Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sorry for the long question.

I have a laptop with ubuntu quantal 12.10, a fingerprint scanner, and a few active user accounts. When the machine boots up to lightdm, I get a prompt toenter my password or scan my finger print. Every now and then, fingerprint scanning just doesn't seem to work. Before the 12.10 upgrade, I was always able to enter my password for this user when fingerprint failed. Now, no matter what, I have to scan my prints to login as this user. If I try to login as a different user (fingerprint is not enabled for any others), I can see the password is typed out -- asterisks show in the password input box as I type them -- and get in. Not so for the fingerprint user. Any clues on how to figure out what's gone wrong?

share|improve this question
up vote 2 down vote accepted

The bug you've described seems to have been solved in LightDM shipped with Ubuntu 13.04.

In Ubuntu 12.10 I had the same problem but for a different reason. I had an encrypted home dir and fingerprint-gui doesn't store passwords to accounts but instead provides a pam module and only checks for a matching fingerprint to allow users to log in. However, to decrypt a home dir one must enter a password, otherwise encryption simply wouldn't make sense. Thus, as long as ecryptfs doesn't provide a way to use fingerprints instead of passwords, this system won't work.

Combined with the bug you've described this leads for me to the situation where I have to always first scan my fingerprint for it to fail and only then I'm able to enter a password in LightDM.

As a workaround, I've disabled fingerprint authentication for LightDM altogether, after all one has to pass this login quite seldom.

This works as follows:

  1. Make a copy of the file /etc/pam.d/common-auth, name it whatever you want. For simplicity, I will assume that you named it common-auth-pass-only:

    sudo cp /etc/pam.d/common-auth /etc/pam.d/common-auth-pass-only
  2. Edit the newly created file for example with the command sudo nano /etc/pam.d/common-auth-pass-only, you will have to remove the line:

    auth    [success=2 default=ignore] try_first_identified debug

    The exact contents of this line may differ slightly, but the part with will be there.

  3. Edit the lightdm pam config file for example with the command sudo nano /etc/pam.d/lightdm. Replace the file name common-auth in the line

    @include common-auth

    with the name of the newly created file, the line should then look like this:

    @include common-auth-pass-only

Remember, this is only a temporary workaround, the command pam-auth-update won't manage your config for LightDM any more after these changes were applied.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.