drawuth

PAM auth, but by drawing on the touchpad.

⚠️ WARNING: Using this may be less secure than a password. It may be more likely to be bypassed than a strong password. Use at your own risk!

Prerequisites

• A Linux system with PAM support
• A touchpad exposed as an evdev input device (e.g. /dev/input/eventX)
• Read access to the relevant /dev/input/ device (you may need to be in the input group)

Building

make
sudo make install

This will build pam_drawuth.so and drawuthctl and install them to /lib/security/ and /usr/local/bin/ respectively.

Installing

Add the following line to the desired files in /etc/pam.d/ (e.g. sudo, login):

auth sufficient pam_drawuth.so

Place this line before any auth required pam_unix.so lines. This will first attempt authentication via gesture; if it fails, PAM will fall through to your password.

Example /etc/pam.d/sudo:

auth sufficient pam_drawuth.so
auth required pam_unix.so

Usage

i️ NOTE: If not specifying --file, you'll need to run the command as root (using sudo).

Registering a gesture

Before you can authenticate, you need to register your gesture:

drawuthctl --register

This collects 5 samples by default and estimates a suitable tolerance. You can collect more samples for a tighter fit:

drawuthctl --register --samples 8

Testing a gesture

To verify your gesture works:

drawuthctl --test

CLI Reference

--register and --test are mutually exclusive.

Exit codes