I cannot login to my CachyOs profile with my fingerprint reader

Dear Forum community,

first of all a major thank you for this amazing thing that is Cachy. And also thanks to everybody here helping out and contributing. Now, im a noob when it comes to Linux, in Windows i probably wouldnt struggle this much.

The issue is this: I want to install a fingerprint reader on my Lenovo x13 Gen 4. So i asked the Brave Browser AI to help me and followed these steps:

Summary

sudo pacman -S fprintd libpam-fprintd
fprintd-enroll
sudo pam-auth-update --enable fprintd
sudo pacman -Syu && sudo pacman -S fprintd libfprint

Edit /etc/pam.d/system-auth and add this line at the top of the auth section:auth sufficient pam_fprintd.so

Now i readily admit that I have no idea what I just did. However the fingerprint reader is working within CachyOs. Whenever it asks me to input my password, the fingerprint is available.

However I cannot login to my CachyOs profile with the fingerprint. Just the written password. Additionally, since I added that ‘ auth sufficient pam_fprintd.so’ line, the computer takes about a minute to login when I use the written password. Before I added that line, it took mere seconds.

So id like to kindly ask you, if I made a mistake, and how it would be possible to activate that fingerprint reader for the login screen as well. And maybe as a goody reduce that login time?

Im sure what I did looks like a mess to you and it probably is. All im asking for is some benevolence for a noob that tries to get rid Spydows.

Thanks for reading this far and thanks for any advice in advance.

Hello @AdmirAlex Bad news, fingerprint login works for screen unlocking and sudo , it does not work for the initial login after system boot.

All that good stuff is after your system boots up to desktop. :frowning:

I won’t be hurt if someone proves me wrong though. :slight_smile:

PS my understanding was a extra line was needed ie:

auth [success=1 new_authtok_reqd=1 default=ignore] pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_fprintd.so

They needed to be on top of that file, in location /etc/pam.d/sddm

Also I edited the title to read better.

I might be a feature, not a bug. It is not a good idea at all to set up your device with biometric login. No matter, Laptop or Phone. :wink:

It is not a good idea at all to set up your device with biometric login.

It might be not as secure as fingerprint manufacturers would have you believe but is very convenient to unlock for example your phone with a fingerprint and it also prevents people around you to see your unlock pattern.

Thank you for all your input! Its a balancing act when it comes to biometrics. Its just that all that terminal work and all those passwords one has to put in is a lot more than one has to do on Spydows. So I decided to stick to the idea and not use the biometric stuff.

How do I remove all that stuff that has been installed? Is there a simple command in the terminal?

There is one more thing im wondering about: When I ask AI (I hate it but i dont know an easier way to understand all this terminal work) it tells me to use an ‘Extension Interface’ or something like that. Is the AI talking about Octopi and the CachyHello App? And is there a GUI way to install all these programs? Basically is there a ‘Windows way’ to do all these things without using the terminal?

Oh and concerning the title: all this ‘programing’ in the terminal got me a bit excited. Its just that the terminal is a bit intimidating :wink:

Thanks again everybody. This is fun! :slight_smile:

Moin,

I can only advise you to buy a good Unix book or borrow one from a library.
Then there are help pages for 99% of all Unix commands that you use in the console, which you can view in the terminal, e.g. :wink:

# man ls

Then you will see the following

LS(1)                                                                                                    User Commands                                                                                                   LS(1)

NAME
       ls - list directory contents

SYNOPSIS
       ls [OPTION]... [FILE]...

DESCRIPTION
       List information about the FILEs (the current directory by default).  Sort entries alphabetically if none of -cftuvSUX nor --sort is specified.

       Mandatory arguments to long options are mandatory for short options too.

       -a, --all
              do not ignore entries starting with .

       -A, --almost-all
              do not list implied . and ..

       --author
              with -l, print the author of each file

       -b, --escape
              print C-style escapes for nongraphic characters

       --block-size=SIZE
              with -l, scale sizes by SIZE when printing them; e.g., '--block-size=M'; see SIZE format below

       -B, --ignore-backups
              do not list implied entries ending with ~

       -c     with -lt: sort by, and show, ctime (time of last change of file status information); with -l: show ctime and sort by name; otherwise: sort by ctime, newest first

       -C     list entries by columns

       --color[=WHEN]
              color the output WHEN; more info below

       -d, --directory
              list directories themselves, not their contents

       -D, --dired
              generate output designed for Emacs' dired mode

       -f     same as -a -U

       -F, --classify[=WHEN]
              append indicator (one of */=>@|) to entries WHEN

       --file-type
              likewise, except do not append '*'

       --format=WORD
              across,horizontal (-x), commas (-m), long (-l), single-column (-1), verbose (-l), vertical (-C)

       --full-time
              like -l --time-style=full-iso

Would also work with,

# info ls

Then like this

Next: dir invocation,  Up: Directory listing

10.1 ‘ls’: List directory contents
==================================

The ‘ls’ program lists information about files (of any type, including
directories).  Options and file arguments can be intermixed arbitrarily,
as usual.  Later options override earlier options that are incompatible.

