For example: I have a yubikey and fingerprint, both as auth sufficient in /etc/pam.d/system-auth. Setting it up with authselect enable-feature with-fingerprint with-pam-u2f I get the following config file no matter what order I specify it with:
auth sufficient pam_fprintd.so
auth sufficient pam_u2f.so cue
But this does not make sense, because it will wait for the fingerprint even though the yubikey is plugged in. The actual order should be:
auth sufficient pam_u2f.so cue
auth sufficient pam_fprintd.so
So will it be plausible to make authselect control the order of the auth sufficient depending either on the order of enable-feature or a new function that can re-order them?
For example: I have a yubikey and fingerprint, both as
auth sufficientin/etc/pam.d/system-auth. Setting it up withauthselect enable-feature with-fingerprint with-pam-u2fI get the following config file no matter what order I specify it with:But this does not make sense, because it will wait for the fingerprint even though the yubikey is plugged in. The actual order should be:
So will it be plausible to make
authselectcontrol the order of theauth sufficientdepending either on the order ofenable-featureor a new function that can re-order them?