The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-66999 | TANS-CN-000003 | SV-81489r1_rule | Medium |
| Description |
|---|
| By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the cog of the Windows Operating System and separate maintenance will not be required. |
| STIG | Date |
|---|---|
| Tanium 6.5 Security Technical Implementation Guide | 2016-09-29 |
Details
| Check Text ( C-67635r1_chk ) |
|---|
| Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Validate the "cac_ldap_server_url" value exists and is configured to point to the site's Active Directory instance. This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging in. It must use the syntax of LDAP:// If the value for "cac_ldap_server_url" does not exist or is not configured to the site's AD instance, this is a finding. |
| Fix Text (F-73099r1_fix) |
|---|
| Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Set the value for "cac_ldap_server_url" to reference the site's AD instance. It must use the syntax of LDAP:// |