Release Notes Tanium Server (Version 7.4.3.1204)

Thank you for choosing Tanium. The following Release Notes document changes between releases of the Tanium Server.
This platform release includes the release of both a Windows and Linux Tanium Server.
The previous version can be found here: Release Notes (Version 7.4.2.2063)

Tanium Server for Windows and Linux v7.4.3.1204

General Availability Release Date: June 16, 2020.

Special Notes

• Due to security issues against this release of Tanium Server, Tanium strongly recommends upgrading to at least v7.4.5.1240 if you are using this version.
• This version of Tanium Server shipped with Console v1.4.3.0092.

Security Updates

• This release includes security updates. Details of the issues, including affected versions and mitigation information, can be obtained within Tanium's Support Portal or by contacting your TAM.

New Features

• Added Cross-Origin Resource Sharing (CORS) headers to Tanium Server responses to enable the feature where the Tanium console will install and upgrade solutions on both the servers in an A/A deployment.
• The Tanium Server import API now allows specifying which bundle types to import and which ones not. This new feature will help support a Console that is able to automatically install/ upgrade the same solution onto two Tanium Servers in an Active-Active setup.
• The Tanium Server server_host API now offers a only_active_trusted_servers which returns only the current active servers that are trusted.
• Made the RBAC Customer Administrator privilege composable so it can be used by Solution modules.
• The Tanium Server's LDAP connectors can now authenticate users when the "Sync group members individually" option is selected.
• The Tanium Server REST API now supports the summary option to provide parity with the SOAP API.
• Added support for the Customer Administrator role in RBAC queries.
• Simplified the update of roles and privileges based on Tanium Server license information.
• Tanium Server authentication tokens now support per-token IP white-listing.
• Added the ability to use the IP address reported by the X-Forwarded-For header rather than the connection IP address for Tanium Server throttles API.
• Added a global setting authenticate_api_token_with_x_forwarded_for_ip which will cause the API Whitelist and rate limit to apply to the IP provided by the X-Forwarded-For header (if one exists) for compatibility with reverse proxies situated between the client and the Tanium Server.
• Improved the efficiency of user processing on the Tanium Server.
• Improved the performance efficiency of retrieving lists of Users with summary=1 by short-circuiting the retrieval of properties which will not be serialized in the final result.

Improvements

• Removed legacy plugins left over from previous v7.x versions in favor of dedicated API services.
• The /api/v2/session/validate route in the Tanium Server API will now also validate authorization tokens as well as user/ password sessions.
• The Tanium Module Server will now use Postgres v11.6.
• Added a TDownloader setting (MinFreeSpaceInMB, default 1024MB) that will stop an operation (logging error code 1008) if downloading a file will reduce the remaining free disk space below the configured threshold.
• Optimized flattening of CSV files when exporting results from the Interact Results Grid.
• The Tanium Server /metrics route now removes the object IDs from the tanium_http_requests_total metric for API requests, offering a more compact set of metrics over each object type, instead of each identified object.
• Added a performance optimization to the Tanium Module Server when scanning for and loading plugins from the filesystem.
• The Tanium Server now offers /metrics figures for Chunk downloads tagged by the SHA-256 of the Package file they were served from. These metrics offer greater visibility into the egress network traffic associated with each file used by endpoints.
• The Tanium Server RBAC subsystem now offers individual Read and Write privileges to the access of Separated and Isolated subnet definitions.
• The Tanium Server /info and /metrics pages now provide per-Sensor string retry counts, making it easy to spot the source of StringRetry messages and traffic.
• Improved the Tanium Server's behavior in generating StringRetry messages, increasing the volume of strings requested between servers in an Active-Active deployment to server_string_retry_hash_limit=10,000, as well as finding overall optimizations on how to reduce this type of network traffic.
• Tanium Platform components now implement a TLS record size optimization, reducing transmission overhead to a minimum.
• The Tanium Server will now send its root certificates on the initial TLS handshake with clients and use session tickets in subsequent communications. This brings further efficiencies to networking bandwidth.
• Tanium components now use OpenSSL 1.0.2v.
• Removed unnecessary and unused radio buttons from Tanium Server installer dialogs.
• Removed the Tanium Server installer dialog used to specify a name for the Windows Start Menu folder in which to place Tanium objects.
• Upgrading a Tanium Server to a version which supports the Customer Administrator privilege will now create this privilege based on license contents.
• Micro-admin privileges for Read Global Bandwidth Throttles, Write Global Bandwidth Throttles, Read Subnet Bandwidth Throttles and Write Subnet Bandwidth Throttles have been added to the Tanium Server.
• The Tanium Server will no longer present its legacy-root certificate (used for securing legacy Protocol 314 connections) if Protocol 314 is not enabled.
• Improved the efficiency of loading the results cache during Tanium Server startup.
• Tanium components now use SQLite v3.32.1.
• Updated the result format of the Tanium Server API for Whitelisted URLs to match that of all other REST API calls.
• Added support for summary mode on API calls for information about individual users.
• Improved the efficiency of data handling during REST API processing.
• Improved the efficiency of content set privilege resolution on the Tanium Server.

