Fingerprint Login, sudo and PAM on Linux with a Wireless Key

Q: Does it work with GNOME and KDE?

Yes, both. sudo and polkit go through PAM regardless of desktop. For the login screen, the GDM hook is installed by the package where GDM is present, and SDDM users add it with one command: sudo immurok-pam-helper add sddm .

Q: Is it a fprintd or libfprint device?

No. immurok does not register with fprintd and needs no kernel driver. It has its own PAM module and daemon, which is why it works on machines whose built-in sensor has no Linux support, and on desktops that have no sensor at all.

Q: What if the key is out of range or the battery is flat?

Your password still works. The PAM module is added in front of the normal password module, not instead of it. If the key does not answer, the prompt falls through to the password as before.

Q: Can I use the same key on a Linux box and a Mac?

Yes. The key holds two independent pairings. Bind it to the Linux machine and to a Mac or Windows PC, enrol one finger as the switch finger, and a touch of that finger moves the key between them.

The state of fingerprints on Linux

fprintd has existed for years, but it needs a sensor the kernel already supports, and those mostly live inside laptops. On a desktop, or on a laptop whose sensor has no driver, Linux users have almost no usable fingerprint option. They type their password for the lock screen, for sudo, for every polkit dialog, dozens of times a day.

immurok does not need a kernel driver. It is a separate Bluetooth LE device, and its Linux client is a user-space daemon plus a PAM module. Anything that authenticates through PAM can ask the key for a touch.

What immurok does on Linux

sudo. pam_immurok.so at the front of /etc/pam.d/sudo. The touch is the credential; nothing is typed and no password is stored.
polkit prompts. The same module in /etc/pam.d/polkit-1 covers the admin dialogs GNOME and KDE raise for package installs, settings changes and mounts.
Login and lock screen. A hook for GDM (gdm-password) or SDDM lets a touch unlock the session.
Password managers. 1Password, Bitwarden and KeePassXC offer “unlock with system authentication” on Linux. That goes through polkit, so with the hook installed a touch unlocks the vault. No extra immurok setup.
SSH and Git signing. The daemon exposes an SSH agent backed by the ECDSA P-256 key on the device. Every signature needs a touch; the private key never leaves the hardware.
TOTP and API secrets. Keep two-factor seeds and API keys on the device and fetch them from the CLI after a touch.
AI coding agents. imk run --agent -- sudo ... pops a GTK4 dialog and waits for your finger before the command runs. The agent gate.

Distributions and desktops

Distribution	Package	Notes
Debian 12+ / Ubuntu 24.04+	.deb, amd64 and arm64	Ubuntu 22.04 builds from source
Fedora 43+	.rpm, x86_64 and aarch64
Arch / Manjaro / EndeavourOS	.pkg.tar.zst
Other distributions	Build from source	Rust toolchain; glibc only, no musl (Alpine, Void musl)

Requirements: kernel 5.10 or later, a Bluetooth 4.2+ adapter, systemd user services, PAM 1.4+, polkit 0.120+, and a GNOME, KDE or other GTK4-capable desktop. The client ships a GTK4 settings app, a terminal dashboard and a CLI, so a headless or minimal desktop still gets the full feature set.

Install in four commands

# Debian / Ubuntu
sudo apt install ./immurok_<version>-1_amd64.deb
# Fedora
sudo dnf install ./immurok-<version>-1.x86_64.rpm
# Arch
sudo pacman -U immurok-<version>-1-x86_64.pkg.tar.zst

immurok-cli pair                  # or open the immurok app
immurok-cli pam install sudo      # the package never edits /etc/pam.d on its own

The package starts the daemon and the session agent for every user. Pairing and enabling the PAM hooks are deliberately left to you, and the settings app has Install, Remove and Repair buttons for each hook. Packages are attached to every GitHub release.

Security, in Linux terms

The PAM module does not see a password because there is none. It opens a local socket to the daemon, the daemon asks the key for a touch, and the key answers with an HMAC-signed “match succeeded” that the daemon verifies against the pairing keys in /var/lib/immurok. The fingerprint template never leaves the key. The daemon, the PAM module and the polkit policy are open source under Apache 2.0, and the local channel between them is authenticated too, which we wrote about here.

Common questions

Does it work with GNOME and KDE?

Yes, both. sudo and polkit go through PAM regardless of desktop. For the login screen, the GDM hook is installed by the package where GDM is present, and SDDM users add it with one command: sudo immurok-pam-helper add sddm.

Is it a fprintd or libfprint device?

No. immurok does not register with fprintd and needs no kernel driver. It has its own PAM module and daemon, which is why it works on machines whose built-in sensor has no Linux support, and on desktops that have no sensor at all.

What if the key is out of range or the battery is flat?

Your password still works. The PAM module is added in front of the normal password module, not instead of it. If the key does not answer, the prompt falls through to the password as before.

Can I use the same key on a Linux box and a Mac?

Yes. The key holds two independent pairings. Bind it to the Linux machine and to a Mac or Windows PC, enrol one finger as the switch finger, and a touch of that finger moves the key between them.

Pre-order IK-1 · US$69

Ships December 2026. Apps and firmware updates are free.

Fingerprint authentication for Linux, done through PAM