fdo-mirrors/fprintd
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/fprintd.git synced 2026-02-04 13:00:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
fprintd/pam
History
Benjamin Berg 9ec1747b84 Revert "pam_fprintd: Just return a PAM_AUTH_ERROR on unknown errors" 
This reverts commit ecf6b7c323.

The idea of the commit was to make device failures less fatal to the
system. Unfortunately, we can fail quickly in this case, and returning
PAM_AUTH_ERR means that the user might run into a retry limit due to
this.

Go back to reporting PAM_AUTHINFO_UNAVAIL, it appears as the lesser evil
right now. Ideally we want to a way to tell the upper stack to retry
authentication whenever there is a good opportunity, but to not consider
it as an authentication failure.
2021-07-01 12:59:11 +02:00
..
fingerprint-strings.h fprintd: Reindent the source code following uncrustify rules 2020-12-07 18:41:45 +01:00
meson.build build: Make pam module installation dir configurable 2020-02-10 14:49:11 +01:00
pam_fprintd.c Revert "pam_fprintd: Just return a PAM_AUTH_ERROR on unknown errors" 2021-07-01 12:59:11 +02:00
pam_fprintd.ver Revert "build: Ensure that gcov symbols are exposed when needed" 2020-02-05 17:09:19 +01:00
pam_fprintd_autoptrs.h fprintd: Reindent the source code following uncrustify rules 2020-12-07 18:41:45 +01:00
README Add README for the PAM module 2008-12-04 13:23:50 +00:00

README 

PAM module for fingerprint authentication
-----------------------------------------

Using:
* Modify the appropriate PAM configuration file
(/etc/pam.d/system-auth-ac on Fedora systems), and add the line:
auth        sufficient    pam_fprintd.so
before the line:
auth        sufficient    pam_unix.so ...
* You can now enroll fingerprints using fprintd-enroll. The first available
  fingerprint available will be used to log you in.

Options:
* You can add the "debug" option on the pam configuration file line above,
  this will log more information from PAM to the file specified in your
  syslog configuration (/var/log/secure by default on Fedora)

Known issues:
* pam_fprintd does not support identifying the user itself as
  that would mean having the fingerprint reader on for all the time
  the user selection is displayed, and could damage the hardware.
  It could be fixed by having gdm/login only start the PAM conversation
  when there is activity
* pam_fprintd doesn't support entering either the password or a fingerprint,
  as pam_thinkfinger does, because it's a gross hack, and could be fixed
  by having the login managers run 2 separate PAM stacks