STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication.

DISA Rule

SV-254914r961038_rule

Vulnerability Number

V-254914

Group Title

SRG-APP-000175

Rule Version

TANS-AP-000480

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Request or regenerate the certificate being used to include both the "Server Authentication" and "Client Authentication" objects.

Check Contents

From Browser:

1. Navigate to the Tanium Console URI and log in using multi-factor authentication.

2. Click the lock to the left of the URI in the address bar.

3. Select the lock on the left of the URI in the address bar:
a) Chrome: Select "Certificate".
b) Edge: Select "Connection is Secure," and then select the certificate icon on the right.

4. Select the "Details" tab.

5. Scroll down through the details to find and select the "Enhanced Key Usage" field.

If there is no "Enhanced Key Usage" field, this is a finding.

In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified.

If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

From Server:

1. Access the Tanium Server interactively.

2. Log on to the TanOS server with the tanadmin role.

3. Press "2" for "Tanium Operations Menu," and then press "Enter".

4. Press "7" for "Download SOAP Certificate," and then press "Enter".

5. In a browser with access to the Tanium Server Console, navigate to https://<tanium server>/pub/SOAPServer.crt.

6. Download the SOAPServer.crt file when prompted.

7. Double-click on the file to open the certificate.

8. Select the "Details" tab.

9. Scroll down through the details to find and select the "Enhanced Key Usage" field.

If there is no "Enhanced Key Usage" field, this is a finding.

In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified.

If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

Vulnerability Number

V-254914

Documentable

False

Rule Version

TANS-AP-000480

Severity Override Guidance

From Browser:

1. Navigate to the Tanium Console URI and log in using multi-factor authentication.

2. Click the lock to the left of the URI in the address bar.

3. Select the lock on the left of the URI in the address bar:
a) Chrome: Select "Certificate".
b) Edge: Select "Connection is Secure," and then select the certificate icon on the right.

4. Select the "Details" tab.

5. Scroll down through the details to find and select the "Enhanced Key Usage" field.

If there is no "Enhanced Key Usage" field, this is a finding.

In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified.

If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

From Server:

1. Access the Tanium Server interactively.

2. Log on to the TanOS server with the tanadmin role.

3. Press "2" for "Tanium Operations Menu," and then press "Enter".

4. Press "7" for "Download SOAP Certificate," and then press "Enter".

5. In a browser with access to the Tanium Server Console, navigate to https://<tanium server>/pub/SOAPServer.crt.

6. Download the SOAPServer.crt file when prompted.

7. Double-click on the file to open the certificate.

8. Select the "Details" tab.

9. Scroll down through the details to find and select the "Enhanced Key Usage" field.

If there is no "Enhanced Key Usage" field, this is a finding.

In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified.

If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

Check Content Reference

M

Target Key

5492