Lock Screen authentication
Configure lock-screen authentication in Settings → Lock Screen → Lock Screen Authentication. Changes apply automatically and may open a terminal when sudo authentication is required.
Choose the policy owner
| Mode | Primary PAM source | Fingerprint and security-key policy |
|---|---|---|
| DMS-managed (default) | A password-only DMS service, or your selected custom service | Controlled by the DMS toggles and OR/AND mode |
| Use system PAM authentication | /etc/pam.d/login, or your selected custom service | Controlled entirely by that PAM stack |
Use system-PAM mode when authselect, pam-auth-update, NixOS, LDAP,
Kerberos, systemd-homed, or another administrator-owned stack already
defines the factors and their ordering. DMS suppresses its separate
fingerprint and security-key prompts in this mode so it does not prompt twice.
Intended interaction
With DMS-managed authentication, Auto means safe source selection: DMS uses a sanitized password-only primary service and an installed or bundled key-only security-key service. An enabled and ready fingerprint factor starts automatically, so the user only touches the reader. In OR mode, the user starts a one-shot security-key check with the passkey button and then touches the key. In AND mode, DMS starts the dedicated security-key check after a successful password or fingerprint check.
Selecting Custom… substitutes a validated primary or key-only service without changing that interaction model; DMS suppresses a separate factor only when the custom primary service already provides it. Use system PAM authentication instead delegates the complete factor policy, ordering, and interaction to the selected system stack, so the DMS factor toggles and OR/AND mode do not apply.
Primary PAM source
Auto uses a sanitized password-only DMS service. When no installed
dankshell service exists, DMS generates one in its user state directory.
This applies on NixOS too and does not modify a declaratively managed system
PAM file.
Select a detected service or Custom… when the primary authentication stack
must come from a specific absolute path. DMS validates the complete included
stack before applying it. If a custom primary stack already contains
pam_fprintd or pam_u2f, DMS suppresses the matching separate prompt.
Inspect or validate primary services with:
dms auth list-services --json
dms auth validate --service system-auth
dms auth validate --path /etc/pam.d/system-auth
Fingerprint unlock
Install and configure fprintd, enroll a finger, then enable Enable
fingerprint authentication. Availability may remain unconfirmed until the
reader and its PAM module are visible, but DMS does not perform enrollment.
Security-key unlock
Install pam_u2f, register your key, and enable Enable security key
authentication.
The mode determines how DMS combines the key with the primary factor:
- OR - Password or security key: either factor can unlock. Security-key authentication starts on demand from the passkey button on the lock screen.
- AND - Password then security key: successful primary authentication is followed by a required security-key check.
Security Key PAM Source
Auto uses /etc/pam.d/dankshell-u2f when it exists, otherwise the bundled
DMS key-only service. Choose Custom… to use a dedicated service at another
absolute path.
A custom security-key service must be key-only. DMS rejects a mixed login or password stack here because OR/AND policy belongs to DMS in this mode. A minimal service can look like:
#%PAM-1.0
auth required pam_u2f.so cue authfile=/etc/u2f-mappings
account required pam_permit.so
Validate it before selecting it:
dms auth validate --purpose u2f --path /etc/pam.d/dankshell-u2f
On NixOS, define the dedicated U2F-only PAM service declaratively, then select
its generated path. Do not select the general login service as the Security
Key PAM Source.
Troubleshooting
Keep a terminal available while testing PAM changes. If a factor appears disabled, check its status text in the Authentication card, validate the selected service, and confirm the module and enrollment/key mapping outside DMS first.
Greeter login is configured separately; see Dux Greeter authentication.