Arch Linux

drossbox

Member

Registered: 2019-12-04

Posts: 24

Fingerprint not accepted at login. Pam syntax issue?

I'm using GDM and have enrolled my fingerprint using libfprint. According to the wiki, I shouldn't need to do anything else - and when I go to log in I am indeed told to swipe my finger or enter my password instead. However, my fingerprint is never accepted and I have to use my password. If I change

/etc/pam.d/gdm-password

to include

auth      sufficient pam_fprintd.so

at the top, the fingerprint will work every time. However, that's not desirable because if my fingerprint is unreadable, I will be unable to log on as this overrides the password option.

Likewise, I am having a similar issue with using my fingerprint for sudo. Adding

auth		sufficient  	pam_unix.so try_first_pass likeauth nullok
auth		sufficient  	pam_fprintd.so

to

/etc/pam.d/sudo

results in no fingerprint use being possible. Only by removing

 auth		sufficient  	pam_unix.so try_first_pass likeauth nullok

will it work, but again I'm then not able to fall back to password. Is this an issue with my syntax or positioning in pam files? It would be good to have this working after such a long wait for support for my fingerprint reader.

I currently also use 2Fa at login. Ideally, I would like to either use a fingerprint to log in, or if a fingerprint is not provided require the password + 2fa code. For reference, here is my full /etc/pam.d/gdm-password

 auth            sufficient      pam_unix.so try_first_pass likeauth nullok
auth      sufficient pam_fprintd.so
auth     include   system-local-login
auth     optional  pam_gnome_keyring.so
auth required pam_google_authenticator.so secret=/HDD/googleauth/me

account  include   system-local-login

password include   system-local-login
password optional  pam_gnome_keyring.so use_authtok

session  optional  pam_keyinit.so force revoke
session  include   system-local-login
session  optional  pam_gnome_keyring.so auto_start

Last edited by drossbox (2020-08-27 14:03:00)

saint613

Member

Registered: 2020-06-25

Posts: 11

Re: Fingerprint not accepted at login. Pam syntax issue?

Do you have fingerprint-gui installed? If not I'd give it a try
Install and add    "auth        sufficient      pam_fingerprint-gui.so"     to the top of your PAM config files.
There are some permission and group setups you may need to do after the install but it works flawless for me with lightdm and sudo, also a handy gui for testing and fingerprint management.