In this lesson, you will learn how to configure the Pluggable Authentication Modules (PAM) stack to accept biometric input—specifically fingerprints—for authentication tasks like sudo and graphical logins.
The Mechanism of pam_fprintd
Biometric authentication in Linux typically relies on fprintd, a daemon that interfaces with fingerprint scanners. To integrate this into PAM, we use pam_fprintd.so. When you add this module to your PAM configuration, the system attempts to match your fingerprint against a stored template before falling back to your password.
Configuring the Authentication Stack
You apply these changes by modifying the files located in /etc/pam.d/. For example, to enable fingerprint authentication for sudo, you would edit the /etc/pam.d/sudo file.
You must place the pam_fprintd.so module with a sufficient control flag at the top of the auth stack:
# /etc/pam.d/sudo
auth sufficient pam_fprintd.so
auth include common-auth
By using the sufficient flag, you tell the PAM stack that if the fingerprint is successfully verified, the authentication process is complete, and the system should grant access immediately. If the fingerprint scan fails or times out, the stack proceeds to the next line—in this case, common-auth—which prompts you for your standard password.
Implementation Considerations
Before modifying these files, ensure you have enrolled your fingerprints using the fprintd-enroll command. If you do not enroll your fingers first, the PAM module will simply fail to find a match, causing a fallback to password authentication every time.
Be cautious when editing these files. Because PAM configurations are sensitive, a syntax error can lock you out of sudo or your desktop environment. It is standard practice to keep a root terminal open while testing configuration changes, or to have a recovery mechanism available, such as a live ISO, to revert changes if you accidentally misconfigure the authentication chain.
Key Takeaway: By placing pam_fprintd.so with the sufficient control flag in your PAM stack, you enable a seamless "biometric-first" authentication flow that automatically falls back to password entry upon failure or cancellation.