Fingerprint reader support

[Noah-Raketic]

If your fingerprint reader works with fprintd, this is actually possible right now in Qubes OS 4.3.
This comment helped me get it set up:

How can i use fingerprint login?

xscreensaver-auth runs under the uid and gid of the user (not root) in Qubes 4.2. Therefore, the qvm-run command will fail immediately, because it cannot connect to the qubesd socket. /usr/local/bin/fprint-auth needs to be adjusted like that: #!/bin/sh exec /usr/bin/sg qubes -c '/usr/bin/qvm-run -q --no-gui -u root sys-usb /usr/bin/fprintd-verify'

Essentially, you have to have a Qube (could be sys-usb, but it’s more secure to use a dedicated Qube) with your reader connected, enroll a fingerprint in fprintd, and use a script to check your fingerprint within that Qube, either required in PAM for fingerprint 2FA or sufficient to have optional fingerprint login.

Though if you go the 2FA route, be aware that if your fingerprint Qube ever stops working, you’ll be locked out. I’ve had a couple times where I had to login as root in a TTY to manually restart my fingerprint Qube.