DankGreeter authentication

DankGreeter authenticates logins through greetd's PAM service. dms-greeter can manage the fingerprint and security-key entries in /etc/pam.d/greetd, or you can make your distribution or system configuration the policy owner.

Configure this in Settings → Greeter → Authentication in DMS, then apply with the Sync button (or dms-greeter sync).

Choose who manages greetd PAM

Leave Use system PAM authentication off for the normal managed setup. The fingerprint and security-key toggles update the greetd PAM configuration on the next greeter sync.

Turn it on when greetd PAM is managed by authselect, pam-auth-update, NixOS, or your own PAM files. The next greeter sync then removes the managed block and stops writing /etc/pam.d/greetd; the factor toggles are disabled because the system PAM configuration decides what the greeter offers.

caution

Keep a root terminal or another login method available while changing PAM. An invalid greetd stack can prevent graphical login.

Login interaction

DankGreeter always follows /etc/pam.d/greetd; the lock screen's Auto and Custom sources and its OR/AND modes do not apply at login. With DMS-managed greetd PAM, selecting a user automatically starts any enabled and available fingerprint or security-key factor, and the factor button can start it again.

With Use system PAM authentication, the system stack owns the factor ordering, prompts, and required interaction. Press Enter on an empty password field only if that stack waits for an explicit login attempt.

Fingerprint login

1. Install your distribution's fprintd service and PAM integration.
2. Enroll at least one finger with fprintd-enroll.
3. Confirm it with fprintd-list "$USER".
4. Enable Fingerprint at login in the Greeter Authentication card and run Sync.

For example, Fedora uses:

sudo dnf install fprintd fprintd-pam
fprintd-enroll

If enrollment reports No devices available, check the libfprint supported devices list. Some Validity/Synaptics readers instead need open-fprintd and python-validity. Do not run the stock and alternate fprintd implementations together.

Security-key login

Install pam_u2f, register the key in the mapping used by your distribution, and test that mapping before enabling Security key at login. Enabling the toggle does not install pam_u2f or register a key.

The lock screen's OR and AND modes do not change greeter policy. The greeter follows the ordering and control flags in its own greetd PAM stack.

Repair and troubleshooting

Normal setting changes apply on the next greeter sync. Use the following only to manually repair or reapply the managed configuration:

dms-greeter sync --auth

The command may prompt for sudo and rewrites only the managed PAM block. Lock screen PAM is separate and repaired with dms auth sync.

See DankGreeter configuration for the rest of the greeter setup, and Lock Screen authentication for the separate in-session lock policy.