   For non-option command-line arguments that are directories, by
default ‘ls’ lists the contents of directories, not recursively, and
omitting files with names beginning with ‘.’.  For other non-option
arguments, by default ‘ls’ lists just the file name.  If no non-option
argument is specified, ‘ls’ operates on the current directory, acting as
if it had been invoked with a single argument of ‘.’.

   By default, ‘ls’ lists each directory's contents alphabetically,
according to the locale settings in effect.(1)  If standard output is a
terminal, the output is in columns (sorted vertically) and control
characters are output as question marks; otherwise, the output is listed
one per line and control characters are output as-is.

   Because ‘ls’ is such a fundamental program, it has accumulated many
options over the years.  They are described in the subsections below;
within each section, options are listed alphabetically (ignoring case).
The division of options into the subsections is not absolute, since some
options affect more than one aspect of ‘ls’'s operation.

   Exit status:

     0 success
     1 minor problems  (e.g., failure to access a file or directory not
       specified as a command line argument.  This happens when listing a
       directory in which entries are actively being removed or renamed.)
     2 serious trouble (e.g., memory exhausted, invalid option, failure
       to access a file or directory specified as a command line argument
       or a directory loop)

   Also see *note Common options::.

* Menu:

* Which files are listed::
* What information is listed::
* Sorting the output::
* General output formatting::
* Formatting file timestamps::
* Formatting the file names::

octopi is probably the best alternative to software installation if you don’t want to mess around with the console.

If you mean the administration of a Linux workstation in general, every graphical desktop environment, such as KDE, Gnome, XFCE, etc., has its own tools. In KDE, it is system settings tool

Kind regards
Bernd

Risking to deviate even further from the original topic, here are some random thoughts.

How do I remove all that stuff that has been installed? Is there a simple command in the terminal?

I guess you mean all the things you installed by randomly entering these commands you didn’t fully understand into a CLI (which, by the way, is the quickest way to really mess up your system):

sudo pacman -S fprintd libpam-fprintd
fprintd-enroll
sudo pam-auth-update --enable fprintd
sudo pacman -Syu && sudo pacman -S fprintd libfprint

The answer to that is: get familiar with pacman then you can uninstall the packages the same way you installed them but with the -Rs argument like so:

sudo pacman -Rs fprintd libfprint libpam-fprintd

But only do this when you are sure you really want to uninstall the packages, which is a decision I can’t make for you.

Next, you asked:

When I ask AI (I hate it but i dont know an easier way to understand all this terminal work) it tells me to use an ‘Extension Interface’ or something like that. Is the AI talking about Octopi and the CachyHello App?

Why not ask your AI the same? I don’t know what the AI meant with an Extension Interface, maybe it was talking about GNOME Extensions which will not help you when you are on KDE (which, again, we can only presume but do not know). If you do not know what I am talking about, read (or watch videos or ask an AI) on Desktop Enviroments in Linux in general and GNOME and KDE specifically.

Next:

And is there a GUI way to install all these programs?

As @dp20eic mentioned, Octopi or the Cachy Package Manager would likely be the best guess here.

Basically is there a ‘Windows way’ to do all these things without using the terminal?

You better drop that thought immediately when you are on an Arch-derivate. You will have to get familiar with the command line when you are on Linux, there is no way around that and don’t let people tell you otherwise. You can install / uninstall programs using either Octopi or the Cachy Package Manager, but you will have to dive into the CLI sooner or later so get accustomed to that.

Wow. Thank you :slight_smile: At this point its best for me to read everything you wrote and learn the basics. The initial question has been answered and I dont want to steer this thread off topic any further.

From now on ill slow down to learn what is happening.

Wish you all the best and happy holidays.

You can get the fingerprint reader working for logins. I’m using CachyOS (with KDE Plasma), and I login using the fingerprint reader (I feel like a caveman every time I have to use my password). I have a Dell Inspiron 5645, and the fingerprint reader works super fast (it’s basically instant).

There is a caveat though - you have to press [ENTER] first when the login greeter is waiting for you to enter your password. After that, you can touch your fingerprint sensor, and it should log you in.

