Firewall rules must be configured on the Tanium Server for Server-to-Database communications.

From Tanium 6.5 Security Technical Implementation Guide

Part of SRG-APP-000383

Associated with: CCI-001762

SV-81521r1_rule Firewall rules must be configured on the Tanium Server for Server-to-Database communications.

Vulnerability discussion

The Tanium Server can use either a SQL Server RDBMS installed locally to the same device as the Tanium Server application or a remote dedicated or shared SQL Server instance. Using a local SQL Server database typically requires no changes to network firewall rules since all communication remains on the Tanium application server device. To access database resources installed to a remote device, however, the Tanium Server service communicates over the port reserved for SQL, by default port 1433, to the database.Port Needed: Tanium Server to Remote SQL Server over TCP port 1433.Network firewall rules:Allow TCP traffic on port 1433 from the Tanium Server device to the remote device hosting the SQL Server RDBMS.https://kb.tanium.com/Port_Configuration_v6.5

Check content

Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server. Access the host-based firewall configuration on the Tanium Server. Validate a rule exists for the following: Port Needed: Tanium Server to Remote SQL Server over TCP port 1433. If a host-based firewall rule does not exist to allow Tanium Server to Remote SQL Server over TCP port 1433, this is a finding. Consult with the network firewall administrator and validate rules exist for the following: Allow traffic from Tanium Server to Remote SQL Server over TCP port 1433. If a network firewall rule does not exist to allow traffic from Tanium Server to Remote SQL Server over TCP port 1433, this is a finding.

Fix text

Configure host-based and network firewall rules as required.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer