These are instructions for installing and starting the Smallstep Agent on a Linux system running systemd. If you want to install the agent binary manually instead, see Install the Smallstep agent on a Linux device.

Prerequisites

• Install the libpcsclite1 package (optional, for YubiKey support)
• Install curl and polkitd packages
• Supported operating systems:
  • Enterprise Linux (RHEL, CentOS Stream, Rocky Linux, Alma Linux, etc)
  • Ubuntu (Current Stable and LTS releases)
  • Debian (Current Releases)
  • Fedora (Current Releases)
• We support amd64 and arm64 architectures
• The following directories are used by default:
  • runtime state in /run/step-agent
  • configuration in /etc/step-agent
  • certificates in /var/lib/step-agent (or in your configured locations)
• The agent will connect to the following Smallstep hosts:
  • Your CA: <your-team>.ca.smallstep.com and subdomains
  • Agent API: control.infra.smallstep.com
  • Smallstep API: gateway.smallstep.com
  • Device Attestation CA: att.smallstep.com (when device attestation is used)

Install step and step agent

1. Download and install our step-cli package

   ARCH=amd64
   FORMAT=deb
   curl -LO <https://dl.smallstep.com/cli/docs-quickstart/latest/step-cli_[$ARCH.](https://dl.smallstep.com/gh-release/cli/docs-cli-install/v0.24.4/step-cli_0.24.4_amd64.deb)$FORMAT>
   sudo dpkg -i step-cli_$ARCH.$FORMAT
   

   This provides the step CLI command. Format can be deb or rpm.

2. Download and install our Smallstep agent package

   ARCH=amd64
   FORMAT=deb
   curl -LO <https://dl.smallstep.com/step-agent-plugin/latest/step-agent-plugin_$ARCH.$FORMAT>
   sudo dpkg -i step-agent-plugin_$ARCH.$FORMAT
   

   This provides the step agent subcommand and daemon.

Configure step agent

Create the agent.yaml config file, with your team name and fingerprint.

Find your team name in your smallstep dashboard URL.

Find your fingerprint under the Smallstep Agents authority, on the Certificate Manager Authorities dashboard page.

cat <<EOF | sudo tee /etc/step-agent/agent.yaml
team: "demo1234"
fingerprint: "40523785c1d1d11EXAMPLE017b660d52a5fa5f2cb94cf0e1a9e9209dbea0826"
EOF

Now, restart the agent: