Setting up fprintd for swaylock - Revision history

Prabuanand: added redirect link

2025-09-02T03:52:56Z

added redirect link

← Older revision	Revision as of 03:52, 2 September 2025
Line 1:	Line 1:
		#REDIRECT [[Fingerprint Authentication with swaylock]]

Benaki: Blanked the page

2025-09-01T14:09:44Z

Blanked the page

← Older revision		Revision as of 14:09, 1 September 2025
Line 1:		Line 1:
	~~= Fingerprint Authentication with swaylock =~~

	~~This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:~~
	* <code><enter password></code> → <code><hit enter></code>
	* <code><hit enter></code> → <code><touch fingerprint sensor></code>

	~~== Installation ==~~

	~~Install the fprintd package:~~

	~~doas apk add fprintd~~

	~~== Configure PolicyKit Permissions ==~~

	~~Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:~~

	~~doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'~~
	~~polkit.addRule(function (action, subject) {~~
	~~if (action.id.indexOf("net.reactivated.fprint.") == 0) {~~
	~~if (subject.isInGroup("input")) {~~
	~~return polkit.Result.YES;~~
	}
	}
	~~});~~
	~~EOF~~

	~~Add your user to the <code>input</code> group:~~

	~~doas adduser $USER input~~

	~~'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.~~

	~~== Enroll Fingerprints ==~~

	~~If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:~~

	~~# Delete fingerprints for current user~~
	~~fprintd-delete $(whoami)~~

	~~# If you accidentally enrolled as root, delete those too~~
	~~doas fprintd-delete root~~

	~~Enroll your fingerprint(s):~~

	~~fprintd-enroll~~

	~~Verify the enrollment works:~~

	~~fprintd-verify~~

	~~== Configure PAM for swaylock ==~~

	~~Create the PAM configuration for swaylock:~~

	~~doas tee /etc/pam.d/swaylock << 'EOF'~~
	~~# Try password authentication first~~
	~~auth sufficient pam_unix.so nullok~~
	~~# If no password provided, try fingerprint~~
	~~auth sufficient pam_fprintd.so ignore-empty-password~~
	~~auth required pam_deny.so~~

	~~# KWallet integration (optional)~~
	~~-auth optional pam_kwallet.so~~
	~~-auth optional pam_kwallet5.so~~
	~~-session optional pam_kwallet.so auto_start~~
	~~-session optional pam_kwallet5.so auto_start~~
	~~EOF~~

	~~== Usage ==~~

	~~Once configured, swaylock will accept both authentication methods:~~

	* '''Password authentication:''' Type your password and press Enter
	* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor

	~~== Troubleshooting ==~~

	* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group
	* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)
	* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code>

	~~== Extending to Other Services ==~~

	~~You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:~~
	* <code>sudo</code> or <code>doas</code>
	* <code>polkit-1</code>
	* <code>login</code>
	* <code>su</code>

Benaki at 13:41, 1 September 2025

2025-09-01T13:41:22Z

← Older revision		Revision as of 13:41, 1 September 2025
Line 9:		Line 9:
	Install the fprintd package:		Install the fprintd package:

	~~<syntaxhighlight lang="bash">~~		doas apk add fprintd
	doas apk add fprintd
	~~</syntaxhighlight>~~

	== Configure PolicyKit Permissions ==		== Configure PolicyKit Permissions ==
Line 17:		Line 15:
	Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:		Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:

	~~<syntaxhighlight lang="bash">~~		doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
	doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'		polkit.addRule(function (action, subject) {
	polkit.addRule(function (action, subject) {		if (action.id.indexOf("net.reactivated.fprint.") == 0) {
	if (action.id.indexOf("net.reactivated.fprint.") == 0) {		if (subject.isInGroup("input")) {
	if (subject.isInGroup("input")) {		return polkit.Result.YES;
	return polkit.Result.YES;		}
	}		}
	}		});
	});		EOF
	EOF
	~~</syntaxhighlight>~~

	Add your user to the <code>input</code> group:		Add your user to the <code>input</code> group:

	~~<syntaxhighlight lang="bash">~~		doas adduser $USER input
	doas adduser $USER input
	~~</syntaxhighlight>~~

	{{Note\|You must log out and back in (or reboot) for the group membership to take effect.}}		'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.