Bug Fixes

• Optimized some Tanium Server interactions with the database by avoiding some cache refreshes when unnecessary and reducing the amount of data the data they retrieve.
• Renamed and enhanced client message counters on the Tanium Server /info page to separate counters by protocol type and to distinguish between read and write counters.
• Fixed server behavior such that deleted global settings revert to their (hidden) defaults rather than being treated as missing.
• Improved the identification of Zone Server Hubs in the Tanium Server's registration requests API to make it possible to clearly identify which Zone Server is associated with which Zone Server Hub.
• Corrected an issue where the Tanium Server could return zero results rather than the current number of online systems when asking the special question "Get number of machines".
• Improved handling and parsing of Certificate Revocation Lists (CRLs) in the Tanium Downloader, reducing its CPU consumption when working through long revocation lists during file downloads.
• Fixed an issue where System Status was not updated when a Protocol 315 Client Registration resulted in a Server Challenge.
• Fixed a condition on Linux Tanium Servers by which TDownloader processes could become zombies.
• Fixed an issue with the Tanium Server export API where it would not honor setting the export_dont_include_related option.
• Reduced the processing required on the Tanium Server to handle errors in question results.
• Fixed an issue in the management of non-active user contents that would produce a failure when reassigning an object from one user to another would fail with user not in persona if the first user was deleted before the second was assigned to the same Persona.
• Improved the HTTP status codes to return HTTP-414 or HTTP-431 when requests exceed their expected sizes.
• Improved memory handling by the Tanium Server when spawning new processes on Linux systems, avoiding an ENOMEM while trying to spawn off a new process when more that 50% of available memory was used.
• Fixed an issue in read-after-write consistency for Computer Groups wherein a Computer Group might have not been available to the API for a few seconds after it was created.
• Fixed a condition in the handling of Package file URLs by which package files where taking a long time before being reported as cached and ready in a Tanium Server.
• Fixed an issue where a fresh install of the Tanium Server on Linux would point to the wrong content manifest. This was not an issue on upgrades from previous versions.
• Fixed a Tanium API problem where audit information of Saved Questions did not include the name of the saved question which changed.
• Updated Tanium Server Packages API to accept changes to the hidden_flag.
• Fixed a problem in the Tanium Server API where trying to disable LDAP authentication on a connector using the disable_ldap_auth=2 option would result in the error: Invalid value for disable_ldap_auth on ldap_sync_connector.
• Added HTTP no-cache headers to the index.html page served by the Tanium Server.
• The Tanium Server API will no longer allow the deletion of sensors from the Reserved content set
• Fixed an issue with the Tanium Server by which when setting up an Active-Active system, clients would fail to establish TLS connections with the second server installed until after a restart was performed.
• Fixed a condition in the Tanium Server and its installer by which the server would not start when its fully qualified name (FQDN) was longer than 64 characters, logging the error: ASN1_mbstring_ncopy:string too long.
• Corrected a typo in the error message produced when attempting to export unflattenable CSV data in flattened form.
• Fixed a minor initialization issue in the serialization of SOAP Plugin objects in the Tanium Server API
• Fixed a problem with the cleanup of Tanium archive tables where this process would stop working, as seen by never updating the read-only Global Setting last_archive_database_cleanup_date. The scheduling of this process can now be controlled as it was before, using the archive_database_cleanup_interval to specify how often the process should run (default: 24 hours) and archive_database_cleanup_hour to specify the UTC time of day when it should run (default: 5 am UTC).
