4

In Trusty, there is a new lockscreen that fits the look and feel of lightdm, and shares some config files, especially for pam.

I am using libpam-fprintd to allow using my fingerprint reader when asked for a sudo password, or for unlocking the screen.

The point is that I don't want to allow the fingerprint reader when logging into the desktop. But I want to allow it when unlocking the screen. The reason for that is that fingerprint won't allow to open the gnome-keyring, which is fine when unlocking, but not when loging-in. This also enables me to have a strong password, as I type it only once, then use the fingerprint reader.

See the PPA page instructions, especially the "Note on keyrings and passwordless logins" part

Before the new lock-screen, /etc/pam.d/lightdm was used by the greeter, not by the (old) lock-screen. So I had a different behaviour when logging in and when unlocking, which was exactly what I wanted.

See this page from the Thinkwiki for the config used.

Now, it seems that /etc/pam.d/lightdm is used by both the greeter and the lock-screen.

So my need would be to have a distinct pam config file for the greeter and for the lock screen. Is this possible?

0

1 Answer 1

1

Currently this is not possible. From the Unity code (lockscreen/UserAuthenticatorPam.cpp):

// FIXME (andy) We should install our own unityshell pam file.
  return pam_start("lightdm", username_.c_str(),
                   &conversation, &pam_handle_) == PAM_SUCCESS;

You should file a feature request for this.

3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .