STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

Multifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts.

DISA Rule

SV-254897r1015861_rule

Vulnerability Number

V-254897

Group Title

SRG-APP-000080

Rule Version

TANS-AP-000195

Severity

CAT II

CCI(s)

• CCI-000056 - Retain the device lock until the user reestablishes access using established identification and authentication procedures.
• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.
• CCI-000060 - Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

Weight

10

Fix Recommendation

Use the vendor documentation titled "Multi-Factor Authentication" to implement correct configuration settings for this requirement.

Vendor documentation can be downloaded from the following URL: https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html#cac_Tanium_Appliance

1. Access the Tanium Server interactively.

2. Log on to the TanOS server with the tanadmin user role.

3. Enter "2" to access the "Tanium Operations" menu.

4. Enter "2" to access the "Tanium Configuration" Settings menu.

5. Enter "1" to access the "Edit Tanium Server Settings" menu.

6. Validate the value for "ForceSOAPSSLClientCert" is set to "1".

7. Validate the following keys exist and are configured:

7A. "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name.

7B. "ClientCertificateAuthRegex"
For example:
.*:\s(\d+)@.*
Note: This regex may vary.

7C. "ClientCertificateAuth"
For example:
/opt/Tanium/TaniumServer/cac.pem
Note: The path name is case sensitive.

7D. "TrustedHostList"
For example:
Append 127.0.0.1 (for IPv4) and [::1] (for IPv6).

Check Contents

1. Access the Tanium Server interactively.

2. Log on to the TanOS console with the "tanadmin" user role.

3. Enter "2" to access the "Tanium Operations" menu.

4. Enter "2" to access the "Tanium Configuration" Settings menu.

5. Enter "1" to access the "Edit Tanium Server Settings" menu.

6. Validate the value for "ForceSOAPSSLClientCert" is set to "1".

7. Validate the following keys exist and are configured:

7A. "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name.

7B. "ClientCertificateAuthRegex"
For example:
.*:\s(\d+)@.*
Note: This regex may vary.

7C. "ClientCertificateAuth"
For example:
/opt/Tanium/TaniumServer/cac.pem

7D. "TrustedHostList"
For example:
Append 127.0.0.1 (for IPv4) and [::1] (for IPv6)

If the value for "ForceSOAPSSLClientCert" is not set to "1" and the remaining registry values are not configured, this is a finding.

Vulnerability Number

V-254897

Documentable

False

Rule Version

TANS-AP-000195

Severity Override Guidance

1. Access the Tanium Server interactively.

2. Log on to the TanOS console with the "tanadmin" user role.

3. Enter "2" to access the "Tanium Operations" menu.

4. Enter "2" to access the "Tanium Configuration" Settings menu.

5. Enter "1" to access the "Edit Tanium Server Settings" menu.

6. Validate the value for "ForceSOAPSSLClientCert" is set to "1".

7. Validate the following keys exist and are configured:

7A. "ClientCertificateAuthField"
For example:
X509v3 Subject Alternative Name.

7B. "ClientCertificateAuthRegex"
For example:
.*:\s(\d+)@.*
Note: This regex may vary.

7C. "ClientCertificateAuth"
For example:
/opt/Tanium/TaniumServer/cac.pem

7D. "TrustedHostList"
For example:
Append 127.0.0.1 (for IPv4) and [::1] (for IPv6)

If the value for "ForceSOAPSSLClientCert" is not set to "1" and the remaining registry values are not configured, this is a finding.

Check Content Reference

M

Target Key

5492