Completing the initial setup (physical Tanium Appliance)

Configure basic network, host, and user settings before you install a Tanium Appliance role.

Requirements

License	Contact Tanium Support to obtain a valid license. Tanium Support must know the fully qualified domain name (FQDN) for each Tanium Server appliance in your deployment to generate your license file.
Network	Be ready to specify the static IP address in CIDR format (such as 192.168.2.0/24), default gateway IP address, host name, domain name, primary and secondary DNS servers, and NTP servers.

The Tanium Appliance does not support LACP or respond to LACP packets. On a switch that is connected to a Tanium Appliance, either disable LACP or configure the switch to enable LACP only on ports where an LACP device is detected. After initial configuration is complete, a user with the tanadmin role can configure static NIC teaming on the appliance to provide link redundancy.

In rare circumstances, a physical Tanium Appliance might fail to boot and hang at the TanOS boot screen. In this situation, it is best to disable LLDP at the switch or in the appliance BIOS. LLDP is not supported or required by TanOS. Contact Tanium Support for more information.

(FIPS-compliant organizations) Enable FIPS 140-3 mode before initial setup

Configuration options

• Configure iDRAC if you want to configure the tanremote user account and then continue from the iDRAC interface with initial configuration.
• Configure IP address only if you want to complete the network configuration from the console and then later resume initial configuration elsewhere (for example, in a different location through an SSH connection).

• Perform full initial configuration if you want to configure the tanadmin account and then complete all of the initial configuration steps at once from the console.

Configure iDRAC

Configure IP address only

Perform full initial configuration

Access TanOS remotely

To access your Tanium Appliances remotely, note the following requirements.

• Your local management computer must be connected to a subnet that can reach the appliance IP address.
• Your management computer must have an SSH client application or terminal emulator that can make a client connection to the appliance.
• You must have an SSH client such as PuTTY to sign in to the TanOS console. For PuTTY, use version 0.71 or later.
• You must have an SSH key generator such as ssh-keygen to generate keys for the tancopy user.
• You must have an SFTP client such as WinSCP to copy files to and from the appliance. For WinSCP, use version 5.15.2 or later.

Watch the tutorial about how to configure WinSCP for the Tanium Appliance.

Configure SSH keys

TanOS has built-in and customer-created user accounts to access the appliance operating system and perform tasks.

Before you install a Tanium Appliance role, you must add SSH keys to authenticate access for the tancopy built-in user. tancopy can make an SFTP connection with SSH key authentication to TanOS and copy files to and from the /incoming and /outgoing directories.

TanOS does not support self-service password reset methods. If you forget your password, you must ask a user with the tanadmin role to reset it for you. You can avoid this risk by setting up SSH key authentication.

Watch the tutorial about how to configure SSH key authentication for the Tanium Appliance.

Before you begin

• You must have an SSH client to sign in to the TanOS console, and an SFTP client to copy files to and from the appliance.
• You must have an SSH key generator to generate keys for the tancopy user.

Add SSH keys

You must set up an SSH key for the tancopy user. For the best results, set up SSH key authentication for TanOS user accounts.

Add SSH keys for the tancopy user

You must set up an SSH key for the tancopy user. The SSH key is used when you transfer files through SFTP to the /incoming and /outgoing directories.

1. Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
   • Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
   • Specify a passphrase that is easy to remember.
   • Save the private key to a location that you can access when you set up your SFTP client.
2. Copy the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.

   In an SSH key exchange, the keys must match exactly, including line endings.

3. Sign in to the TanOS console as a user with the tanadmin role.

4. Enter C-U (User Administration > TanOS User Management).

5. Enter the line number for the tancopy user to go to the user administration menu for this user. View screen

   >>> User Administration -> TanOS -> tancopy <<< 
   
    Username:        tancopy 
    Account Enabled: Yes
    Authentication:  SSH Key Only
    SSH Lockout:     No (0)
    Multi-Factor:    Not configured
    
    Notes:
      * This user account cannot be deleted
      * This user account cannot have a password
      * This user account cannot use multi-factor
   
             A: Manage SSH Authorized Keys
             P: Manage SSH Key Pair
             L: Reset SSH Lockout
             C: [DISABLED] Change Password
             N: [DISABLED] Disable Password Access
             M: [DISABLED] Multi-Factor Authentication
   
             E: Enable Account
             D: Disable Account
             X: [DISABLED] Delete User
   
             F: Edit known hosts file
   
             R: Return to previous menu  RR: Return to top
   
   ------------------------------------------------------

6. Enter A (Authorized Keys).

7. Enter A and follow the prompts to add the contents of the public key generated in Step 1. View screen

   >>> User Administration -> TanOS -> tancopy -> Authorized Keys -> Add <<< 
   
   Account: tancopy
   Please paste the public key and press enter: 
   ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA1ClmgkMrbbxB7jND/Y4/Giupck35xAuGNKfZWqVLM5F0CNXuTScf6v2z
   MDxW5TO5tm/U8P9sqh19RDEzTn2RayXzsoZmXyB8abCCpHG4+03Zv05RHiX4i5QomAMBnbZejdA9/fGTxO1rPo1rdtTq
   Z+KCgzbEhHLWUD44+If5RtG+U4kgyzlYsyjgwhfho+BrRY6e7QYBsXVbuBQ9ROGV6PCTB80jXZVAKrAbsTQ1DVkpuBue
   mftv7vOn3b8MKzJ/IY/LLL1tIgpSGvgvjr2mOJJ+JoZF2XnPVUFmYiDSCkPAzhCyFHILHfOVAfws9n1G6p3fwILqNhvB
   oPeaCFaApQ== rsa-key-20200123
    Validating input
    Adding key to authorized keys after validation
    Finished adding authorized keys for tancopy
   
   
    Press enter to continue

8. To test, on your management computer, set up an SFTP client such as WinSCP to connect to the Tanium Server appliance:
   1. Specify tancopy for user name.
   2. Click Advanced.
   3. Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
   4. Save the configuration and click Login to initiate the connection.

   You should be able to connect to the appliance and see the /incoming and /outgoing directories.

 

Add SSH keys for TanOS users

It is a best practice to also set up SSH key authentication for TanOS user accounts.

As an alternative to the following procedure, you can use ssh-copy-id to add an SSH public key to any TanOS user with the tanadmin profile.

1. Use an SSH key generator such as ssh-keygen to generate a public/private key pair. Note:
   • Specify an RSA key with 2048 bits (such as ssh-keygen -t rsa -b 2048).
   • Specify a passphrase that is easy to remember.
   • Save the private key to a location that you can access when you set up your SFTP client.
2. Copy all of the text in the public key file to the clipboard. If you use ssh-keygen, copy the contents of the .pub file that you created.

   In an SSH key exchange, the keys must match exactly, including line endings.

3. Sign in to the TanOS console as a user with the tanadmin role.

4. Enter C-U (User Administration > TanOS User Management).

5. Enter the line number of the user account that you want to manage. View screen

   >>> User Administration -> TanOS -> tanadmin <<<
   
    Username:        tanadmin 
    Account Enabled: Yes
    Authentication:  SSH Key or Password
    SSH Lockout:     No (0)
   
    Notes:
      * This user account must always have a password
      * This user account cannot be deleted
      * This user account cannot be disabled
   
             A: Manage SSH Authorized Keys
             P: Manage SSH Key Pair
             L: Reset SSH Lockout
             C: Change/Enable Password (Chosen)
             N: [DISABLED] Disable Password Access
             M: Multi-Factor Authentication
   
             E: [DISABLED] Enable Account
             D: [DISABLED] Disable Account
             X: [DISABLED] Delete User
   
