[GUIDE/SOLVED] Sudo and Login with Fingerprint Reader under KDE/Arch Linux

Framework Laptop 13 Linux
21

Thanks for the starter code. I was able to get fingerprint reader working on Arch/Plasma 6/SDDM using the following guides:

In summary:

# Install necessary packages
pacman -S fprintd
pacman -S pam-fprint-grosshack

# Enroll fingerprint(s)
fprintd-enroll

# Verify
fprintd-verify

Using device /net/reactivated/Fprint/Device/0
Listing enrolled fingers:
 - #0: right-index-finger
 - #1: right-thumb
Verify started!
Verifying: right-index-finger
Verify result: verify-match (done)

Alternatively, use the Users GUI application, for your local user, to add fingerprint(s). Under Configure Fingerprint Authentication...

At this point, lock screen fingerprint should work for unlocking an existing session:

20250503_022146~2
20250503_022146~21920×995 149 KB

To get login fingerprint working, update /etc/pam.d/sddm :

# add to top:

auth        [success=1 new_authtok_reqd=1 default=ignore]  pam_unix.so try_first_pass likeauth nullok
auth        sufficient  pam_fprintd.so

Press ENTER at the empty password prompt and touch the fingerprint sensor. You should be able to log in. (There is no GUI feedback)
You can also login via password normally.

To get sudo/su fingerprint working, update /etc/pam.d/sudo and /etc/pam.d/su:

# add to top:

# Disallow fingerprint in sudo/su without tty
auth       [success=1 default=ignore]  pam_succeed_if.so    service in sudo:su:su-l tty in :unknown
auth       sufficient      pam_fprintd.so

Example:

# Fingerprint
02:05 AM:~ $ sudo date
Place your finger on the fingerprint reader
Sat May  3 02:05:27 AM PDT 2025

# Password (ctrl+c)
02:05 AM:~ $ sudo date
Place your finger on the fingerprint reader
^C[sudo] password for kish: 
Sat May  3 02:05:44 AM PDT 2025

To get polkit agent fingerprint working:

First:
sudo cp /usr/lib/pam.d/polkit-1 /etc/pam.d/polkit-1

Then edit the new file:

auth        sufficient      pam_fprintd_grosshack.so
auth        sufficient      pam_unix.so try_first_pass nullok
# Optional, will show UI message below when pressing ENTER on empty passwd
auth        sufficient  pam_fprintd.so

Example:

Screenshot_20250503_024150
Screenshot_20250503_0241502494×934 106 KB

4 Likes
22

Happy to report, yes, it works exactly as described! I had set up fingerprint authentication on my laptop already before but couldn’t do auth on the cli. Great, it’s working now!
EndeavorOS (arch), kernel Linux 6.15.9, KDE Plasma 6.4.4

23

This worked for me by default, on:

PRETTY_NAME="Fedora Linux 42 (KDE Plasma Desktop Edition)"

…per:

RokeJulianLockhart@Beedell:~$ sudo echo
Place your right index finger on the fingerprint reader

RokeJulianLockhart@Beedell:~$
24

I have an update on this ongoing issue. I’m new to Arch and the fingerprint has been more difficult than on Fedora or Mint. Things were helped by a new modification of fprintd. I followed Kish’s excellent instructions but was having problems with the GUI “Authentication Required” window. It usually wouldn’t work and sometimes scanning the print would cause the command to abort.

I found a new package in AUR that seems to do the same thing as pam_fprint_grosshack called PAM-Parallel-Fprint .

For the last step in Kish’s post, I replaced “pam_fprintd_grosshack.so” with “pam_parallel_fprint.so”

Sometimes I still have to hit enter before being able to use the fingerprint.

Part of the issue seems to be how pkexec (the Authentication Required window) is called by the app using it. There might be the error below:

error: XDG_RUNTIME_DIR is invalid or not set in the environment.
Failed to create wl_display (No such file or directory)
qt.qpa.plugin: Could not load the Qt platform plugin "wayland" in "" even though it was found.
```

According to the Arch Wiki, the correct way for an app called “program” to do this is by running

pkexec env WAYLAND_DISPLAY="$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" XDG_RUNTIME_DIR=/run/user/0 program

It seems for me, in cases where the program needing root privileges doesn’t set the variables exactly the way Arch/Wayland/KDE wants it, the new pam_parallel_fprint works better than pam_fprintd_grosshack.