Fingerprint scanner: Difference between revisions
Full article for installing fingerprint scanners |
fprintd-enroll doesn't need to (and shouldn't) be run as root |
||
| (9 intermediate revisions by 8 users not shown) | |||
| Line 11: | Line 11: | ||
# Install the driver | # Install the driver | ||
services.fprintd.enable = true; | services.fprintd.enable = true; | ||
# If simply enabling fprintd is not enough, try enabling fprintd.tod... | |||
services.fprintd.tod.enable = true; | services.fprintd.tod.enable = true; | ||
# use one of the next four drivers | # ...and use one of the next four drivers | ||
services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix; # Goodix driver module | services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix; # Goodix driver module | ||
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-elan # Elan(04f3:0c4b) driver | # services.fprintd.tod.driver = pkgs.libfprint-2-tod1-elan; # Elan(04f3:0c4b) driver | ||
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-vfs0090; # driver for 2016 ThinkPads | # services.fprintd.tod.driver = pkgs.libfprint-2-tod1-vfs0090; # (Marked as broken as of 2025/04/23!) driver for 2016 ThinkPads | ||
# services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix-550a # Goodix 550a driver (from Lenovo) | # services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo) | ||
# however for focaltech 2808:a658, use fprintd with overidden package (without tod) | |||
# services.fprintd.package = pkgs.fprintd.override { | |||
# libfprint = pkgs.libfprint-focaltech-2808-a658; | |||
# }; | |||
</syntaxhighlight> | </syntaxhighlight> | ||
== Enroll fingerprint == | == Enroll fingerprint == | ||
Fingerprint enrollment can be done via the [[Command Shell|CLI]] or the UI in the Desktop Environment if available. | |||
=== CLI === | |||
<syntaxhighlight lang="bash">$ fprintd-enroll</syntaxhighlight> | |||
=== Gnome === | |||
In [[GNOME|Gnome]], the the fingerprints can be configured through the Settings application. | |||
# Open Gnome Settings | |||
# Scroll down to ''System'' | |||
# Enter the ''Users'' menu | |||
# Enter ''Fingerprint Login'' and add fingerprints | |||
'''Note:''' If the ''Fingerprint Login'' item is not available, the <code>fprintd</code> driver might not be configured correctly. | |||
== Login == | |||
While <code>services.fprintd.enable = true;</code> enables fingerprint login for the majority of display manager via the corresponding [https://search.nixos.org/options?channel=unstable&show=security.pam.services.%3Cname%3E.fprintAuth&from=0&size=50&sort=relevance&type=packages&query=pam.services.%3Cname%3E. PAM module], it can sometimes disable the ability to login using a password. This is addressed in the GitHub issue [https://github.com/NixOS/nixpkgs/issues/171136 171136]. In that issue, a possible workaround is addressed using a custom PAM module for the gnome display manager:<syntaxhighlight lang="nixos"> | |||
security.pam.services.login.fprintAuth = false; | |||
security.pam.services.gdm-fingerprint = lib.mkIf (config.services.fprintd.enable) { | |||
text = '' | |||
auth required pam_shells.so | |||
auth requisite pam_nologin.so | |||
auth requisite pam_faillock.so preauth | |||
auth required ${pkgs.fprintd}/lib/security/pam_fprintd.so | |||
auth optional pam_permit.so | |||
auth required pam_env.so | |||
auth [success=ok default=1] ${pkgs.gdm}/lib/security/pam_gdm.so | |||
auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so | |||
account include login | |||
password required pam_deny.so | |||
session include login | |||
session optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start | |||
''; | |||
}; | |||
</syntaxhighlight> | |||
[[Category:Hardware]] | [[Category:Hardware]] | ||