             F: Edit known hosts file
   
             R: Return to previous menu  RR: Return to top

6. Enter A (Authorized Keys).

7. Enter A and follow the prompts to paste the public key generated in Step 1. View screen

   >>> User Administration -> TanOS -> tanadmin -> Authorized Keys -> Add <<< 
   
    Account: tanadmin 
    Please paste the public key and press enter: 
   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqXUnoyrg4opYQp4DGZoasYy8ud5oJEar9BqRr2RVHMm/Sxcl4T1sthsN
   WS0ECo0j32mCSM3ynYZn2AdJTU6HbKnFM30gtQL7+tpmGrgbkaVEJ9OXoA47JP0o5hbI16UUpuEKJrEBOYovIsrN2gtwKbz
   YdOVCxVq5amzqg7/UrQyUO3rmt54qStiqNIiHI3UjzPWYJwUxz90vU7LWsXYz1CAWBTXnh51kg0lBPFgbRmUZJb0DwLb4Sw
   lFZAe5P0RO4RwdmZVgTfsqy+MVuyzaBzGD1z4MlIZ83R6sW+nXtipbzqhFTLykLRLIXobuHjuf0Yy1H7/ZDJh/qlojce4TC
   g/+5e2h1RQ8ZKgECZDJoCdrkAM6y9arHCoZwqEP9MXugQXCO6EMrP39vXajnV3YrDKKLYP1pxWZGOA4ylNqY5mG1+AofVdG
   vAUBztjXfXgC3bgL0Qgp+d3E8JvLRHXfkmRijppvj+BCJUawXJfkMtBEgrxQP9PoDwHrqJj6ey80v8P7DgojQw83JumsG3S
   +7l0e0Ia02q/05s2EpOv9jE9aJiLRGKbb4WkjvUSpK1VmDK54qfeSKj6yp3IIt13GBKmkVqKbbZS6gaZ3UTpzq3dj+53YeP
   eOe8XMECuxl6aH4nLT4u3CqrCqxTfTa5y1Fi3/e9zI5/AKJlTXWF3ISCQ== [email protected]
    Validating input
    Adding key to authorized keys after validation
    Finished adding authorized keys for tanadmin
   
   
    Press enter to continue

8. To test, on your management computer, set up an SSH client such as PuTTY to connect to the Tanium Server appliance:
   1. Specify the Tanium Server IP address, port 22, and SSH connection type.
   2. Under SSH, browse and select the private key that pairs with the public key uploaded to the appliance.
   3. Open the SSH session and enter the tanadmin user name.
   4. You are prompted for the SSH key passphrase instead of the tanadmin password. View screen

      login as: tanadmin
      
      ######################## WARNING ########################
      
             Unauthorized access is strictly prohibited.
      
      #########################################################
      
      Authenticating with public key "rsa-key-20200119"
      Passphrase for key "rsa-key-20200119":

Add TanOS system users

Create additional TanOS system users based on tanadmin (privileged) and tanuser (restricted) profiles.

Create more than one privileged user with the tanadmin role in case you forget the password for the built-in tanadmin user.

1. Sign in to the TanOS console as a user with the tanadmin role.

2. Enter C-U (User Administration > TanOS User Management).

3. Enter A and follow the prompts to add a system user. View screen

   >>> User Administration -> System Users -> Add System User <<< 
   
    Adding a system user requires first name, last name, user name and user role.
   
    Attention: 
    TanUser Role:  Monitor/Check the status of the appliance, no changes are allowed
    TanAdmin Role: Full administrative role to manage the appliance
   
    A temporary password will be generated and the new user is required to change 
    their password upon first login! 
   
    The password policy requires meeting these rules:
    - Minimum of 10 characters long
    - At least 1 upper case character
    - At least 1 lower case character
    - At least 1 numeric character
    - At least 1 other character
    - Must not match any of recent 4 passwords
    - Must not be based on a dictionary word
    - Must not contain part of the username
   
    Please enter first name: John
    Please enter last name: Doe
    Please enter desired user name (max 30 chars): john.doe
    Which role should be assigned to john.doe?
   
