DankGreeter authentication

DankGreeter authenticates logins through greetd's PAM service. Configure it in Settings → Greeter → Authentication.

Choose who manages greetd PAM

Leave Use system PAM authentication off for the normal DMS-managed setup. The fingerprint and security-key toggles update the shared /etc/pam.d/greetd configuration automatically.

Turn it on when greetd PAM is managed by authselect, pam-auth-update, NixOS, or your own PAM files. DMS then removes its managed block and stops writing the file. Its factor toggles are disabled because the system PAM configuration is now the policy owner.

caution

Keep a root terminal or another login method available while changing PAM. An invalid greetd stack can prevent graphical login.

Login interaction

DankGreeter always follows /etc/pam.d/greetd; the lock screen's Auto and Custom sources and its OR/AND modes do not apply at login. With DMS-managed greetd PAM, selecting a user automatically starts any enabled and available fingerprint or security-key factor, and the factor button can start it again.

With Use system PAM authentication, the system stack owns the factor ordering, prompts, and required interaction. Press Enter on an empty password field only if that stack waits for an explicit login attempt.

Fingerprint login

Install your distribution's fprintd service and PAM integration, enroll a finger with fprintd-enroll, and verify it with fprintd-list "$USER". Then enable Fingerprint at login.

For example, Fedora uses:

sudo dnf install fprintd fprintd-pam
fprintd-enroll

If enrollment reports No devices available, check the libfprint supported devices list. Some Validity/Synaptics readers instead need open-fprintd and python-validity. Do not run both daemon implementations at once.

Security-key login

Install pam_u2f, register the key in the mapping used by your distribution, and test that mapping before enabling Security key at login. The lock screen's OR and AND modes do not affect the greetd PAM policy.

Repair and troubleshooting

Normal setting changes apply automatically. Use this command to repair or reapply DMS-managed PAM configuration:

dms auth sync

See DankGreeter configuration and Lock Screen authentication.