|
Packit |
f7449a |
PAM module for fingerprint authentication
|
|
Packit |
f7449a |
-----------------------------------------
|
|
Packit |
f7449a |
|
|
Packit |
f7449a |
Using:
|
|
Packit |
f7449a |
* Modify the appropriate PAM configuration file
|
|
Packit |
f7449a |
(/etc/pam.d/system-auth-ac on Fedora systems), and add the line:
|
|
Packit |
f7449a |
auth sufficient pam_fprintd.so
|
|
Packit |
f7449a |
before the line:
|
|
Packit |
f7449a |
auth sufficient pam_unix.so ...
|
|
Packit |
f7449a |
* You can now enroll fingerprints using fprintd-enroll. The first available
|
|
Packit |
f7449a |
fingerprint available will be used to log you in.
|
|
Packit |
f7449a |
|
|
Packit |
f7449a |
Options:
|
|
Packit |
f7449a |
* You can add the "debug" option on the pam configuration file line above,
|
|
Packit |
f7449a |
this will log more information from PAM to the file specified in your
|
|
Packit |
f7449a |
syslog configuration (/var/log/secure by default on Fedora)
|
|
Packit |
f7449a |
|
|
Packit |
f7449a |
Known issues:
|
|
Packit |
f7449a |
* pam_fprintd does not support identifying the user itself as
|
|
Packit |
f7449a |
that would mean having the fingerprint reader on for all the time
|
|
Packit |
f7449a |
the user selection is displayed, and could damage the hardware.
|
|
Packit |
f7449a |
It could be fixed by having gdm/login only start the PAM conversation
|
|
Packit |
f7449a |
when there is activity
|
|
Packit |
f7449a |
* pam_fprintd doesn't support entering either the password or a fingerprint,
|
|
Packit |
f7449a |
as pam_thinkfinger does, because it's a gross hack, and could be fixed
|
|
Packit |
f7449a |
by having the login managers run 2 separate PAM stacks
|