To get it working with the SDDM login (KDE Plasma), edit /etc/pam.d/sddm, and add to the very top:

auth [success=1 new_authtok_reqd=1 default=ignore] pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_fprintd.so 
  • Reboot
  • Press [ENTER] when prompted to enter your login password.
  • Then use your fingerprint reader to log in (assuming you’ve already enrolled your fingerprint).

Yes Sir it’s not a race, but continual learning.
25 year user and I still learn something new daily. :smiley:

BTW Please note that the fingerprint reader is not working for the initial login after booting the system. This is a security feature to prevent unauthorized access to your system.

General hint: Chris Titus has some nice videos on Arch. Maybe grab a coffee (or which ever liquid you prefer) and watch some of them. Because you will have to maintain your system sooner or later so it’s better to come prepared:

https://www.youtube.com/@ChrisTitusTech/search?query=maintenance

Maybe start here:

https://www.youtube.com/watch?v=xhVS1HKwGWw

If, for some reason, you have a situation with state personel, it is allowed in some countries to enforce unlocking by “leading” your finger or scanning your face. Hard to do, when the only option is the pin stored only in your head. Better being a little paranoid than being sorry. “I have nothing to hide” is not a good argument in my opinion. :wink:

To get it working with the SDDM login (KDE Plasma), edit /etc/pam.d/sddm, and add to the very top:

auth [success=1 new_authtok_reqd=1 default=ignore] pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_fprintd.so 

  • Reboot

  • Press [ENTER] when prompted to enter your login password.

  • Then use your fingerprint reader to log in (assuming you’ve already enrolled your fingerprint).

I created an account just to upvote this. No fingerprint login on the initial login screen was killing me and this solved it for me.

Hey guys.

Also got an chipsailing-cs9711 and installed the custom fürintd: GitHub - mmhfarooque/chipsailing-cs9711-fingerprint-linux: Chipsailing CS9711 (USB 2541:0236) fingerprint scanner driver for Linux. One-command installer for Ubuntu, Debian, Fedora, Arch, openSUSE. Patched libfprint with 1500ms retry delay + PAM config. Includes .deb, RPM, and Arch packages. · GitHub

Enrolling is working but with the setup pam changes, the scanner does not work on login screen, lockscreen or sudo.

I manually edited the /etc/pam.d/sddm and added your lines.
On Lockscreen it works (WIN+L), but not on the initial screen nor on sudo comands.

This fixed it for me:

  • Reverted the changes /etc/pam.d/sddm
  • Edit the following file: sudo nano /etc/pam.d/system-auth
  • Add: as first auth line (under PAM…): auth sufficient pam_fprintd.so

This works for me on the following: sudo, login screen (sddm), lockscreen (sddm).

Hope this helps.

Hey guys, this is working for me with kdewallet: GitHub - Himalian/autokdewallet: Unlock kwallet automatilly, useful for non-password KDE users · GitHub
It auto unlocks with an salted tpm stored secret.
It is recommended to change the wallet password to someting else than your user pw (maybe also sudo).

There is a security risk associated with configuring auth sufficient pam_fprintd.so in /etc/pam.d/system-auth (see NVD - cve-2024-37408).

A safer approach may be to enable fingerprint authentication only in /etc/pam.d/polkit-1 (and in /etc/pam.d/sddm for login) and to use run0 instead of sudo (for tasks authenticated through fprintd). This reduces the risk of silently approving a privilege-escalation request other than the one the user intended.

For example, try running two commands simultaneously in different terminals (e.g. sudo whoami and echo Place your finger on the fingerprint reader;cat) and then authenticate with your fingerprint; see Fwd: Security vulnerability in fprintd.

Some information about run0: Sudo alternatives - #7 by triam; for common maintenance tasks, you can alias sudo to run0.

In minimal desktop environments or window managers, a PolicyKit authentication agent (e.g. polkit-gnome) is required to display authentication prompts.


In case of authentication problems with the CS9711 after resuming from sleep:

sudo tee /usr/lib/systemd/system-sleep/fprintd-fix <<'EOF'
#!/bin/sh
case "$1" in
  post)
    systemctl restart fprintd.service
    ;;
esac
EOF
sudo chmod +x /usr/lib/systemd/system-sleep/fprintd-fix

thanks regarding the security risk hint.
I think we all know that biometrics (fingerprint or face) is not as secure as a good password.
But the point is: convenience :innocent:
And i dont want to secure an main frame server, it’s just my personal computer.

Your sleep resume script with restarting fprintd.service completes my whole setup.
thx for this.