4

In Trusty, there is a new lockscreen that fits the look and feel of lightdm, and shares some config files, especially for pam.

I am using libpam-fprintd to allow using my fingerprint reader when asked for a sudo password, or for unlocking the screen.

The point is that I don't want to allow the fingerprint reader when logging into the desktop. But I want to allow it when unlocking the screen. The reason for that is that fingerprint won't allow to open the gnome-keyring, which is fine when unlocking, but not when loging-in. This also enables me to have a strong password, as I type it only once, then use the fingerprint reader.

See the PPA page instructions, especially the "Note on keyrings and passwordless logins" part

Before the new lock-screen, /etc/pam.d/lightdm was used by the greeter, not by the (old) lock-screen. So I had a different behaviour when logging in and when unlocking, which was exactly what I wanted.

See this page from the Thinkwiki for the config used.

Now, it seems that /etc/pam.d/lightdm is used by both the greeter and the lock-screen.

So my need would be to have a distinct pam config file for the greeter and for the lock screen. Is this possible?

1

Currently this is not possible. From the Unity code (lockscreen/UserAuthenticatorPam.cpp):

// FIXME (andy) We should install our own unityshell pam file.
  return pam_start("lightdm", username_.c_str(),
                   &conversation, &pam_handle_) == PAM_SUCCESS;

You should file a feature request for this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.