Messed up PAM

Ask Fedora
1

Don’t try this at home…

So, I wanted to disable fingerprint identification on my Fedore 44 Plasma.

Without thinking, I followed the first answer from an AI, it somewhat messed up my installation.

Now I have to enter my password for almost everything I or my computer wants to do, like connecting to a network. I’m unable to change the brightness of my laptop.

history shows

987 sudo authselect select minimal with-faillock --force
988 sudo authselect select sssd --force
989 sudo authselect apply-changes
990 sudo dnf reinstall authselect authselect-libs pam
991 sudo authselect select sssd --force --prohibit-changes
992 sudo authselect select sssd --force
993 sudo authselect apply-changes --force
994 sudo dnf reinstall authselect authselect-libs pam
995 sudo authselect select sssd --force
996 sudo authselect apply-changes
997 sudo reboot
998 sudo dnf upgrade
999 dnf --version
1000 history

Is there anything that I can do besides putting on my skämsstrut and reinstall?

2

Try

sudo authselect select local --force
sudo authselect apply-changes
sudo reboot
3

To disable fingerprint you could just do

sudo authselect disable-feature with-fingerprint

That depends on what the AI made you do.

4

Maybe

sudo authselect disable-feature with-fingerprint
fprintd-delete $USER
5

Thanks, but nothing changed.

6

Post

authselect current
loginctl show-session $(loginctl | awk '/'$USER'/{print $1;exit}') -p Active -p Remote -p Type
rpm -V pam authselect authselect-libs
ls /etc/pam.d/*.rpmnew /etc/pam.d/*.rpmsave 2>/dev/null
7

Here we go

$ authselect current
Profile ID: local
Enabled features: None

$ loginctl show-session $(loginctl | awk '/'$USER'/{print $1;exit}') -p Active -p Remote -p Type
Remote=no
Type=wayland
Active=yes

$ rpm -V pam authselect authselect-libs
..?......  c /etc/security/opasswd
..?......    /usr/bin/unix_update

$ ls /etc/pam.d/.rpmnew /etc/pam.d/.rpmsave 2>/dev/null
$
8

That looks fine. post

authselect check
id
grep -r kwallet /etc/pam.d/
journalctl -b -g 'pam_\|kwallet\|polkit' -p warning
rpm -qf /etc/pam.d/* 2>&1 | grep 'not owned'
9 
pata@carbon:~$ authselect check
Current configuration is valid.
pata@carbon:~$ id
uid=1000(pata) gid=1000(pata) groups=1000(pata),10(wheel),977(wireshark),980(lxd) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
pata@carbon:~$ grep -r kwallet /etc/pam.d/
/etc/pam.d/sddm-autologin:-session    optional    pam_kwallet5.so auto_start
/etc/pam.d/sddm-autologin:-session    optional    pam_kwallet.so auto_start
/etc/pam.d/sddm:-auth        optional      pam_kwallet5.so
/etc/pam.d/sddm:-auth        optional      pam_kwallet.so
/etc/pam.d/sddm:-session     optional      pam_kwallet5.so auto_start
/etc/pam.d/sddm:-session     optional      pam_kwallet.so auto_start
pata@carbon:~$ journalctl -b -g 'pam_|kwallet|polkit' -p warning
-- No entries --
pata@carbon:~$ rpm -qf /etc/pam.d/* 2>&1 | grep 'not owned'
file /etc/pam.d/switchable-auth is not owned by any package
pata@carbon:~$
10

Can you post

stat -c '%n %y %s %U' /etc/pam.d/switchable-auth
cat /etc/pam.d/switchable-auth
grep -rn switchable-auth /etc/pam.d/ /etc/authselect/
11

bump.

12 
pata@carbon:~$ stat -c '%n %y %s %U' /etc/pam.d/switchable-auth
/etc/pam.d/switchable-auth 2026-09-15 19:28:58.537085856 +0200 31 root
pata@carbon:~$ cat /etc/pam.d/switchable-auth

Generated by authselect

Do not modify this file manually, use authselect instead. Any user changes will be overwritten.

You can stop authselect from managing your configuration by calling 'authselect opt-out'.

See authselect(8) for more details.

auth required pam_debug.so auth=authinfo_unavail
pata@carbon:~$ grep -rn switchable-auth /etc/pam.d/ /etc/authselect/
/etc/authselect/dconf-db:9:enable-switchable-authentication=false
/etc/authselect/dconf-locks:8:/org/gnome/login-screen/enable-switchable-authentication
pata@carbon:~$
14

That did not change anything as far as I could see.

This change some of the dialogs that asks for my password, smartmon required password now.



pata@carbon:~$ sudo rpm -V -a | sort -t / -k 2
.M.......    /boot/efi/System
.M.......    /boot/efi/System/Library
.M.......    /boot/efi/System/Library/CoreServices
.M.......    /boot/efi/System/Library/CoreServices/SystemVersion.plist
.M.......    /boot/efi/mach_kernel
.M.......  c /etc/audit/rules.d/audit.rules
S.5....T.  c /etc/chrony.conf
S.5....T.  c /etc/dnf/dnf.conf
S.5....T.  c /etc/sddm.conf
.M.......  c /etc/sysconfig/irqbalance
S.5....T.  c /etc/sysconfig/livesys
S.5....T.  c /etc/sysctl.conf
S.5....T.  c /etc/texlive/web2c/updmap.cfg
......G..    /run/sddm
.M.......  g /usr/share/texlive/texmf-dist/web2c/fmtutil.cnf
missing     /var/cache/dnf
.M.......  g /var/lib/boltd
.M.......    /var/lib/fwupd
.M.......    /var/lib/sddm
.M.......  g /var/lib/snapd/seccomp/bpf/global.bin
.M.......  g /var/lib/snapd/snap/README
.M.......  g /var/lib/snapd/state.json
.....UG..  g /var/run/pcscd



pata@carbon:~$ sudo -i << EOI | sort
grep -v -x -F -f <(rpm -q -a -l) 
<(find /etc/authselect* /etc/pam*)
EOI
[sudo] password for pata:
/etc/authselect/switchable-auth
/etc/pam.d/switchable-auth
15

Maybe try moving those files to some backup directory and rerun

sudo authselect select local --force
sudo authselect apply-changes
sudo reboot
16

I suspect your issue is related to Polkit, see also:
Polkit authentication not usable with password, only fingerprint

17

Tried that one now but still no brightness control.

Yes, I can relate that one too.

Thanks for mentioning polkit, that triggered my memory.

Not too long ago I asked ai about pkexec kept asking for my password for different operations within a program that I’m making.

Its solution was to create /etc/polkit-1/rules.d/40-sabas-timeout.rules

polkit.addRule(function(action, subject) {
if (subject.isInGroup("wheel")) {
return polkit.Result.AUTH_ADMIN_KEEP;
}
});

So I removed that file and rebooted and I think everything looks ok now. :slight_smile: (I have only tested it for a really short period of time)

I guess that file worked fine until I disabled fingerprint and the removal of it, in combination with zero or more of your suggestions above solved it.

Thank you all for your time and suggestions, I’m really happy I don’t have to reinstall so close to a new release.

Thank you :heart: