smallstep_full_white

The Smallstep App

Smallstep ensures that access to financial data, code repositories, PII, and other sensitive resources is only possible from trusted, company-managed devices.

The Smallstep desktop app is central to that process. It offers a uniform experience for device identity across macOS, Windows, and Linux, and is the foundation for Smallstep's high-assurance device identity attestation workflow, automating the issuance of certificates to devices and configuring the components that depend on these certificates. P.S: The Smallstep app operates differently for Linux. For Linux specific instructions, see Smallstep Agent for Linux.

Here's all the necessary info you need to install and use the Smallstep app effectively and consciously.

Download

Installers for macOS, Windows and Linux can be also be downloaded from GitHub releases. Releases are signed with, and can be verified, by cosign.

PlatformRelease
macOSLatest Version
Linux (Flatpak)Latest Version
Linux (.deb)Latest Version
Linux (.rpm)Latest Version
WindowsLatest Version

System Requirements

Windows

  • Windows 10 or later
  • Trusted Platform Module (TPM 2.0)

Linux

  • Flatpak, or Debian 12+, Ubuntu 22.04+, Fedora 38+
  • systemd-based service manager
  • Trusted Platform Module (TPM 2.0)
  • p11-kit
  • tpm-tss2

macOS

  • macOS 13 (Ventura) or later
  • Secure Enclave

Runtime Requirements

All platforms require an internet connection for normal operation.

Windows

  • Administrator privileges - the Smallstep app requires privilege escalation to be able to communicate to the TPM

macOS

  • Location permission - to enable management of Wifi networks, the Smallstep app needs location permission
  • Keychain access - the Smallstep app uses the macOS keychain to store both keys and certificates it manages
  • Network Extension entitlement - the Smallstep app requests the Network Extension entitlement so that it can manage VPN connections

Linux

  • TPM read/write permission - the Smallstep app communicates to the TPM from user-space using tpm-tss2, and the running user must have read/write permissions to the TPM resource manager (typically /dev/tpmrm0)

File Access

On all platforms, the Smallstep app creates and manages a directory on the filesystem in a well-known location for management of keys and certificates. However, it does not access any other file on a device except the one it creates.

  • On macOS: $HOME/Library/Application Support/Smallstep
  • On Windows: %LOCALAPPDATA%/Smallstep
  • On Linux: $XDG_RUNTIME_DIR/step-agent and $XDG_CONFIG_HOME/step-agent

Telemetry

The Smallstep app collects and reports some data from the host device as part of its normal operation. These are:

  • Device Identifiers from TPM-enabled platforms
  • Device/Computer Name
  • Device/Computer Hostname
  • Chipset Architecture
  • Operating System Version
  • WAN IP Address