Lock Screen authentication

Configure this in Settings → Lock Screen → Lock Screen Authentication. Changes apply automatically and may open a terminal when sudo authentication is required.

Choose the policy owner

Mode	Primary PAM source	Factor policy
DMS-managed (default)	A password-only DMS service, or your custom service	DMS fingerprint/security-key toggles and OR/AND mode
Use system PAM authentication	/etc/pam.d/login, or your custom service	The selected PAM stack

Use system-PAM mode when authselect, pam-auth-update, NixOS, LDAP, Kerberos, systemd-homed, or another administrator-owned stack already defines the factors. DMS suppresses its separate factor prompts in this mode.

Intended interaction

With DMS-managed authentication, Auto means safe source selection: DMS uses a sanitized password-only primary service and an installed or bundled key-only security-key service. An enabled and ready fingerprint factor starts automatically, so the user only touches the reader. In OR mode, the user starts a one-shot security-key check with the passkey button and then touches the key. In AND mode, DMS starts the dedicated security-key check after a successful password or fingerprint check.

Selecting Custom… substitutes a validated primary or key-only service without changing that interaction model; DMS suppresses a separate factor only when the custom primary service already provides it. Use system PAM authentication instead delegates the complete factor policy, ordering, and interaction to the selected system stack, so the DMS factor toggles and OR/AND mode do not apply.

Primary PAM source

Auto uses a sanitized password-only DMS service. When no installed dankshell service exists, DMS generates one in its user state directory, including on NixOS. It does not modify a declaratively managed system PAM file.

Select a detected service or Custom… for a specific absolute path. DMS validates the included stack before applying it and suppresses a separate factor prompt when a custom primary stack already contains pam_fprintd or pam_u2f.

dms auth list-services --json
dms auth validate --service system-auth
dms auth validate --path /etc/pam.d/system-auth

Fingerprint unlock

Install and configure fprintd, enroll a finger, and enable Enable fingerprint authentication.

Security-key unlock

Install pam_u2f, register the key, and enable Enable security key authentication.

• OR - Password or security key: either factor can unlock. Start the key check on demand with the passkey button on the lock screen.
• AND - Password then security key: a successful primary check is followed by a required key check.

Security Key PAM Source

Auto uses /etc/pam.d/dankshell-u2f when available, otherwise the bundled DMS key-only service. Custom… accepts another dedicated absolute path.

The service must be key-only. DMS rejects a mixed password/login stack because OR/AND policy belongs to DMS:

#%PAM-1.0
auth required pam_u2f.so cue authfile=/etc/u2f-mappings
account required pam_permit.so

dms auth validate --purpose u2f --path /etc/pam.d/dankshell-u2f

On NixOS, define this dedicated U2F-only service declaratively and select its generated path. Do not use the general login service as the Security Key PAM Source.

Greeter login is separate; see DankGreeter authentication.