    1: TanUser (Monitoring)
    2: TanAdmin (Administrative)
   
    Please select: 2
   
    The temporary password for john.doe is: proudbrownwildfowl
   
    Adding local user john doe ...
    Successfully added user john doe (username: john.doe) with role tanadmin.
   
    Press enter to continue

 

Export the RAID controller security key

The RAID controller security key is used by the controller to lock and unlock access to encryption-capable physical disks. You can export the key and store it in a safe location. During recovery from controller failure, you will need to provide the key. When you run a Health Check, you might see messages alerting you to export the RAID controller security key.

Boot Check: Pass (EFI Boot)
Active partition: pass (VolGroup1-root)

>>> Hardware health (will take 1-12 seconds) <<<
hardware type: pass (TV-220)
RAID controller RAID.Integrated.1-1 Security Key: pass
disk encryption: pass


>>> RAID Controller Security Key <<<

RAID Security key check: fail (key has NOT been exported)  <-------- 

>>> Tanium Application file Permissions <<<

executed checks: 48
failed checks: 4
new health status setting: warning

1. Sign in to the TanOS console as a user with the tanadmin role.

2. Enter A-X-5 (Appliance Configuration > Advanced Configuration > Export RAID Controller Security Key).

3. Follow the prompts to export the RAID controller security key to the /outgoing directory. View screen

   >>> Appliance Configuration -> Advanced Menu -> Export Security Key <<< 
   
   Once the security key has been placed in the outgoing directory it
   will remain until the nightly cleanup job is run. After this time it
   will be deleted and must be exported again.
   Please be sure to download it and save in a secure location.
   
   Would you like to export the security key? [Yes|No]: yes
   
   The security key has been placed in the sftp outgoing directory.
   This location will be cleaned daily at 02:00am appliance time!
   
   Press enter to continue

4. Use SFTP to copy the file from the /outgoing directory to your local computer.

Files copied to the /outgoing directory that are older than 24 hours are deleted every day at 02:00 AM UTC. You should copy the RAID controller security key file from the /outgoing directory to your local computer immediately after you have used the TanOS menu to export it and save it in a protected location. If you lose the RAID controller key file, you can return to the Advanced Menu and export the key file again.

The default name of the RAID controller key file is TanOS-key-controller-Cfg.tgz. It is recommended to change the name to include the host name or serial number of the appliance it came from before you store it. You likely have more than one appliance, so a name based on a unique host name or serial number is useful if you later need to locate the correct file.

Export the grub key

The grub key can be used during the boot sequence to diagnose and recover from failure conditions. You can export the key and store it in a safe location. During recovery, you need to provide the key to Tanium Support for a technician to extract the grub password.

1. Sign in to the TanOS console as a user with the tanadmin role.

2. Enter A-X (Appliance Configuration > Advanced Configuration).

3. Enter 6 and follow the prompts to export the grub key to the /outgoing folder. View screen

   >>> Appliance Configuration -> Advanced Menu -> Export Security Key <<< 
   
   Once the security key has been placed in the outgoing directory it
   will remain until the nightly cleanup job is run. After this time it
   will be deleted and must be exported again.
   Please be sure to download it and save in a secure location.
   
   Would you like to export the security key? [Yes|No]: yes
   
   The security key has been placed in the sftp outgoing directory.
   This location will be cleaned daily at 02:00am appliance time!
   
   Press enter to continue

4. Use SFTP to copy the file from the /outgoing directory to your local computer.

What to do next

• It is a best practice to complete iDRAC configuration before you install Tanium Core Platform servers. See Manage the iDRAC interface (physical Tanium Appliances only).
• When these steps are completed, you can continue with the installation of an Appliance Array.