I have installed fingerprint-GUI using:

sudo apt-add-repository ppa:fingerprint/fingerprint-gui
sudo apt-get update && sudo apt-get install libbsapi policykit-1-fingerprint-gui fingerprint-gui

But it also accepts fingerprint authentication at login (lightdm). I only want it with sudo, gksudo, and su, i.e, after I've logged in, it should then accept fingerprints.

I'm on Xubuntu 16.04 AMD64, up to date. And my machine is a ThinkPad T410

this is my /etc/pam.d/lightdm file's contents:

auth    requisite       pam_nologin.so
auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
@include common-auth
auth    optional        pam_gnome_keyring.so
auth    optional        pam_kwallet.so
auth    optional        pam_kwallet5.so
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
#session required        pam_loginuid.so
session required        pam_limits.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
session optional        pam_gnome_keyring.so auto_start
session optional        pam_kwallet.so auto_start
session optional        pam_kwallet5.so auto_start
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
@include common-password

And the common-auth:

# /etc/pam.d/common-auth - authentication settings common to all services
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    [success=2 default=ignore]  pam_fingerprint-gui.so try_first_identified debug
auth    [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_ecryptfs.so unwrap
# end of pam-auth-update config
  • 1
    Can you post the contents of your /etc/pam.d/lightdm file? I found an answer that is asking something similar, but the inverse. It's basically asking for a way to enable fingerprint for everything but the login on lightdm. Here's the answer link. The same concept could be used in this case.
    – TheOdd
    Commented Oct 19, 2017 at 21:13
  • @OwenHines I've added the contents to the answer.
    – Nafees
    Commented Oct 20, 2017 at 9:24
  • Could you also post /etc/pam.d/common-auth? Sorry I didn't mention it in the first comment.
    – TheOdd
    Commented Oct 20, 2017 at 14:52
  • @OwenHines added common-auth's contents too.
    – Nafees
    Commented Oct 22, 2017 at 8:25
  • @TheOdd Could you please persist what next? Commented Apr 2, 2020 at 5:31

1 Answer 1


Easiest way to disable it via GUI. Search Users and mark Fingerprint login as "disabled".


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .