The Tanium Server installers account SQL database permissions must be reduced from sysadmin to db

The Tanium Server installers account SQL database permissions must be reduced from sysadmin to db_owner.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-67029	TANS-DB-000004	SV-81519r1_rule		Medium

Description
Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have been created, the Tanium Server service must be configured to execute under an account that holds at least the dbo role on both databases. Post-installation, if the account used to configure the Tanium Server services to access the remote SQL database server holds only the Database Owner role, rather than the sysadmin role, consider granting this account the View Server State permission on the SQL Server. While it's not strictly necessary, this dynamic management view enables the Tanium Server to access data faster than the dbo role alone.

Description

Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have been created, the Tanium Server service must be configured to execute under an account that holds at least the dbo role on both databases. Post-installation, if the account used to configure the Tanium Server services to access the remote SQL database server holds only the Database Owner role, rather than the sysadmin role, consider granting this account the View Server State permission on the SQL Server. While it's not strictly necessary, this dynamic management view enables the Tanium Server to access data faster than the dbo role alone.

STIG	Date
Tanium 6.5 Security Technical Implementation Guide	2016-09-29

Details

Check Text ( C-67665r2_chk )
Access the Tanium SQL server interactively. Log on with an account with administrative privileges to the server. Open SQL Server Management Studio and connect to Tanium instance of SQL Server. In the left pane, click “Databases”, select the Tanium database, click “Security”, and then click “Users”. In the “Users” pane, review the role assign to the Tanium Server installer's user account. If the role assigned to the Tanium Server installer's account is not db_owner, this is a finding.

Check Text ( C-67665r2_chk )

Access the Tanium SQL server interactively.

Log on with an account with administrative privileges to the server.

Open SQL Server Management Studio and connect to Tanium instance of SQL Server.

In the left pane, click “Databases”, select the Tanium database, click “Security”, and then click “Users”.

In the “Users” pane, review the role assign to the Tanium Server installer's user account.

If the role assigned to the Tanium Server installer's account is not db_owner, this is a finding.

Fix Text (F-73129r2_fix)
Access the Tanium SQL server interactively. Log on with an account with administrative privileges to the server. Open SQL Server Management Studio and connect to Tanium instance of SQL Server. In the left pane, click “Databases”, select the Tanium database, click “Security”, and then click “Users”. In the “Users” pane, right-click the Tanium Server installer's user account, and on the shortcut menu, click “Properties”. Under Database role membership, change role from sysadmin to db_owner. Click “OK”.

Fix Text (F-73129r2_fix)

Access the Tanium SQL server interactively.

Log on with an account with administrative privileges to the server.

Open SQL Server Management Studio and connect to Tanium instance of SQL Server.

In the left pane, click “Databases”, select the Tanium database, click “Security”, and then click “Users”.

In the “Users” pane, right-click the Tanium Server installer's user account, and on the shortcut menu, click “Properties”.

Under Database role membership, change role from sysadmin to db_owner.

Click “OK”.