Fingerprint login: PAM decides who gets asked

fprintd owns the reader and answers authentication requests; the attempt count before password fallback is a parameter on the PAM module line that calls it.

Is the reader or the PAM stack the problem

fprintd-list "$USER"
fprintd-verify
systemctl status fprintd
lsusb

fprintd-verify success means the reader and stored prints are fine; the failure is the desktop’s PAM configuration. Fedora generates PAM files from profiles:

authselect current
authselect check
grep -R "pam_fprintd" /etc/pam.d/ /etc/authselect/ 2>/dev/null

That grep lists every service accepting a fingerprint, and by omission those that do not.

Raising the attempt limit

⚠️ Back up first. A malformed auth line locks you out of the session you edit from; recovery needs a TTY or rescue boot.

sudo cp /etc/pam.d/system-local-login /etc/pam.d/system-local-login.bak
sudo cp /etc/pam.d/sudo /etc/pam.d/sudo.bak

Change the module line — both max_tries= and max-tries= appear in documentation and the module accepts that name:

auth    sufficient   pam_fprintd.so max_tries=3 timeout=10

sufficient ends authentication on success; failure falls through to the next method. The file depends on the failing prompt:

/usr/lib/pam.d/polkit-1 is polkit’s stack: the prompt when an unprivileged process asks something privileged — mounting a drive, changing network settings. It includes system-auth by default, so a max_tries there covers all polkit prompts; to limit it to polkit, bypass the include:

auth    sufficient    pam_fprintd.so max_tries=3 timeout=10
auth    include       system-auth

Recovery

Failure mode: a session that will not unlock because the PAM stack accepts nothing.

1. Press your password first — fingerprint is usually additional, not a replacement.
2. Esc sometimes switches the GDM auth UI.
3. Ctrl+Alt+F3 (or F2, F4, F5) reaches a text login on a TTY; the graphical session keeps running.

loginctl unlock-session
loginctl list-sessions
sudo cp /etc/pam.d/system-local-login.bak /etc/pam.d/system-local-login

On a TTY, Ctrl+C aborts the fingerprint prompt and falls back to the password; graphical greeters do not.

Keep max_tries low: each attempt is another chance for a replicated or forged print — the Arch Wiki’s warning about fingerprint for su and sudo. Fingerprint as sufficient for sudo without a TTY check is a privilege-escalation path; the documented guard is a pam_succeed_if rule matching service in sudo:su:su-l tty in :unknown before the fingerprint line — the pattern in Arch setup notes.

References

• Arch Wiki: fprint
• fprintd
• pam_fprintd(8)