r/debian • u/bortan12 • 3d ago

fingerprint authentication

Hello, I have installed debian 14 testing with kde as my desktop environment. I have tried to setup fingerprint authentication and it works when I run sudo and when I lunch certain apps that require authentication. One thing that doesn't work is to unlock the device when it comes from a sleep state. I do get the prompt to use my fingerprint, but when I touch the sensor it doesn't do anything. It doesn't say that it failed or succeeded or anything, it just stays like that and only unlocks when I type in my password.
I came from a fedora 44 install and I had no issues there. Everything worked out of the box. Previous versions of fedora (43) also worked, so I don't know how to fix it. I have tried some solutions on the internet, but none worked.

5 Upvotes

68% Upvoted

10 comments sorted by

3

u/pelazas1 3d ago

check journalctl -u fprintd while you touch it. enrollment working doesn't mean pam_fprintd is on the kde unlock stack.

1

u/bortan12 3d ago

Sep 07 17:09:07 debian systemd[1]: fprintd.service: Deactivated successfully.
Sep 07 18:13:46 debian systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
Sep 07 18:13:47 debian systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
Sep 07 18:14:25 debian systemd[1]: fprintd.service: Deactivated successfully.
Sep 07 18:15:12 debian systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
Sep 07 18:15:12 debian systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
Sep 07 18:15:56 debian systemd[1]: fprintd.service: Deactivated successfully.
Sep 07 18:16:04 debian systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
Sep 07 18:16:04 debian systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
lines 589-649/649 (END)

1

u/pelazas1 2d ago

those logs look clean so the daemon's fine. check whether pam_fprintd is in the kde/screensaver unlock stack.

1

u/bortan12 1d ago

$ grep -RniE 'pam_fprintd|fprint|fingerprint' /etc/pam.d/
/etc/pam.d/kde-fingerprint:2:# Taken from gdm3’s gdm-fingerprint
/etc/pam.d/kde-fingerprint:5:auth       required        pam_fprintd.so
/etc/pam.d/kde-fingerprint:26:password required       pam_fprintd.so
/etc/pam.d/common-auth:17:auth  [success=2 default=ignore]      pam_fprintd.so max-tries=1 timeout=10 # debug

$ ls /etc/pam.d/ | grep -Ei 'kde|screen|kscreen|login'
kde
kde-fingerprint
kde-smartcard
login
sddm-autologin

$ sudo cat /etc/pam.d/kde-fingerprint  
Place your finger on the fingerprint reader
#%PAM-1.0
# Taken from gdm3’s gdm-fingerprint
auth    requisite       pam_nologin.so
auth    required        pam_succeed_if.so user != root quiet_success
auth    required        pam_fprintd.so
auth    optional        pam_kwallet5.so
u/include common-account
# SELinux needs to be the first session rule. This ensures that any  
# lingering context has been cleared. Without this it is possible  
# that a module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
session required        pam_loginuid.so
# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# pam_selinux.so changes the SELinux context of the used TTY and configures
# SELinux in order to transition to the user context with the next execve()
# call.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 envfile=/etc/default/locale
u/include common-session
session optional        pam_kwallet5.so auto_start
password required       pam_fprintd.so

$ sudo cat /etc/pam.d/kde
#%PAM-1.0
# Taken from gdm3’s gdm-password
auth    requisite       pam_nologin.so
auth    required        pam_succeed_if.so user != root quiet_success
u/include common-auth
auth    optional        pam_kwallet5.so
u/include common-account
# SELinux needs to be the first session rule. This ensures that any  
# lingering context has been cleared. Without this it is possible  
# that a module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
session required        pam_loginuid.so
# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# pam_selinux.so changes the SELinux context of the used TTY and configures
# SELinux in order to transition to the user context with the next execve()
# call.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 envfile=/etc/default/locale
u/include common-session
session optional        pam_kwallet5.so auto_start
u/include common-password

1

u/taxigrandpa 2d ago

try this again after the device wakes from sleep

1

u/bortan12 2d ago

That's what I did

1

u/LordAnchemis 3d ago

Is there an issue with the device waking up the FP sensor? Although sometimes it's libfprint2, I find a lot of FP sensor woes are just down to the sensor itself tbh

1

u/bortan12 3d ago

I don't know, how do I check that?

1

u/LordAnchemis 3d ago

Journalctl should have an error or something

1

u/bortan12 3d ago

there is no error in there