	== Enroll Fingerprints ==		== Enroll Fingerprints ==
Line 41:		Line 35:
	If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:		If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:

	~~<syntaxhighlight lang="bash">~~		# Delete fingerprints for current user
	# Delete fingerprints for current user		fprintd-delete $(whoami)
	fprintd-delete $(whoami)
			# If you accidentally enrolled as root, delete those too
	# If you accidentally enrolled as root, delete those too		doas fprintd-delete root
	doas fprintd-delete root
	~~</syntaxhighlight>~~

	Enroll your fingerprint(s):		Enroll your fingerprint(s):

	~~<syntaxhighlight lang="bash">~~		fprintd-enroll
	fprintd-enroll
	~~</syntaxhighlight>~~

	Verify the enrollment works:		Verify the enrollment works:

	~~<syntaxhighlight lang="bash">~~		fprintd-verify
	fprintd-verify
	~~</syntaxhighlight>~~

	== Configure PAM for swaylock ==		== Configure PAM for swaylock ==
Line 65:		Line 53:
	Create the PAM configuration for swaylock:		Create the PAM configuration for swaylock:

	~~<syntaxhighlight lang="bash">~~		doas tee /etc/pam.d/swaylock << 'EOF'
	doas tee /etc/pam.d/swaylock << 'EOF'		# Try password authentication first
	# Try password authentication first		auth sufficient pam_unix.so nullok
	auth sufficient pam_unix.so nullok		# If no password provided, try fingerprint
	# If no password provided, try fingerprint		auth sufficient pam_fprintd.so ignore-empty-password
	auth sufficient pam_fprintd.so ignore-empty-password		auth required pam_deny.so
	auth required pam_deny.so
			# KWallet integration (optional)
	# KWallet integration (optional)		-auth optional pam_kwallet.so
	-auth optional pam_kwallet.so		-auth optional pam_kwallet5.so
	-auth optional pam_kwallet5.so		-session optional pam_kwallet.so auto_start
	-session optional pam_kwallet.so auto_start		-session optional pam_kwallet5.so auto_start
	-session optional pam_kwallet5.so auto_start		EOF
	EOF
	~~</syntaxhighlight>~~

	== Usage ==		== Usage ==

Benaki at 13:36, 1 September 2025

2025-09-01T13:36:08Z

← Older revision		Revision as of 13:36, 1 September 2025
Line 1:		Line 1:
	# Fingerprint Authentication with swaylock		= Fingerprint Authentication with swaylock =

	This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:		This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:
	~~- `~~<enter password>` → `<hit enter>`		* <code><enter password></code> → <code><hit enter></code>
	~~- `~~<hit enter>` → `<touch fingerprint sensor>`		* <code><hit enter></code> → <code><touch fingerprint sensor></code>

	## Installation		== Installation ==

	Install the fprintd package:		Install the fprintd package:

	~~```~~bash		<syntaxhighlight lang="bash">
	doas apk add fprintd		doas apk add fprintd
	~~```~~		</syntaxhighlight>

	## Configure PolicyKit Permissions		== Configure PolicyKit Permissions ==

	Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the `input` group to manage fingerprints:		Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:

	~~```~~bash		<syntaxhighlight lang="bash">
	doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'		doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
	polkit.addRule(function (action, subject) {		polkit.addRule(function (action, subject) {
Line 27:		Line 27:
	});		});
	EOF		EOF
	~~```~~		</syntaxhighlight>

	Add your user to the `input` group:		Add your user to the <code>input</code> group:

	~~```~~bash		<syntaxhighlight lang="bash">
	doas adduser $USER input		doas adduser $USER input
	~~```~~		</syntaxhighlight>

	Note: You must log out and back in (or reboot) for the group membership to take effect.		{{Note\|You must log out and back in (or reboot) for the group membership to take effect.}}

	## Enroll Fingerprints		== Enroll Fingerprints ==

	If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:		If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:

	~~```~~bash		<syntaxhighlight lang="bash">
	# Delete fingerprints for current user		# Delete fingerprints for current user
	fprintd-delete $(whoami)		fprintd-delete $(whoami)
Line 47:		Line 47:
	# If you accidentally enrolled as root, delete those too		# If you accidentally enrolled as root, delete those too
	doas fprintd-delete root		doas fprintd-delete root
	~~```~~		</syntaxhighlight>

	Enroll your fingerprint(s):		Enroll your fingerprint(s):

	~~```~~bash		<syntaxhighlight lang="bash">
	fprintd-enroll		fprintd-enroll
	~~```~~		</syntaxhighlight>

	Verify the enrollment works:		Verify the enrollment works:

