5

I want to make efficient use of the fingerprint reader on my laptop. I was able to configure fingerprint reading through fprint and PAM (using the steps described in the second comment here), but I've encountered a small problem.

When logging in with the fingerprint reader the GNOME keyring isn't unlocked. Now I understand that this is this way because fprintand the keyring have no support for hardware-based keystore unlocking like for example Windows Hello does. I have no problem with this restriction, but it means that I have to type my password on login anyways.

How I get around this right now is by waiting for 10s on the first login so the fingerprint reader times out and I get the password prompt. Then I enter the password to login and the keyring gets unlocked with the login. When I unlock my device or run sudo commands afterwards I will still use the fingerprint reader.

So my question is if it is possible to configure PAM in a way that allows me to do the first login directly with the password (without waiting for the fingerprint sensor to time out) while still allowing me to unlock and run sudo commands with the fingerprint reader.

I'm running Linux Mint with the Cinnamon desktop.

AdminBee
  • 21,637
  • 21
  • 47
  • 71
Emil S.
  • 153
  • 1
  • 5

1 Answers1

4

Well, this is a bit tricky.

The authentication methods for various services are controlled by files in /etc/pam.d/ directory. The pam-auth-update command will update the common-* files, which are @included by the service-specific files.

I'm more of a KDE guy myself, but Cinnamon is a GNOME derivative, so its initial login is probably handled by /etc/pam.d/gdm (or /etc/pam.d/gdm-greeter if it exists). You might achieve what you want by replacing the @include lines in that file by the contents of the corresponding /etc/pam.d/common-* files, leaving out the lines referring to pam_fprintd. This should result the initial login omitting all the components related to the fingerprint sensor, but everything else still having the fingerprint authentication available as usual.

(You can also achieve the same in the opposite way: by using pam-auth-update to remove the fingerprint authentication configuration from the common-* files, and then adding them back in to the service-specific file for those services you want only. But it seems like this would be more work than the first method.)

Warning: Changing the PAM configuration files can easily lock you out of your computer in case of typos or other mistakes. Before editing the configuration files and logging out to test the changes, make sure you have an alternative way in to undo your change in case it turns out it does not work.

In this case, switch to the text-mode virtual console, log in from there and become root, so that you'll be already fully authenticated on that console. Then switch back to the GUI mode, make your changes (first making a backup copy of any file you'll change) and log out of the GUI to test it. If the GUI login no longer works, just switch back to the text-mode virtual console where you're already logged in with root powers, and use it to undo your changes.

Alternatively, start a SSH session of two from another computer before making the changes, and backup any files before changing them.

If you lock yourself out with no alternative way in, you'll need to boot the system using a live Linux media, then mount your root filesystem and undo your changes to it.

telcoM
  • 87,318
  • 3
  • 112
  • 232
  • Thank you, the fallback method is greatly appreciated. I'll try to make this work today, my file is called `lightdm` instead of `gdm`. – Emil S. Sep 29 '21 at 14:40
  • Just tried it, worked like a charm, thank you so much! This solution is as clean as it gets. I can now directly login after boot with my password and still unlock and `sudo` with the fingerprint. I copied the contents of `common-auth` into `lightdm` where they would've been included. Then I commented out the `fprint` line. – Emil S. Sep 29 '21 at 14:53