Tanium™ Client Deployment Guide Version 6.0.314.XXXX February 05, 2018 The information in this document is subject to change without notice. Further, the information provided in this document is provided “as is” and is believed to be accurate, but is presented without any warranty of any kind, express or implied, except as provided in Tanium’s customer sales terms and conditions. Unless so otherwise provided, Tanium assumes no liability whatsoever, and in no event shall Tanium or its suppliers be liable for any indirect, special, consequential, or incidental damages, including without limitation, lost profits or loss or damage to data arising out of the use or inability to use this document, even if Tanium Inc. has been advised of the possibility of such damages. Any IP addresses used in this document are not intended to be actual addresses. Any examples, command display output, network topology diagrams, and other figures included in this document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental. Please visit https://docs.tanium.com for the most current Tanium product documentation. Tanium is a trademark of Tanium, Inc. in the U.S. and other countries. Third-party trademarks mentioned are the property of their respective owners. © 2018 Tanium Inc. All rights reserved. © 2018 Tanium Inc. All Rights Reserved Page 2 Table of contents Overview 8 What is the Tanium Client? 8 Registration 9 Client peering 9 File distribution 11 Prerequisites 14 Host system requirements 14 Admin account 15 Network connectivity and firewall 16 Host system security exceptions 16 Deployment options summary 18 Using the Tanium Client Deployment Tool 21 Methods 21 Before you begin 21 Install the Client Deployment Tool 23 Deploy the Tanium Client 25 Check for Tanium Client updates 32 Troubleshooting 33 Logs 34 Advanced settings 34 Deploying the Tanium Client to Windows endpoints 36 Step 1: Create the installer 36 Step 2: Execute the installer 37 © 2018 Tanium Inc. All Rights Reserved Page 3 EXE 37 MSI 37 Install wizard 38 Command line 39 Example: Silent "Express" installation 40 Example: Specifying Multiple Tanium Server Names 40 Example: Silent "Custom" installation 41 Example: Batch file format 41 Example: Use advanced CDT options 41 Step 1: Create a special installer 43 Step 2: Use the special installer to install the Tanium Client on host computers 45 Uninstall 45 Use a Tanium package 46 Use Add/Remove Programs 46 Uninstall program 46 Deploying the Tanium Client to Mac endpoints 48 Step 1: Create the installer 48 Step 2: Execute the installer 48 Web UI installation 48 Command-line installation 50 Manage the Tanium Client Mac OS service 50 Uninstall 51 Deploying the Tanium Client to Linux endpoints 53 Install the Tanium Client 54 Manage the Tanium Client Linux service 56 © 2018 Tanium Inc. All Rights Reserved Page 4 Example: Add Custom Tags to the client installation directory 56 Uninstall 58 Deploying the Tanium Client to Solaris endpoints 59 Before you begin 59 Install the Tanium Client 60 Unattended Tanium Client installation 61 Configure the Tanium Client 62 Manage the Tanium Client Solaris service 62 Creating a package for IPS 63 Uninstall 67 Deploying the Tanium Client to AIX endpoints 68 Install the Tanium Client 68 Manage the Tanium Client AIX service 69 Uninstall 69 Preparing the Tanium Client on OS images 70 Windows OS 70 Linux OS 72 Mac OS X 74 VDI 76 Configuring the connection with Tanium Server 78 ServerName 78 ServerNameList 78 LastGoodServerName 78 Using the Tanium Console to set ServerName 78 Configuring Tanium Client peering 83 © 2018 Tanium Inc. All Rights Reserved Page 5 Default behavior 83 Example: Setting AddressMask to /22 85 Configure the AddressMask setting 88 Configure DesiredNeighborhoodSize 89 Configure "separated subnets" 90 Configure "isolated subnets" 91 Verify changes 94 Use the Tanium Console 94 Examine the client configuration 96 Using client-related Tanium content 98 Initial Content 98 Client Maintenance 100 Client Upgrade 102 Client Service Hardening 106 Advanced tuning 115 Troubleshooting 116 Tanium Client installation paths 116 Tanium Client Windows Registry 116 TaniumClient.ini settings 119 Tanium Client logs 121 Action logs 122 Action_XXX folders 122 Action_XXX.log files 123 Action log cleanup 124 Contacting Tanium support 124 © 2018 Tanium Inc. All Rights Reserved Page 6 Change log 125 © 2018 Tanium Inc. All Rights Reserved Page 7 Overview This guide describes how to deploy the Tanium™ Client to enterprise endpoints. What is the Tanium Client? The Tanium Client is a service installed on endpoint computers. In response to your questions, it discovers and reports within seconds both static and dynamic real-time data pertaining to the endpoint, including: l Hardware and software inventory l Software configuration l Local or domain user details l Installed application or services, startup programs, and running processes l Existence of registry keys and their values l WMI data elements l File system details, including identification of files by hash or contents