Requirements

This topic summarizes the requirements for installing Tanium Core Platform servers.

For the host system requirements of the Tanium Client, see Tanium Client Management User Guide: Tanium Client and Client Management requirements.

Installation package and license files

Tanium provides the following installation package files and license file required to install the Tanium Server, Tanium Module Server, and Tanium Zone Server:

• SetupServer.exe
• SetupModuleServer.exe
• SetupZoneServer.exe
• tanium.license

The installation package for each of these three servers must have the same build number (for example, all must have build number 7.5.4.1158). To complete the procedures in this guide, be sure you can copy these files to, and between, the host computers.

The license is bound to the hostname you assign to the Tanium Server. In high availability (HA) deployments, the license must specify the hostnames of both Tanium Servers. Contact Tanium Support if the server hostnames change.

Server version and host system requirements

Table 1 summarizes basic requirements for Tanium Core Platform and database servers that are installed on customer-provided Windows infrastructure. For detailed version specifications and sizing guidelines, see Reference: Host system resource guidelines.

Tanium solutions (modules and shared services) might have additional requirements for Tanium Core Platform servers. Table 2 provides links to the user guide sections that list these requirements.

The Standard, Enterprise, and Datacenter editions of the following Windows Server platforms are supported. The Server Core and Nano Server options are not supported.

Click the links in the following table to see the minimum Tanium Core Platform version (Tanium dependencies) and other platform server requirements for each Tanium module and shared service.

Internet access, network connectivity, and firewalls

Internet URLs

During installation and ongoing operations, the Tanium Server and the web browser that you use to access the Tanium Console must connect to https://content.tanium.com to import updates to Tanium Core Platform components and modules. The Tanium Server might need to connect to additional URLs based on the components you import. For a list of the required URLs, see Tanium Core Platform Deployment Reference Guide: Internet URLs required.

Proxy server

If your enterprise network environment requires outbound Internet connections to traverse a proxy server, you can configure the proxy settings as described under Tanium Console User Guide: Configuring proxy server settings.

Ports and firewalls

The following table summarizes the Tanium processes and default values for ports used in Tanium Core Platform communication. Host and network firewalls might require configuration to allow the specified processes to send and receive TCP data over the listed ports. The Tanium installer opens required ports in the Windows host firewall. You must work with your network security administrator to ensure the platform components can communicate through any security barriers (such as firewalls) in their communication path. For a detailed explanation, see Tanium Core Platform Deployment Reference Guide: Network ports. Your security administrator might also need to create rules to exempt or exclude Tanium processes that run on the host computers from blocking by antivirus or processing by encryption or other security and management stack software. For details, see Tanium Core Platform Deployment Reference Guide: Host system security exceptions.

Configure firewall policies to open ports for Tanium traffic with TCP-based rules instead of application identity-based rules. For example, on a Palo Alto Networks firewall, configure the rules with service objects or service groups instead of application objects or application groups.

Network communication ports used by Tanium components

Source	Destination	Port	Protocol	Purpose
Tanium Server, Module Server	External servers	443, 80	TCP	Tanium Server (TaniumReceiver.exe) or Module Server (TaniumModuleServer.exe) communication with external servers such as content.tanium.com
Tanium Server	Tanium Server	443, 17472	TCP	Communication between active-active Tanium Servers
Tanium Server	Module Server	17477	TCP	Tanium Server communication with the Module Server
Module Server	Tanium Server	443	TCP	Tanium Module Server communication with the Tanium Server
Tanium Server	Tanium database	1433, 5432	TCP	Tanium Server communication with the Tanium database: SQL server (Sqlservr.exe) or PostgreSQL server (postgres.exe)
Zone Server Hub	Zone Server	17472	TCP	Zone Server Hub (TaniumZoneServer.exe) communication with the Zone Server (TaniumZoneServer.exe)
Tanium Clients	Tanium Clients, Tanium Server, Zone Server	17472	TCP	Communication between Tanium Clients (TaniumClient.exe), Communication between the clients and the Tanium Server or Zone Server
Console/API users	Tanium Server	443	TCP	Tanium Console/API user workstation (browser) communication with the Tanium Server
Console/API users	External servers	443, 80	TCP	Tanium Console/API user workstation (browser) communication with external servers such as content.tanium.com
To improve the security of the Zone Server, configure separate ports for traffic from Zone Server Hubs and Tanium Clients. For the steps, see Configure ports for traffic from Zone Server Hubs and Tanium Clients.

The following figure illustrates how the Tanium Core Platform uses ports in an active-active deployment with Windows infrastructure:

For the topology of deployments that use a proxy server between Tanium Core Platform servers and external servers, see Tanium Console User Guide: Overview of proxy servers.

Tanium™ Direct Connect uses additional ports for communication between Tanium Clients and the Module Server. See Tanium Direct Connect User Guide: Host and network security requirements.

For more information about the port requirements of other Tanium modules and shared services, see the Tanium Core Platform Deployment Reference Guide: Solution-specific port requirements.

Administrator account permissions

Work with your Microsoft Active Directory (AD) administrator to provision the accounts needed during Tanium Core Platform installations or upgrades and for post-installation or post-upgrade activities. To change accounts or update their passwords, see Tanium Console User Guide: Windows service accounts.

Administrator accounts for installations and upgrades

The following table lists the administrator accounts required to install or upgrade Tanium Core Platform servers, create Tanium databases, or deploy Tanium Clients. You can use a single service account to install the Tanium Server and to create databases on the SQL or PostgreSQL server, as long as the account has the all required group memberships and permissions for those servers. You can also use a single service account to install the Zone Server and Zone Server Hub. You must use a separate service account to install the Module Server.

Administrator accounts for post-installation/upgrade activities

The following table lists the administrator accounts required for regular, ongoing operations performed after installations or upgrades, including running the services for Tanium Core Platform servers and Tanium Clients, and accessing Tanium databases. If you reuse the accounts used for installations and upgrades, first reduce the account permissions to those specified in the following table. You can use a single service account to run the Tanium Server service and access the Tanium databases. You can also use a single service account to run the Zone Server and Zone Server Hub services. You must use a separate service account to run the Module Server service.