View source for Fingerprint scanner

Fingerprint scanners (on laptop computers) can be used to unlock devices instead of using passwords.

== Install ==
<syntaxhighlight lang="nixos">
# Start the driver at boot
systemd.services.fprintd = {
  wantedBy = [ "multi-user.target" ];
  serviceConfig.Type = "simple";
};

# Install the driver
services.fprintd.enable = true;
# If simply enabling fprintd is not enough, try enabling fprintd.tod...
services.fprintd.tod.enable = true;
# ...and use one of the next four drivers
services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix; # Goodix driver module
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-elan; # Elan(04f3:0c4b) driver
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-vfs0090; # (Marked as broken as of 2025/04/23!) driver for 2016 ThinkPads
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)

# however for focaltech 2808:a658, use fprintd with overidden package (without tod)
# services.fprintd.package = pkgs.fprintd.override {
#   libfprint = pkgs.libfprint-focaltech-2808-a658;
# };
</syntaxhighlight>

== Enroll fingerprint ==
Fingerprint enrollment can be done via the [[Command Shell|CLI]] or the UI in the Desktop Environment if available.

=== CLI ===
<syntaxhighlight lang="bash">$ fprintd-enroll</syntaxhighlight>

=== Gnome ===
In [[GNOME|Gnome]], the the fingerprints can be configured through the Settings application.
# Open Gnome Settings
# Scroll down to ''System''
# Enter the ''Users'' menu
# Enter ''Fingerprint Login'' and add fingerprints

'''Note:''' If the ''Fingerprint Login'' item is not available, the <code>fprintd</code> driver might not be configured correctly.

== Login ==
While <code>services.fprintd.enable = true;</code> enables fingerprint login for the majority of display manager via the corresponding [https://search.nixos.org/options?channel=unstable&show=security.pam.services.%3Cname%3E.fprintAuth&from=0&size=50&sort=relevance&type=packages&query=pam.services.%3Cname%3E. PAM module], it can sometimes disable the ability to login using a password. This is addressed in the GitHub issue [https://github.com/NixOS/nixpkgs/issues/171136 171136]. In that issue, a possible workaround is addressed using a custom PAM module for the gnome display manager:<syntaxhighlight lang="nixos">
security.pam.services.login.fprintAuth = false;
security.pam.services.gdm-fingerprint = lib.mkIf (config.services.fprintd.enable) {
  text = ''
    auth       required                    pam_shells.so
    auth       requisite                   pam_nologin.so
    auth       requisite                   pam_faillock.so      preauth
    auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
    auth       optional                    pam_permit.so
    auth       required                    pam_env.so
    auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
    auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so

    account    include                     login

    password   required                    pam_deny.so

    session    include                     login
    session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
  '';
};

</syntaxhighlight>
[[Category:Hardware]]