roam/azoshardware-auth.org

azos/hardware-auth

• Architecture
• Gotchas
• Key Files

Architecture

• lauretta (ThinkPad T480) uses YubiKey U2F/FIDO2 (pam_u2f) as a "sufficient" PAM factor ahead of password, for both sudo and login (which greetd=/=tuigreet substacks) — see features/hardware-auth/default.nix, commit 1d66194.
• Default NixOS PAM rule ordering already tries u2f before pam_unix, both "sufficient" — no extra ordering config needed.
• Per-user enrollment (not machine state): pamu2fcfg > ~/.config/Yubico/u2f_keys; must be redone on each new machine.

Gotchas

• lauretta's built-in fingerprint reader is a Synaptics Metallica MIS, USB ID 06cb:009a — a match-on-chip sensor NOT supported by upstream libfprint (confirmed via openSUSE forum + a Launchpad bug for this exact device ID). fprintd-enroll fails with "GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice".
• nixos-hardware's lenovo/thinkpad/default.nix (imported by the t480 profile) only has a generic commented-out services.fprintd.enable = true; — no model-specific workaround, and no other ThinkPad profile there handles this sensor either.
• Raised upstream in nixos-hardware issue #521 ("[ThinkPad x270] Fingerprint reader does not work"). Commenter ahbnr (also has a T480) built custom packages for python-validity + open-fprintd + fprintd-clients, working via a manual security.pam.services.sudo.text override.
• That became a maintained flake: https://github.com/ahbnr/nixos-06cb-009a-fingerprint-sensor (55 stars, targets 06cb:009a specifically, tested on T480).
• BLOCKER: that flake's README says "With NixOS Unstable: Not supported" — only NixOS 24.11/23.11 stable. Our azos flake pins nixpkgs-unstable (flake.nix:7). Its issue tracker has an open "Update to 25.05" request (unresolved) and a closed issue about unstable builds failing with a patch error, confirming the incompatibility.
• Decision (2026-10-09): keep fingerprint disabled/unimplemented, documented only as a code comment in features/hardware-auth/default.nix. Revisit if (a) the ahbnr flake gets ported to nixpkgs-unstable/a newer stable release, or (b) it's worth pinning a second stable nixpkgs input just for this one package set.

Key Files

• features/hardware-auth/default.nix — azos.hardware-auth.enable, wires up security.pam.u2f, option description documents the pamu2fcfg enrollment steps