Arch Linux

sitwano

Member

Registered: 2017-07-07

Posts: 83

fprintd authentication for sudo fails with verification timeout

I've installed fprintd on my thinkpad x250. running lsusb gives:

Bus 003 Device 002: ID 8087:8001 Intel Corp. 
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 5986:0366 Acer, Inc 
Bus 001 Device 003: ID 8087:0a2a Intel Corp. 
Bus 001 Device 002: ID 138a:0017 Validity Sensors, Inc. Fingerprint Reader
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

I have edited /etc/pam.d/sudo and added

 auth      sufficient       pam_fprintd.so 

So now when I run applications using sudo, for example sudo vim to edit system files, it takes forever to authenticate. Most times it takes more than 10 to 20 seconds to and fails with the message "verfication timeout"

Now this does not happen soon after I enroll my fingerprints because then its quick (almost instant authentication). However, when I logoff or restart a couple times the authentications gets very slow and fails with timout error. The arch wiki has no information about this. So not sure what to do. Is this  a bug or an annoying feature?

R00KIE

Forum Fellow

From: Between a computer and a chair

Registered: 2008-09-14

Posts: 4,734

Re: fprintd authentication for sudo fails with verification timeout

I can only provide some ideas of what you can check because I don't have fingerprint authentication set up. The fingerprint reader on my thinkpad e560 seems to be very finicky about matching the fingerprints (and I think biometric authentication is a bad idea - identification on the other hand would be fine) so I don't use it.

When authentication gets very slow check if there are any errors in the output of dmesg, it doesn't have to be exactly when you try to authenticate, it could be the result of something failing before and leaving the fingerprint reader in some undefined state.

Also check the journal output for the current boot as that should contain messages from pam which might provide a clue as to what is not working properly.

---

R00KIE
Tm90aGluZyB0byBzZWUgaGVyZSwgbW92ZSBhbG9uZy4K