• Fixed issues with the Tanium Server's export and import of groups by which Action Groups were being exported when they should not, and already existing Computer Groups would be deleted and recreated on import, changing their referenced id numbers and creating issues in Action targeting as well as RBAC.
• Fixed an issue in the designation of the composite_mr_group_flag value for the groups table.
• Resolved an issue where additional namespaces included in the SAML response XML document (such as sending additional claim attributes) would cause SAML authentication to fail.
• Fixed an issue with the Tanium Module Server where it would constantly write diagnostics files into its TMS/info/ directory, not honoring its local info_export_interval_minutes setting (default: 60).
• Fixed an issue in the Tanium Server when querying for certain implied RBAC privileges which would result in a SQL exception and the error in the Tanium logs: updateModuleImpliedPrivilegesThread ... Subquery returned more than 1 value.
• Changed the frequency with which the Tanium Downloader updates download progress files on disk to 1 second, as to reduce CPU and disk resource consumption. Along with this change a command-line option --progress-file-update-milliseconds allows specifying a different update interval when necessary.
• Fixed an issue in the Tanium Client that caused Action verification failures observed in the action's log as a sequence of an Action Verification Scheduled message, followed immediately by an Action Verification Failed.
• Fixed an issue where the Tanium Module Server interpreted its info_export_max_age_days local setting as minutes instead of days, thus keeping a diagnostic files for a shorter span of time than configured.
• Preflight (PR) requests to the Tanium Server are set to no longer require authorization in order to support automated installation of Solution modules to both TSs in an Active-Active environment.
• The Tanium Server will no longer force a re-verification of a client certificate during registration, since this is also the process by which a TC will acquire a certificate, thus avoiding the intermittent message: Cannot reverify certificates: no client certificate presented.
• Optimized the logic that handles Saved Questions in the Tanium Server to avoid a database deadlock condition when updating most_recent_qid in the saved_questions table.
• Fixed a caching issue in the Tanium Server where when importing a Sensor and overwriting an existing one, the column definitions in the result would be incorrect.
• Fixed an issue when retrieving privileges associated with Content Set roles which would return already deleted privileges in the result.
• Fixed a problem by which the use of the pki show command line would no longer print full key names in its results.
• Fixed an issue in the Tanium Server that caused the retrieval of Question result data to return no results when the hide_errors option was set.
• The setting to detect string hash collisions is now enabled by default for new installs of the Tanium Server.
• Fixed a database contents issue where groups could contain a NULL content_set_id value.
• Fixed an issue where an incorrect error message could be returned for certain TDownloader failures.

Known Issues and Workarounds

• String report processing hangs on Tanium Server v7.4.3.1204 when hash collision resolution is enabled, causing persistent RCU question result errors.
  Workaround: Disable hash collision resolution questions by setting the enable_collision_questions Global Setting to 0 (zero).
• Large manual Computer Groups fail to be recognized by the Tanium Server upon creation.
  Workaround: There is no workaround for this behavior. Avoid current Tanium Server v7.4 if your make use of very large manual Computer Groups until a fix is released. If you must create such large groups please plan accordingly, since you may very well require a Tanium Server restart after having created them. NOTE that this behavior does not affect existing Computer Groups or Question and Action targeting, only the Console display of such groups.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup