Is it possible to authenticate user without asking him to provide username/password and using only "second factor", i.e USB drive or fingerprint device? The idea is that I just want to insert the device to PC and to authenticate to this Linux machine without touching the keyboard. The decision about the user who needs to be authenticated will be made according to the attached device.

How can I achieve this(if it is possible) in Linux using PAM? Is it possible to create such a PAM module which will accomplish this?

Thank you very much!


It can be done by pamusb-conf command.

Please refer tutorial here -



  • Thank you for your reply, @sanjayparmar. I know that this can be done with pam_usb, however, there is an issue here. manpages.ubuntu.com/manpages/trusty/man1/pamusb-agent.1.html It is mentioned here that I must firstly authenticate using pam_usb, and only after that I can use the pam_usb agent. But can I accomplish this without the need for "first" authentication, straight after system start? Is it possible to create a module in such a way that it will wait for USB device attachment? In the case of pam_usb, this agent is a python script, but I don't want to use any external scripts. – MrMan Jan 16 at 13:06
  • have you tried above links with pam_usb ? – sanjayparmar Jan 22 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.