Reference: TanOS command line interface

Add another appliance to the Appliance Array that is defined on the current appliance. Format:

ssh -qt user@appliance add array member <ip_address>

This command requires you to access the CLI as the tanadmin user. It is not available for other users with the tanadmin role.

Use a JSON document to assign the desired roles to array members and perform necessary setup steps. Command actions are:

• show: Provides a template for the JSON configuration file. Requires no input.

  Example:

  ssh -q user@appliance array assign roles show >config.json

• dryrun: Using JSON on stdin, display the actions. Example:

  ssh -q user@appliance array assign roles dryrun <config.json

• apply: Using JSON on stdin, apply the requested changes. Example:

  ssh -q user@appliance array assign roles apply <config.json

In the JSON configuration file template you retrieve from the array assign roles show command, you typically must configure the following settings:

• password_b64: The base64-encoded password for the Tanium Console admin user that is specified for the tanium_username setting.

• role: The role to assign for each array member, using one of the following numeric settings:

  • 1: All-in-One
  • 2: Tanium Server
  • 3: Tanium Module Server
  • 4: Tanium Zone Server

Create backups of the active partitions by copying their contents to the inactive partitions for each affected appliance in the array. This may take a while to complete. Tanium services are stopped during the backup. Appliances that do not have alternate partitions are not affected.

Upgrade the operating system for all appliances in the array. Run this command only on the primary Tanium Server in the array. Specify the upgrade version or use the --interactive flag to select from a list of options. Format:

ssh -qt user@appliance array upgrade appliance <TanOS_version>

Upgrade the Tanium software on all appliances in the array.

Load all RPMs to the incoming directory on the primary Tanium Server before running this command.

Specify the upgrade version or use the --interactive flag to select from a list of options. Format:

ssh -qt user@appliance array upgrade tanium <Tanium_version>

ssh -qt user@appliance create array <ip_address> <name of array>

Promote an array member with the Tanium Server role to be the array manager. Specify the serial number of the Tanium Server to promote. Format:

ssh -qt user@appliance promote member <serial_number>

Create a Tanium Support Gatherer (TSG) ZIP file, list the types of TSGs that you can create, and upload a TSG ZIP file to an SFTP location.

Available options:

• --list - List the available TSG types for this appliance.

  Format:
  create tsg --list
  Usage example: 
  ssh -qt user@appliance create tsg --list

• type - Specify the TSG type, such as appliance or a specific solution.

  Format:
  create tsg <type>

  Usage example: 
  ssh -qt user@appliance create tsg connect

• sftp-destination - SFTP destination where the TSG will be uploaded

  Format:

  create tsg <type> <sftpuser@host:destination>

  Where sftpuser is the user name for the SFTP destination, host is the SFTP location's IP address or fully qualified domain name (FQDN), and destination is the destination directory and file name for the TSG. If you do not include a destination, the TSG is uploaded to the SFTP server's home directory with the default generated file name.

  The following example includes the A option to use agent forwarding to authenticate with the SFTP destination. Agent forwarding requires an SSH agent (such as ssh-agent in OpenSSH) to be running on your local host. For more information, see the documentation for your SSH client. Alternatively, you can generate an SSH key pair using the TanOS console for the specified TanOS user and add the public key to the SFTP destination's authorized keys. For information, see Manage SSH keys.

  Usage example:
  ssh -qtA user@appliance create tsg appliance [email protected]:newfilename.zip

Install, upgrade or remove the Direct Connect (DEC) Zone Proxy.

Available options:

• list: List the available DEC proxy versions.
• install <version>: Install the selected version of DEC proxy.
• remove: Uninstall the DEC proxy.
• show <item>: Show the current DEC proxy status (version or apipayload).
• show instructions: Show instructions for how to configure a DEC proxy.

Manage performance data collection.

Tools:

• perf record - Record performance data.

  Format:
  performance perf record <duration> <options>
  Where duration is the number of seconds to record.
  Usage examples: 
  ssh -q user@appliance performance perf record 60 -t

• perf top - Monitor a performance counter in real-time. This command requires the ssh -t option. To exit, press Q.

  Format:
  performance perf top <options>

  Usage example: 
  ssh -qt user@appliance performance perf top

• vmstat - Monitor virtual memory statistics.
  

  Format:
  performance vmstat <delay> <count> <options>
  Where delay is the number of seconds between updates, and count is the number of times to show statistics. For example, if you enter a delay of 3 and a count of 10, the command shows statistics every three seconds for ten times (total duration is 30 seconds). If you omit the count, the command returns statistics according to the delay until you press Ctrl-C.

  Usage example:
  ssh -qt user@appliance performance vmstat 3 10

• iostat - Monitor I/O statistics.
  

  Format:
  performance iostat <delay> <count>
  Where delay is the number of seconds between updates, and count is the number of times to show statistics. For example, if you enter a delay of 3 and a count of 10, the command shows statistics every three seconds for ten times (total duration is 30 seconds). If you omit the count, the command returns statistics according to the delay until you press Ctrl-C.

  Usage example:
  ssh -qt user@appliance performance iostat 1

• pidstat - Monitor individual processes.
  

  Format:
  performance pidstat <delay> <count>
  Where delay is the number of seconds between updates, and count is the number of times to show statistics. For example, if you enter a delay of 3 and a count of 10, the command shows statistics every three seconds for ten times (total duration is 30 seconds). If you omit the count, the command returns statistics according to the delay until you press Ctrl-C.

  Usage example:
  ssh -qt user@appliance performance pidstat 1 5 -t

• htop - Monitor process usage in real-time. This command requires the ssh -t option. To exit, press Q.

  Format:
  performance htop <options>

  Usage example: 
  ssh -qt user@appliance performance htop -t

• iotop - Monitor I/O usage in real-time. This command requires the ssh -t option. To exit, press Q.

  Format:
  performance perf top <options>

  Usage example: 
  ssh -qt user@appliance performance perf top <options>

Options:

• -t - Limit results to Tanium-related process. This option is unavailable for the iostat and pidstat tools.
• -D - Data clean-up, for when a command is interrupted.

Report basic information for the appliance, including the serial number, server name, TanOS version, role, and Tanium version.

This command is available to users with the tanuser role.

Set the public key to encrypt backup files. The public key must be in PEM format.

Usage example:
ssh -qt user@appliance set fqdn appliance.example.com

Usage example:
ssh -qt user@appliance set nameservers 8.8.8.8 9.9.9.9

Show the NTP servers that are configured and connection information.

This command is available to users with the tanuser role.

Add entries to the authorized_keys file for the user.

This command is available to users with the tanuser role.

Remove entries from the authorized_keys file for the user. The command prompts you to paste the contents of keys to delete, or you can provide a list of key contents on stdin.

This command is available to users with the tanuser role.

Format:

ssh -qt user@appliance delete pubkeys

Add entries to a user's SSH known_hosts file.

You can provide fingerprints for the remote host on stdin, or you can use the scan action to automatically discover and add the fingerprints of a remote host. For example:

ssh -qt user@array_manager register ssh-host 192.168.15.115 <fingerprints.txt
ssh -qt user@array_manager register ssh-host 192.168.15.253 scan

For a higher level of security, explicitly provide the fingerprints that you have verified to belong to the remote host on stdin.

Show the user's SSH public keys.

Key types:

• identity - Show the identity public key file for the user (id_rsa.pub).
• authorized_keys - Show entries in the authorized_keys file for the user.

Add a Tanium Console user account to the local authentication service. You can run the command interactively or non-interactively, such as through an external system. Requires entering the password for the new user to proceed when run interactively. When run non-interactively, requires the password for the new user on the standard input stream. Format:

ssh -qt user@appliance local-auth add user username first_name last_name

Delete a Tanium Console user account from the local authentication service. Format:

ssh -qt user@appliance local-auth delete user username

List Tanium Console user accounts in the local authentication service. Format:

ssh -qt user@appliance local-auth list users

Set the password for Tanium Console user in from the local authentication service. You can run the command interactively or non-interactively, such as through an external system. Requires entering the the new password to proceed when run interactively. When run non-interactively, requires the new password on the standard input stream. Format:

ssh -qt user@appliance local-auth set password username