Use multiple PAM login methods at once?

Question

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times before password login is allowed.

I'd like if both login methods were available at the same time, such that you could login with either fingerprint or password without having to fail either a certain number of times. Is this possible?

My /etc/pam.d/system-auth is as follows:

#%PAM-1.0

auth      sufficient pam_fprintd.so
auth      sufficient  pam_unix.so     try_first_pass nullok
#auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   optional  pam_permit.so
account   required  pam_time.so

password  required  pam_unix.so     try_first_pass nullok sha512 shadow
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_unix.so
session   optional  pam_permit.so

---

Here's the journal output with the debug option:

Jun 18 09:50:34 Archenemy dbus[261]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service'
Jun 18 09:50:34 Archenemy systemd[1]: Starting Fingerprint Authentication Daemon...
Jun 18 09:50:34 Archenemy dbus[261]: [system] Successfully activated service 'net.reactivated.Fprint'
Jun 18 09:50:34 Archenemy systemd[1]: Started Fingerprint Authentication Daemon.
Jun 18 09:50:34 Archenemy sudo[3356]: pam_fprintd(sudo): Using device /net/reactivated/Fprint/Device/0
Jun 18 09:50:34 Archenemy fprintd[3357]: ** Message: user 'yau' claiming the device: 0
Jun 18 09:50:35 Archenemy fprintd[3357]: ** Message: now monitoring fd 15
Jun 18 09:50:35 Archenemy fprintd[3357]: ** Message: device 0 claim status 0
Jun 18 09:50:35 Archenemy fprintd[3357]: ** Message: start verification device 0 finger 6
Jun 18 09:50:35 Archenemy sudo[3356]: pam_fprintd(sudo): verify_finger_selected Swipe your right thumb across the fingerprint reader
Jun 18 09:50:37 Archenemy fprintd[3357]: ** Message: verify_cb: result verify-match (1)
Jun 18 09:50:37 Archenemy sudo[3356]: pam_fprintd(sudo): Verify result: verify-match
Jun 18 09:50:37 Archenemy fprintd[3357]: ** Message: no longer monitoring fd 15
Jun 18 09:50:37 Archenemy fprintd[3357]: ** Message: released device 0
Jun 18 09:50:37 Archenemy sudo[3356]: yau : TTY=pts/2 ; PWD=/home/yau ; USER=root ; COMMAND=/bin/bash
Jun 18 09:50:37 Archenemy sudo[3356]: pam_unix(sudo:session): session opened for user root by yau(uid=0)

Answer 1

From /usr/share/doc/fprintd-pam-0.5.0/README

• pam_fprintd doesn't support entering either the password or a fingerprint, as pam_thinkfinger does, because it's a gross hack, and could be fixed by having the login managers run 2 separate PAM stacks

Answer 2

I forked libfprint-fprintd, now fingerprint and password can work together: https://github.com/zsxsoft/libfprint-fprintd

Just compile it as usual way, and add auth sufficient pam_fprintd.so to /etc/pam.d/{sudo, ...}

In current version, you can directly input password after hint "Place your finger on the fingerprint reader". In sudo, pam_fprintd.so will auto fail and pass the password to the next pam after press enter. Also, you can press enter directly to skip fingerprint.

(Just ignore my path, it's for test)

Answer 3

Set 'pam_fprint' to 'sufficient' and ensure 'pam_unix' is set to 'sufficient' while following up with 'pam_deny' as 'required'

The documentation for pam_fprint has a good example while the pam systems administration guide has great examples of complex configurations.