	~~```~~bash		<syntaxhighlight lang="bash">
	fprintd-verify		fprintd-verify
	~~```~~		</syntaxhighlight>

	## Configure PAM for swaylock		== Configure PAM for swaylock ==

	Create the PAM configuration for swaylock:		Create the PAM configuration for swaylock:

	~~```~~bash		<syntaxhighlight lang="bash">
	doas tee /etc/pam.d/swaylock << 'EOF'		doas tee /etc/pam.d/swaylock << 'EOF'
	# Try password authentication first		# Try password authentication first
Line 79:		Line 79:
	-session optional pam_kwallet5.so auto_start		-session optional pam_kwallet5.so auto_start
	EOF		EOF
	~~```~~		</syntaxhighlight>

	## Usage		== Usage ==

	Once configured, swaylock will accept both authentication methods:		Once configured, swaylock will accept both authentication methods:

	- Password authentication: Type your password and press Enter		* '''Password authentication:''' Type your password and press Enter
	- Fingerprint authentication: Press Enter without typing anything, then touch the fingerprint sensor		* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor

	## Troubleshooting		== Troubleshooting ==

	- Permission denied during enrollment: Ensure you're in the `input` group and have logged out/in after adding the group		* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group
	- Fingerprint recognized but doesn't unlock: Check that fingerprints are enrolled for the correct user (not root)		* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)
	- No fallback to password: Verify the PAM configuration has `pam_unix.so` before `pam_fprintd.so`		* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code>

	## Extending to Other Services		== Extending to Other Services ==

	You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in `/etc/pam.d/` such as:		You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:
	~~- `~~sudo` or `doas`		* <code>sudo</code> or <code>doas</code>
	~~- `~~polkit-1`		* <code>polkit-1</code>
	~~- `~~login`		* <code>login</code>
	~~- `~~su`		* <code>su</code>

Benaki at 13:34, 1 September 2025

2025-09-01T13:34:42Z

← Older revision		Revision as of 13:34, 1 September 2025
Line 1:		Line 1:
	~~To enable~~ swaylock ~~to unlock like so:~~		# Fingerprint Authentication with swaylock

	<enter password> <hit enter>		This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:
			- `<enter password>` → `<hit enter>`
			- `<hit enter>` → `<touch fingerprint sensor>`

	or		## Installation

	~~<hit enter> <touch fingerprint sensor>~~		Install the fprintd package:

	~~To install fprintd:~~		```bash
	$ doas apk add fprintd		doas apk add fprintd
			```

	~~Upon installation a standard user was not authorized to add prints.~~		## Configure PolicyKit Permissions
	~~The below was used to allow members of the 'input' group to add prints:~~

	~~$ sudo~~ tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'		Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the `input` group to manage fingerprints:

			```bash
			doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
	polkit.addRule(function (action, subject) {		polkit.addRule(function (action, subject) {
	if (action.id.indexOf("net.reactivated.fprint.") == 0) {		if (action.id.indexOf("net.reactivated.fprint.") == 0) {
	if (subject.isInGroup("input")) {		if (subject.isInGroup("input")) {
	return polkit.Result.YES;		return polkit.Result.YES;
	}		}
	}		}
	});		});
	EOF		EOF
			```

			Add your user to the `input` group:

			```bash
			doas adduser $USER input
			```

			Note: You must log out and back in (or reboot) for the group membership to take effect.

			## Enroll Fingerprints

			If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:

			```bash
			# Delete fingerprints for current user
			fprintd-delete $(whoami)

	$ doas ~~adduser $USER input~~		# If you accidentally enrolled as root, delete those too
			doas fprintd-delete root
			```

	(~~reboot~~)		Enroll your fingerprint(s):

	~~I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):~~		```bash
			fprintd-enroll
			```

	~~$ fprintd-delete $(whoami)~~		Verify the enrollment works:
	~~$ fprintd-delete root~~

	~~Then enroll fresh print(s):~~		```bash
			fprintd-verify
			```

	~~$ fprintd-enroll~~		## Configure PAM for swaylock
	~~$ fprintd-verify~~

	~~Then, to set~~ the swaylock ~~config~~:		Create the PAM configuration for swaylock:

	~~$ sudo~~ tee /etc/pam.d/swaylock << 'EOF'		```bash
			doas tee /etc/pam.d/swaylock << 'EOF'
	# Try password authentication first		# Try password authentication first
	auth sufficient pam_unix.so nullok		auth sufficient pam_unix.so nullok
	# If no password provided, try fingerprint		# If no password provided, try fingerprint
	auth sufficient pam_fprintd.so ignore-empty-password		auth sufficient pam_fprintd.so ignore-empty-password
	auth required pam_deny.so # ~~Keep the wallet stuff~~		auth required pam_deny.so
	-auth optional pam_kwallet.so
	-auth optional pam_kwallet5.so		# KWallet integration (optional)
	-session optional pam_kwallet.so auto_start		-auth optional pam_kwallet.so
	-session optional pam_kwallet5.so auto_start		-auth optional pam_kwallet5.so
			-session optional pam_kwallet.so auto_start
			-session optional pam_kwallet5.so auto_start
	EOF		EOF
			```

			## Usage

			Once configured, swaylock will accept both authentication methods:

			- Password authentication: Type your password and press Enter
			- Fingerprint authentication: Press Enter without typing anything, then touch the fingerprint sensor

			## Troubleshooting

			- Permission denied during enrollment: Ensure you're in the `input` group and have logged out/in after adding the group
			- Fingerprint recognized but doesn't unlock: Check that fingerprints are enrolled for the correct user (not root)
			- No fallback to password: Verify the PAM configuration has `pam_unix.so` before `pam_fprintd.so`

			## Extending to Other Services

			You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in `/etc/pam.d/` such as:
			- `sudo` or `doas`
			- `polkit-1`
			- `login`
			- `su`

Benaki at 13:31, 1 September 2025

2025-09-01T13:31:22Z

← Older revision		Revision as of 13:31, 1 September 2025
Line 1:		Line 1:
	To enable swaylock to unlock like so:		To enable swaylock to unlock like so:

	<enter password> <hit enter>		<enter password> <hit enter>

	or		or

	<hit enter> <touch fingerprint sensor>		<hit enter> <touch fingerprint sensor>

	To install fprintd:		To install fprintd:
	doas apk add fprintd		$ doas apk add fprintd

	Upon installation a standard user was not authorized to add prints.		Upon installation a standard user was not authorized to add prints.
	The below was used to allow members of the 'input' group to add prints:		The below was used to allow members of the 'input' group to add prints:

	sudo tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'		$ sudo tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
	polkit.addRule(function (action, subject) {		polkit.addRule(function (action, subject) {
	if (action.id.indexOf("net.reactivated.fprint.") == 0) {		if (action.id.indexOf("net.reactivated.fprint.") == 0) {
Line 20:		Line 23:
	EOF		EOF

	doas adduser $USER input		$ doas adduser $USER input

	(reboot)		(reboot)
Line 26:		Line 29:
	I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):		I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):

	fprintd-delete $(whoami)		$ fprintd-delete $(whoami)
	fprintd-delete root		$ fprintd-delete root

	Then enroll fresh print(s):		Then enroll fresh print(s):

	fprintd-enroll		$ fprintd-enroll
	fprintd-verify		$ fprintd-verify

	Then, to set the swaylock config:		Then, to set the swaylock config:

	sudo tee /etc/pam.d/swaylock << 'EOF'		$ sudo tee /etc/pam.d/swaylock << 'EOF'
	# Try password authentication first		# Try password authentication first
	auth sufficient pam_unix.so nullok		auth sufficient pam_unix.so nullok

Benaki: Swaylock using fprintd

2025-09-01T13:28:38Z

Swaylock using fprintd

New page

To enable swaylock to unlock like so:
<enter password> <hit enter>
or
<hit enter> <touch fingerprint sensor>

To install fprintd:
doas apk add fprintd

Upon installation a standard user was not authorized to add prints.
The below was used to allow members of the 'input' group to add prints:

sudo tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
polkit.addRule(function (action, subject) {
if (action.id.indexOf("net.reactivated.fprint.") == 0) {
if (subject.isInGroup("input")) {
return polkit.Result.YES;
}
}
});
EOF

doas adduser $USER input

(reboot)

I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):

fprintd-delete $(whoami)
fprintd-delete root

Then enroll fresh print(s):

fprintd-enroll
fprintd-verify

Then, to set the swaylock config:

sudo tee /etc/pam.d/swaylock << 'EOF'
# Try password authentication first
auth sufficient pam_unix.so nullok
# If no password provided, try fingerprint
auth sufficient pam_fprintd.so ignore-empty-password
auth required pam_deny.so # Keep the wallet stuff
-auth optional pam_kwallet.so
-auth optional pam_kwallet5.so
-session optional pam_kwallet.so auto_start
-session optional pam_kwallet5.so auto_start
EOF