Skip to content

Control the order of auth sufficient in pam #335

Description

@LecrisUT

For example: I have a yubikey and fingerprint, both as auth sufficient in /etc/pam.d/system-auth. Setting it up with authselect enable-feature with-fingerprint with-pam-u2f I get the following config file no matter what order I specify it with:

auth        sufficient                                   pam_fprintd.so
auth        sufficient                                   pam_u2f.so cue

But this does not make sense, because it will wait for the fingerprint even though the yubikey is plugged in. The actual order should be:

auth        sufficient                                   pam_u2f.so cue
auth        sufficient                                   pam_fprintd.so

So will it be plausible to make authselect control the order of the auth sufficient depending either on the order of enable-feature or a new function that can re-order them?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions