Skip to content
Garuda Linux Wiki

Fingerprint and biometrics setup

This guide uses a USB fingerprint reader with the fprintd service. The HID DigitalPersona 4500 reader (ID 05ba:000a) is reported to work. The Arch Wiki fprint page covers the base setup. The steps below add PAM changes so that a fingerprint or password works at login.

  1. Install the fingerprint daemon. The Garuda input-devices-support package depends on fprintd.

    Terminal window
    sudo pacman -S --needed fprintd

  2. Enroll your fingerprints in the terminal. The Arch Wiki fprint page has the full enrollment and verification steps.

    Terminal window
    fprintd-enroll

  3. Back up both PAM files before you edit them.

    Terminal window
    sudo cp /etc/pam.d/system-local-login /etc/pam.d/system-local-login.bak
    sudo cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak

  4. Open /etc/pam.d/system-local-login and add the line auth sufficient pam_fprintd.so above the block. The new file should look like this.

    %PAM-1.0
    auth sufficient pam_fprintd.so
    auth include system-login
    account include system-login
    password include system-login
    session include system-login

    This tells the system that an authentication via the fingerprint is a sufficient login method, and not strictly a password.

  5. Open /etc/pam.d/system-auth. The original guide changes more lines than the Arch Wiki example. Compare the result with your backup before you save. The complete file looks like this.

    Terminal window
    sudo micro /etc/pam.d/system-auth
    %PAM-1.0
    auth required pam_faillock.so preauth
    # Optionally use requisite above if you do not want to prompt for the password
    # on locked accounts.
    -auth [success=4 default=ignore] pam_systemd_home.so
    auth [success=1 default=ignore] pam_succeed_if.so service = plasmalogin
    auth [success=2 default=ignore] pam_fprintd.so
    auth [success=1 default=bad] pam_unix.so try_first_pass nullok
    auth [default=die] pam_faillock.so authfail
    auth optional pam_permit.so
    auth required pam_env.so
    auth required pam_faillock.so authsucc
    # If you drop the above call to pam_faillock.so the lock will be done also
    # on non-consecutive authentication failures.
    

    -account [success=1 default=ignore] pam_systemd_home.so
    account required pam_unix.so
    account optional pam_permit.so
    account required pam_time.so
    

    -password [success=1 default=ignore] pam_systemd_home.so
    password required pam_unix.so try_first_pass nullok shadow
    password optional pam_permit.so
    

    -session optional pam_systemd_home.so
    session required pam_limits.so
    session required pam_unix.so
    session optional pam_permit.so

    The line auth [success=1 default=ignore] pam_succeed_if.so service = plasmalogin lets the Plasma Login Manager login accept a fingerprint or a password, but not both. Plasma Login Manager uses the PAM service plasmalogin.

  6. Reboot and test the login with your fingerprint. Then test sudo in a terminal.

After this, sudo asks for a fingerprint first. After a timeout it asks for your password. Polkit dialogs do not use the fingerprint with this setup. The Arch Wiki Fprint page states that fingerprint recognition only works for the login manager and sudo, not polkit, unless you add a polkit rule.

The original guide also mentions a GUI option. Open KDE Settings > Users > [Select User Account] > Configure Fingerprint Authentication to add or delete fingerprints.

Source: How to set up fingerprint/biometrics