail.
Enter the exceptions as FQDNs or IP addresses.
Specify literal values. Tanium Core Platform 7.0.314.6242 and later supports wildcards.
|Bypass CRL Check Host List||Use this setting to list servers that the Tanium Server can trust without checking a certificate revocation list (CRL). The Tanium Server performs a CRL check on all servers that are not in this list, and does not download files from a server that fails the check. Specify the servers by FQDN or IP address.
|Trusted Host List||
Use this setting to list the trusted servers that the Tanium Server can download files from even if those servers do not have valid SSL certificates. In an active-active cluster, specify both Tanium Servers. Tanium core platform 7.0.314.6242 and later supports wildcards. Specify the servers by FQDN or IP address.
|Component||Tanium Server or Module Server.|
|URL||If you set the File Source to Specify URL/Hash, specify the URL.|
|Hash||If you set the File Source to Specify URL/Hash, specify the hash.|
|Download Time||If you set the File Source to Specify URL/Hash, specify a maximum download time before returning a failure message.|
Only users assigned the Administrator reserved role can see and use the Configuration pages. In Windows installations, the proxy settings are written to the Windows Registry. You can change settings in the registry directly (see Tanium Core Platform Deployment Reference Guide: Settings). Be sure to edit only the Tanium Server entry, not the Tanium Module Server entry, in the registries of both the Tanium Server host and the Tanium Module Server host.
Last updated: 4/18/2019 8:02 AM | Feedback