l Event log results l Network configuration settings and state With similar speed, the Tanium Client can be used to execute commands, actions, scripts, or other executable programs just as if an authorized administrator were taking actions from the command line on the target device. For example, you can send the Tanium Client an instruction to take the following actions: l Install or uninstall applications or services l Update or patch installed applications, services, hardware drivers, or firmware l Manage installed applications or services l Add, remove, or modify the Windows Registry settings or other configuration stores l Add, remove, or modify files or the contents of files l Start or stop services These powerful features enable large, geographically distributed organizations to identify and respond to a zero-day exploit, security breach, or application outage in a matter of seconds or minutes rather than days and weeks. © 2018 Tanium Inc. All Rights Reserved Page 8 Registration When the Tanium Client software is first deployed to an endpoint, it initiates a direct connection to the Tanium Server assigned to it in the initial configuration. During initial registration, the Tanium Client establishes a unique ID and receives from the Tanium Server the latest client settings, a list of nearby peers, and the latest sensor, question, and scheduled action definitions. By default, the initial registration status is configured to reset approximately every four hours, forcing the Tanium Client to re-initialize registration. This ensures the latest settings are applied and that optimal peers are selected. The Tanium Client also re-registers with the Tanium Server via a normal registration that happens at a defined registration interval. The default registration interval is a randomized time between 30 and 90 seconds. During a normal registration, the Tanium Client informs the Tanium Server of its current state of questions, actions, and settings; and, in response, the Tanium Server sends new questions, actions, or settings to apply. In large environments, normal registrations are the primary way that new questions, actions, and settings get communicated to Tanium Clients. Client peering In an enterprise network, the Tanium Clients establish peering relationships. Peer connections are continual, long-lived connections used to exchange Tanium messages and files. Information and data are forwarded along linear chains of peers. During registration, the Tanium Client receives a "peer list" of other Tanium Clients to which it may attempt to establish a peer connection. The Tanium Client uses the list to determine which neighbors are the most optimal network peers. Figure 1: Types of peers By default, the linear chains form into groups of 100. These groups are known as neighborhoods. By design, each neighborhood has one forward leader and one backward leader at the ends of the chain. Other than at registration, only leaders establish direct © 2018 Tanium Inc. All Rights Reserved Page 9 connections with the Tanium Server. The Tanium Server passes sensors, questions, and scheduled actions to the backward leader, who passes them to its forward peer, who in turn passes them to its forward peer, and so on, until it reaches the forward leader. The forward leader sends the answer to the question or status of the scheduled action to the Tanium Server. Figure 2: Tanium Client neighborhood Tanium peer communication is designed to accommodate new clients that come online, to route around clients that are removed or are unable to communicate effectively, and to "reflect" around network-level blockages, such as firewall blocking. If a Tanium Client cannot establish an outgoing connection to a forward peer in its list, it establishes its forward connection to the Tanium Server and becomes a forward leader. This is called forward reflection. Likewise, if a Tanium Client cannot establish an outgoing connection to a backward peer, it establishes a backward connection to the Tanium Server and becomes a backward leader. This is called backward reflection. Client peering results in a profound reduction in connections and bandwidth over WAN links. The following figure illustrates the proportions of the savings. A large enterprise network includes subnets in headquarters and branch offices, as well as VPN connections from remote workers. Other than during registration, only the remote VPN clients and leaders, depicted in sharp red, connect to the Tanium Server over WAN links. The remaining clients, depicted in faded red, share data over peer connections on the LAN. © 2018 Tanium Inc. All Rights Reserved Page 10 Figure 3: An enterprise network File distribution There are two key optimizations that Tanium utilizes to distribute files efficiently: l Tanium Client peering Reduces the number of files that must be distributed over WAN links. Instead of sending files to all managed endpoints, the Tanium Server sends files only to a small fraction of them (that is, only to endpoints designated as backward leaders).