Release Notes Tanium Server (Version 7.7.1.7207)

Thank you for choosing Tanium. The following Release Notes document changes between releases of the Tanium Server.
This platform release includes the release of both a Windows and Linux Tanium Server.
The previous version can be found here: Release Notes Tanium Server (Version 7.6.4.2097)

Tanium Server for Windows and Linux v7.7.1.7207

• Tanium Cloud availability date: October 15, 2024.
• On-premises availability date: N/A.

Highlights

• This version of the Tanium Server introduces new mechanisms to manage ComputerID assignments to compatible v7.7 clients.
• The Tanium Server now supports the concept of Ring Sets to support future Autonomous Actions.

Special Notes

• The Tanium Server now uses Console (Version 3.9.2.0000).
• Tanium discourages new installations of this software version on Windows 2012 and 2012-R2 given its End-Of-Life on 2023-10-10.

Security Updates

• N/A.

New Features

• The Tanium Server now implements a cell_row_count API option that limits the maximum number of rows returned for result cells, allowing the caller to limit the amount of data returned when there is a large number of results in each cell.
• The Tanium Server API now supports a description field for computer groups.
• The Tanium Server will now respond with an HTTP-400: Bad Request when a question is asked using a column filter on a sensor that uses multi-character column delimiters. This is not supported.
• Adds support for HMAC key derivation (HKDF) for client identity keys.
• Adds support for Diffie-Hellman elliptic curve (ECDH) shared secret derivation as a means for the Tanium Server and Client to exchange client identity keys.
• Adds support for AES-GCM-128 as a faster and yet sufficiently strong encryption mode.
• The Tanium Server APIs will now refuse to delete a non-empty content set, whereas this was only enforced in the Tanium Console UI.
• Adds export and import support in the Tanium Server API for ring sets and the new saved action ring properties.
• Implements protections in the Tanium Server API to deny modification of sensors that are labeled as Tanium-provided content. This is to allow users to modify their own content but not change those provided by Tanium.
• Provides new metrics for the processing time devoted to client key derivations in the Tanium Server.
• Implements a yearly rotation of the Tanium Servers active-active encryption keys.
• The Tanium Server adds a couple of metrics counters to track the number of registrations with new ComputerID values that do not match the certificates they present.
• Adds support for both encrypted and non-encrypted CDN token requests to the Tanium Server.
• Adds encryption support for CDN files.
• The Tanium Server now implements a ring_set_instances/preview to support the preview of ring deployment plans UI in the Tanium Console.
• Offers new question result processing metrics in the Tanium Server: report_message_queue_bytes, question_report_batch_received_size, question_legacy_question_reports_received and question_legacy_string_reports_received.
• The self-signed certificates that Tanium components generate on installation will now only be valid for a period of one year. This is done to comply with CSPN certification requirements.
• The Tanium Server now offers a pki init-root command line option to initialize its root keys and produce a tanium-init.dat file upon first installation without having to start the server process.
• Implements the ability to rename a module service in the Tanium Server API.

