Fingerprint Authentication with swaylock
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using fingerprint sensor with password as fallback.
Prerequisites
- Enable Polkit
Installation
Install the fprintd package:
$ doas apk add fprintd
Configuration
To get the USB ID for your fingerprint reader, issue the command:
$ lsusb
Once onfigured this allows you to unlock using either:
<enter password>
→<hit enter>
<hit enter>
→<touch fingerprint sensor>
Configure policyKit permissions
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule etc/polkit-1/rules.d/50-fingerprint.rules to allow members of the input
group to manage fingerprints with contents as shown:
Contents of etc/polkit-1/rules.d/50-fingerprint.rules
Ensure that correct permissions are set:
# chown root:root /etc/polkit-1/rules.d/50-fingerprint.rules # chmod 644 /etc/polkit-1/rules.d/50-fingerprint.rules
Add your user to the input
group:
$ doas adduser $USER input
Enroll fingerprints
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:
To delete fingerprints for current user:
$ fprintd-delete $(whoami)
If you accidentally enrolled as root, delete those too
$ doas fprintd-delete root
Enroll your fingerprint(s):
$ fprintd-enroll
Verify the enrollment works:
$ fprintd-verify
Configure PAM for swaylock
Create the PAM configuration file /etc/pam.d/swaylock for swaylock with contents as shown:
Contents of /etc/pam.d/swaylock
Ensure that correct permissions are set:
# chown root:root /etc/pam.d/swaylock # chmod 644 /etc/pam.d/swaylock
Extending to other services
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in /etc/pam.d/
such as:
sudo
polkit-1
login
su
Usage
Once configured, swaylock will accept both authentication methods:
- Password authentication: Type your password and press Enter
- Fingerprint authentication: Press Enter without typing anything, then touch the fingerprint sensor
Troubleshooting
Permission denied during enrollment
If you receive Permission denied message during enrollment ensure you're in the input
group and have logged out/in after adding the group.
Fingerprint recognized but doesn't unlock
If Fingerprint is recognized but doesn't unlock, check that fingerprints are enrolled for the correct user (not root)
No fallback to password
If there is no fallback to password when using fingerprint authentication verify the PAM configuration has pam_unix.so
before pam_fprintd.so