Profile: security-keys

Hardware signing keys and smartcard tools for your station

Stage: 1.0

Who it is for

Operators using hardware signing keys or PIV smartcards with a Bunker.

At a glance

Stage	1.0
Units	5
Disk	Not yet measured
Hardware	A FIDO2 authenticator or PIV token to use the tools; none to install.
Consent	none
Install	hammunition install security-keys

What it installs

PC/SC and OpenSC for PIV smartcards, FIDO2 tools and their device-access rules, YubiKey management tools and the U2F PAM module. All are from your distribution's archive. Hammunition writes no PAM configuration; archive PAM and debconf side effects are unmeasured across the target matrix.

Disk footprint: Not measured for the complete dependency closure; apt's dry run reports what your target needs. Do not treat installed package size as download size.

Why these belong together

These provide the tools for signing a Bunker catalogue with a hardware key and checking that the station can reach its token. FIDO2 is not tied to one vendor; PIV signing uses OpenSSH through the agent and OpenSC.

Packages (5)

pcscd, opensc, fido2-tools, yubikey-manager, libpam-u2f

What it deliberately excludes

Enabling PAM for login or sudo, changing account authentication, generating keys or enrolling a Bunker automatically. PAM enablement is a separate task.

Install it

Read the plan first. It changes nothing and prints every package, build, file and system change, and every consent gate you will meet:

hammunition show security-keys
hammunition install security-keys --dry-run

Then do it. The engine asks for your sudo password once, near the start, and shows the same plan again before it asks you to confirm:

hammunition install security-keys

A member your machine cannot take is deferred by name and the rest installs (D-039); the plan lists each under Will NOT happen, with the reason and the command that fixes it. Installation explains how to read every part of the plan.

What you configure by hand afterward

Run hammunition doctor, then enrol your Bunker with hammunition mirror enrol URL. Generate or load your signing key with the token's tools. OpenSSH 8.2+ is needed. Ubuntu's ykman 5.2.1 support for newer PIV algorithms is unmeasured; use the token's own tools if it cannot generate the required key. No PyPI fallback is installed by this profile. Never publish your private key.

Your first ten minutes

1. Read the plan: hammunition install security-keys --dry-run.
2. Install with hammunition install security-keys; Hammunition writes no PAM files.
3. Connect your token and run hammunition doctor as yourself, without sudo.
4. Read the Bunker catalogue reference.
5. Enrol with hammunition mirror enrol URL; type the fingerprint after checking it.

Take it off again

hammunition uninstall security-keys --dry-run
hammunition uninstall security-keys

This removes what Hammunition itself installed and nothing else. It does not remove dependencies apt pulled in, group memberships or configuration files it wrote; the plan says so and the transaction log records them (D-004).