Improvements

• Offers additional logging details on RBAC permissions failures when the Tanium Server rejects the deployment of a package due to a missing write action privilege.
• Introduces a Tanium Server sequencing counter for active/ active pair messages about incoming Tanium Client registrations in order to support next-generation ComputerID assignments.
• Adds support for 64-bit integer values in the application configuration interfaces.
• The package_file Tanium Server API endpoint will now also display the cached status for the file.
• When de-duplicating user entries synchronized from multiple LDAP synchronization connectors, the Tanium Server will favor entries received from connectors configured with LDAP authentication enabled.
• The Tanium Server will now generate a 3,072-bit key certificate for SOAPServer.crt by default, instead of 2,048-bits as it did in previous versions.
• Implements periodic cleanup of old and unused sensor definitions in the Tanium Server database.
• Generalizes the error text returned by the Tanium Server API when attempting to create a filter or computer group with a duplicate name. Instead of reading "a computer group with that name already exists" it will simply read "a group with that name already exists".
• The Tanium Server will now return an HTTP-400: Bad Request status when it fails to parse the request Tanium-Options header instead of failing with an HTTP-500 status.
• Refactors the English language question parser in the Tanium Server to utilize the same back-end data models as those that underpin the API services.
• Changes the behavior of the Tanium Server API when trying to change the type of a default system setting, which now returns a proper exception and message instead of an HTTP-500 error status.
• The Tanium Server now uses a separate table to keep track of a package file's last request time and updates these values in batches to reduce the number of updates to the database.
• Implements the migration mapping from legacy computer IDs to new ones when a Tanium Client is upgraded, allowing the Tanium Server to map the old ID to the new one along with its associated data.
• Embeds the ComputerIDv2 into newly issued client certificates as a means to support for the computer ID proof workflow.
• Implements the key-exchange mechanism between Tanium Server and Client which will be used for ComputerIDv2 issuance and eventually question result encryption.
• Implements an additional connection state to handle ComputerIDv2 proof and issue workflows, which allows PKI synchronization before computer ID workflows begin.
• Adds a new EncryptedMessage communications type which will be used the client identity key to encode its payload.
• Adds support to specify ring and ring set instance when creating an action in the Tanium Server API.
• The Tanium Server will now include ring group filter criteria when issuing actions for backward compatibility with older clients that are not ring-aware.
• Adds the necessary privileges for RBAC control in the Tanium Server API for rings.
• Extends the Tanium Server action history API to allow filtering by ring set elements.
• Adds a start_date column to the database_upgrade_steps table in the Tanium Server database, to allow reviewing the total execution time for each step.
• Ensures the de-duplication and re-use of ring set definitions in the Tanium Server, given the fact that these definitions are immutable.
• Implements an improvement in the way the groups table is indexed in the Tanium Server database, reducing their storage requirements.
• The Tanium Server now ensures user IDs that are not just unique but also distinct from group IDs to ensure compatibility with some SCIM providers.
• The Tanium Server now saves its cached files chunk maps all into a single file, instead of multi-level map files, as to have all of this information available in a single data file.
• Ensures that the Tanium Server only looks up sensor definitions once when parsing groups. This avoids repeated look-ups for the same element for groups that contain many similar references.
• Ensures that all of the Tanium Server database metadata tables have foreign key references with a DELETE CASCADE option.
• Randomizes the garbage collection of the different sensor caches within the Tanium Server to reduce the performance impact of processing all of them at the same time.
• Randomizes the interval at which the Tanium Server serializes and persists sensor cache results to spread out the performance impact of processing all of them at the same time.
• The Tanium Server will no longer deliver a ServerHash message to clients unless a sensor super-hash, epoch or client settings hashes have changed in the system, thus conserving egress bandwidth.
• Improves the performance of the Tanium Server purge_temp_sensors_data stored procedure.
• Improves the handling of critical sections in code through the use of SRW locks (Slim Read/ Writer locks).
• Reduces the CPU processing overhead in Zone Servers when servicing file chunk requests.
• Removes the creation of a new results snapshot every time the Tanium Server processes a batch of results, delaying this process until results are requested.
• Refactors the use of socket address structures to allow for the storage and handling of different size AF_UNIX representations.
• The Tanium Server content set privileges API will now omit privilege assignments that reference previously deleted content sets, roles or privileges, which on systems with many changes would generate rather large response results.
• The Tanium Server API now disallows the creation of ring sets that do not contain any ring definitions in them.
• Improves the execution performance in querying the groups and sub-groups tables in the Tanium Server database.
• Improves TLS performance by reducing contention in OpenSSL objects during execution.
• Adds the GetResultDifferences scope to the Tanium Server's TBBAllocatorStats which would otherwise be tallied in the APIWorker scope.
• The Tanium Server now allows the report_queue_size_limit global setting to be larger than 4GB. Large values for this setting are not recommended but are now possible.
• Improves the execution performance in calculating public key fingerprints.
• Tanium components have improved their handling of operations on overly busy SQLite databases.
• Benchmarks and improves the performance of the encryption and decryption of question result strings.
• Improves the handling of HTTP HEAD requests which under certain conditions could cause the Tanium Server to spike its CPU utilization.
• Ensures that Tanium Servers will forward already decrypted question results to its active/ active partners to avoid the need to decrypt on both servers which already have a trusted relationship.
• Enables the pipeline processing of incoming question results in the Tanium Server, allowing the processing separate report batches in parallel.
• Tanium Platform now use 3072-bit keys to secure sensitive information shared between Tanium Servers in an active/ active configuration, such as LDAP connector passwords. NOTE: This change restricts v7.4.5.1200 to be the oldest platform version that can be upgraded directly to this release. Older systems will need to be upgraded to an intermediate version before this one is applied.
• Tidies up the threaded handling of OpenSSL contexts within the Tanium Server to avoid they are left behind as orphaned objects.
• Reduces the processing requirements in the Tanium Server when creating sensor result snapshots.
• Updates the manifest URL for the semi-annual release SAR-2024H2.
• Improves the logging of the Tanium Server and Module Server when module connections time out by displaying the configured timeout values in the system.
• Updates the application configuration API to support 64-bit integers as part of the implementation of the new Computer IDv2.
• Allows Tanium components CLI "config" values to hold 64-bit numbers.
• Changes the implementation of the Tanium Server /metrics route to report system status data from an already existing internal snapshot, which should reduce the request time at very large scales.
• Improves the Tanium Server interaction with its database by optimizing one of its SQL queries against the generally large groups table.
• Adds support for long URL paths in Tanium Server requests.
• Reduces copying operations within the Tanium Server while handling long UNC file paths.
• Tanium components now ship with OpenSSL v1.0.2zk and v3.2.3.
• Tanium components now ship with zlib v1.3.1.
• Tanium components now ship with libexpat v2.6.3.
• Tanium components now ship with Python v3.12.7.
• Tanium components now ship with curl v8.10.1 libraries.
• Tanium components now ship with llhttp v6.1.1.
• Tanium components now ship with OpenLDAP v2.5.17 libraries.

Bug Fixes

• Fixes an incorrect application of the cache_filters API option in the Tanium Server when the filter contained sub_filters.
• The Tanium Server now trusts API tokens which are used from any one if its configured IP addresses, avoiding the need to configure this manually in all-in-one deployments.
• Fixes an issue where the Tanium Server would emit a response body to incoming HEAD requests.
• Fixes a problem in the Tanium Server API where action groups with visibility restricted to a user group will fail to load when the user group is deleted.
• Improves the handling of user principal name (UPN) format usernames on the Tanium Server.
• Fixes an omission when handling queued HTTP downloads that when cancelled were not removed from the queue until they timed out.
• Fixes a problem in the Tanium Server where trying to remove the "Deny All" RBAC permission from a user group would produce the error: Only administrators can manage administrator privileges.
• Fixes a defect where the Tanium Server CLI would reference Backup/pki.db instead of Backup/pki-backup.db.
• Fixes an omission where the seconds_since_issued element in the Tanium Server GetResultInfo and GetResultData always had a zero value.
• Fixes a condition in Tanium components communications where a process could spin and consume higher amounts of CPU when a TLS negotiation was terminated abnormally.
• Fixes a problem in HSM-enabled Tanium Server configurations that would result in a running server where accessing its Console would just display an "ERR_SSL_PROTOCOL_ERROR" and the server logs would show "ossl_x509_check_private_key:unknown key type" for the SOAPServer certificate in the system.
• Fixes an issue in the Tanium Server APIs where objects assigned to a content set that was deleted would not be returned in requests expected to return all objects.
• Fixes the shut-down order of some threads within the Tanium Server to guarantee that result updates finish before this cache is serialized to disk while stopping.
• Fixes an issue where the Tanium Server would in some occasions change the order of the sensors when re-issuing a saved question.
• Fixes an issue in the Tanium Server RBAC API where requesting a content set role by name would return ContentSetRoleNotFound when there exists any deleted role with the same name.
• Fixes a change in the Tanium Server question results behavior where sensors with a large number of result rows will display "[no data]" instead of partial data followed by "[too many results]" which is the expected output.
• Fixes an omission in the Content-Type response header for the session/login API on the Tanium Server.
• Fixes a condition in the Tanium Server API where ring sets created successfully but without any ring assignments count not be read back, even though the API has changed to disallow empty ring sets.
• Fixes an omission in the Tanium Server where the API to override the logging level would only alter the log0.txt log.
• Adds the missing "read server host" privilege which would otherwise cause the System User Service to create the needed API tokens for modules and services.
• Fixes an issue where the Tanium Server may stop processing package files and downloads when disable_client_cdn_downloads is enabled (set to '1') while running.
• Improves the performance of public key parsing in the OpenSSL v3 implementation.
• Fixes an issue with the Tanium Server where, in the unlikely event that two package files shared a common chunk hash, the files would fail to download to endpoints until the Tanium Server service was restarted.
• Fixes an issue where the RPM installer of the Tanium Server on Linux would clobber the contents of the Console workbenches.json file.
• Removes the guidance presented by the Tanium Server installer on Linux which asked for the execution of "TaniumKeyUtility makekeys" which would create keys that are incompatible and keep the server service from starting up.
• Fixes an issue in the Tanium Server which would cause changes to content set roles to appear reflected in API results after a delay of almost a minute.
• Fixes a behavior in the Tanium Server where NULL global settings numeric values would be re-cast as zero after a platform upgrade to v7.6 and higher, with the possibility of causing system misconfigurations.
• Fixes an issue in the Tanium Server which would cause a crash of its process when unable to resolve the name of its active/ active companion server, while logging the message: Could not resolve AA host name.
• Fixes an issue where deleting a temporary sensor and then re-importing its exact same definition would cause RBAC failures in the newly imported copy.
• Fixes a misspelling of the word "received" in log0.txt.
• Fixes an internal mechanism inside the Tanium Server which delays some API responses and could lead to a "thread pool too busy" condition, impairing all incoming requests.
• Fixes a condition in the Zone Server Hub process where it could crash during shutdown.
• Fixes a problem in the Tanium Server SP-initiated authentication when SAML is configured with with 3072-bit RSA keys.
• Fixes a "use after free" reference in gRPC requests in the Tanium Server which could result in a process crash.

Known Issues and Workarounds

• N/A.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup