Despite the prevailing security and privacy concerns, facial authentication has gained popularity in today’s devices, including Linux notebooks. I currently own two Linux-oriented notebooks: the TUXEDO Pulse 15 Gen2 and InfinityBook Pro 16 Gen8, each equipped with IR cameras that support fast face unlock as an authentication method.
However, unlike Windows Hello™, which provides a straightforward facial authentication setup, most Linux distributions, including TUXEDO OS, lack built-in, user-friendly facial recognition options. So, is it feasible to enable facial authentication on Linux? And what choices are available to achieve this?
This article is sponsored by TUXEDOComputers, a German company that produces Linux hardware, notebooks, computers, and more. Always and forever, all ideas and opinions on this website are wholly mine, as my values are not for sale. To learn more, read our Code of Ethics.
Howdy, the Only Option!
Linux is well-known for its diverse software options, but when it comes to facial authentication, the situation is quite different—there’s only one option available: Howdy.
Howdy is an open-source facial authentication software that provides a Windows Hello™-style authentication experience. It is a command-line Python software with numerous customization options, including timeout settings and snapshots. Howdy utilizes Pluggable Authentication Modules (PAM) to make facial authentication available throughout your system.
How to Set Up Howdy on Your Linux Distribution
Howdy is compatible with most popular Linux distributions, including Ubuntu, Arch, and Fedora. This tutorial will guide you through the entire process of installing and configuring Howdy.
- Open a terminal window and use the following commands for installation based on your distribution:
- For Ubuntu:
sudo add-apt-repository ppa:boltgolt/howdy && sudo apt update && sudo apt install howdy- For Fedora:
sudo dnf copr enable principis/howdy && sudo dnf --refresh install howdy- For Arch:
yay -Sy howdyPlease note that the ‘howdy’ package is approximately 160MB in size, excluding Python libraries, which will be downloaded during installation.
- During the installation, you’ll be asked to choose a certainty level among ‘fast,’ ‘balance,’ and ‘secure.’ In most cases, ‘balance’ is the recommended choice.
- Configure Howdy to use the correct camera device:
- List the available devices using the ‘
v4l2-ctl‘ tool:
sudo apt install v4l-utils && v4l2-ctl --list-devices
- Identify the IR camera device by using the ‘
ffplay‘ tool, part of the FFmpeg package:
sudo apt install ffmpeg && ffplay /dev/video0Test each device until you identify the IR camera.
- Open the Howdy configuration file:
sudo howdy config- Add the IR camera path to the ‘device_path’ line in the file:
- Save the changes with Ctrl+O.
- Before exiting the config file, enhance Howdy’s security by changing the snapshot options from ‘true’ to ‘false’ as shown below:
- Add your face model by using the following command:
sudo howdy add
- Label your face model accordingly.
Make sure to look directly at the camera, as there won’t be a camera window to show you how your face model looks.
- Now, you can use your beautiful face to authenticate any actions requiring your password!
Unlike Windows Hello, Howdy stores all face models and data locally, ensuring the protection of your privacy.
- Additionally, you can list and remove face models:
- To list the face models:
sudo howdy list- To remove a face model, run:
sudo howdy remove IDReplace ‘ID’ with the specific ID of the face model you want to remove.
- Enjoy the convenience of authenticating actions with your beautiful face on Linux!
Bonus: How to Configure Howdy for Login and Lock Screen Only
While using your face to authenticate instead of typing the root password can be convenient, it’s important to note that this may not be the most recommended security practice. Thus, configuring facial authentication exclusively for login and lock screen purposes is a safer choice.
- Navigate to the ‘/etc/pam.d/’ folder using the cd command.
- List the PAM configuration files using the ls command.
- In the ‘sudo’ file, remove Howdy by commenting out the line that contains Howdy options. To do this, add a ‘#’ before the Howdy line.
- Add Howdy to the login greeter file, such as ‘sddm,’ ‘lightdm,’ or ‘gdm’:
auth sufficient pam_python.so /lib/security/howdy/pam.py
In theory, the above steps appear straightforward and should be compatible with most Linux distributions. However, in practice, dealing with PAM files can be perplexing.
In Ubuntu, for example, the ‘sudo’ file indirectly links to Howdy through a common-auth statement. Hence, to deactivate Howdy for sudo, you should comment out the Howdy-related line in the common-auth file.
Since Ubuntu uses GDM (GNOME Display Manager) as the login greeter, you should add the following line to the top of the ‘gdm-password’ file:
auth sufficient pam_python.so /lib/security/howdy/pam.pyThen, remove the default installed PAM configuration by running:
sudo rm /usr/share/pam-configs/howdy && pam-auth-update --package
These steps ensure that Howdy is configured only for login and lock screen authentication. Similarly, you can manually add Howdy to any PAM files in ‘/etc/pam.d/‘ for other specific use cases.
💬 What do you think about the current state of facial authentication on Linux? And would you consider using it on your Linux notebook?
Linux-Tech&More Comment Policy
Comments are welcomed and encouraged on this blog. Spam, abusive and off-topics comments will be deleted. Please read our Comments policy before commenting.
Join the Discussion!