One fingerprint for the whole lab: sudo on the server, your vault on the laptop

An agent on your server needs root for one command. Before, that meant opening a terminal and typing a long password, ten times a day. Now a notification appears on the laptop with the exact command, you touch the reader, done. The same finger unlocks your password manager. Nothing is weakened: the password still works, and is still the answer to any failure.

What you get. Root approvals in one touch, with the command shown before you agree, for you and for your agents. In service here every day, with a two-second fallback to the password when the laptop is away.

1. The principle: ask, show, sign, verify

1. On the server, sudo runs its PAM stack. A first line calls a small program, before the usual password line.
2. That program sends the laptop the command and a fresh random number (a nonce), over your private network only.
3. The laptop shows a notification with the command. Your finger on the reader authorizes it to sign the nonce with a dedicated key.
4. The server verifies the signature with the public key, the only one it holds. Valid: sudo continues. Anything else: the password line takes over.

The nonce is what makes it safe: an answer captured once is worthless the next time. And since the server only holds a public key, stealing the server gives no way to forge an approval.

2. The PAM line

# /etc/pam.d/sudo — first, before the include of the system stack
auth sufficient pam_exec.so quiet /usr/local/lib/remote-approve/approve
auth include system-auth

sufficient means: if the program says yes, done; if it says no or fails, PAM moves on to the next line, the password. Never use required here: a laptop asleep would lock you out of root.

3. The laptop side

• A small user service, started with the session, that listens only on the private network interface and only accepts the server's address; the firewall says the same.
• Its own signing key (ed25519), created for this purpose, never copied anywhere.
• The reader through fprintd: the service asks for a finger, and signs only if it matches.

Measured fallbacks: laptop away, the password prompt appears in 2 seconds; no finger, after about 20 seconds.

4. The same finger for the password manager

The desktop Bitwarden app can unlock with "system authentication", which goes through polkit. Three pieces were needed on a Hyprland laptop:

• the polkit policy file for Bitwarden, which our distribution's package did not ship;
• a polkit agent running in the session (hyprpolkitagent), enabled as a user service;
• the native messaging manifest in the browser's folder, so the browser extension can talk to the app.

The extension's biometric unlock only works while the desktop app is open. Our first try failed for that reason alone.

Traps

Test the program on its own before putting it in PAM, and keep a root shell open while you change /etc/pam.d. A typo there can lock you out.

A package update can drop a sudo.pacnew (or .rpmnew, .dpkg-dist) next to your file. Carry your line over, or it disappears at the next merge.

Do not let an agent change your PAM stack or your firewall. Run that step yourself.

Found this useful? Tell us what to measure next.