Fingerprint security for WSL sudo commands

  • SpinRite v6.1 Release #3
    Guest:
    The 3rd release of SpinRite v6.1 is published and may be obtained by all SpinRite v6.0 owners at the SpinRite v6.1 Pre-Release page. (SpinRite will shortly be officially updated to v6.1 so this page will be renamed.) The primary new feature, and the reason for this release, was the discovery of memory problems in some systems that were affecting SpinRite's operation. So SpinRite now incorporates a built-in test of the system's memory. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
    /Steve.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in please checkout the “Tips & Tricks” page for some very handy tips!

    /Steve.

  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)

Happenstrance

Happenstrance

Active member
Sep 30, 2020
27
8
I recently got a new laptop (MSI Creator Z16P) with W11 and a fingerprint scanner, and I installed Ubuntu LTS on WSL because in W11 WSL supports linux GUI and audio out of the box. Then I wondered how to secure the sudo command with something other than a password. I found that someone wrote a hybrid Linux app that invokes Windows Hello security whenever you type the sudo command: https://www.windowscentral.com/making-windows-subsystem-linux-wsl-even-better-windows-hello

So I enabled Windows Hello for the first time, then decided to set up the fingerprint scanner to be the default method. I remembered Steve mentioning to add a knuckleprint as backup in case I cut my finger so I did that too, then I followed the linked instructions to install WSL Hello sudo with reservations about it even working.

With trepidation I typed sudo synaptic (a GUI apt installer for linux) and was delightfully surprised to be prompted for my fingerprint. Success!

I look forward to finding ways to get this working with my Yubikey in future (the security key option isn't integrated into "Hello" for some reason) or even SQRL!
 
My experience, a couple of years ago, with Firefox, was that it invoked Windows Hello type prompts.
Click to expand...
Yes that invoked Windows Hello which prompted me for my fingerprint. Clicking "more options" in that prompt only gives the option of entering a PIN.

Unfortunately, there’s two big problems with the current state of the Yubikey-Windows Hello solution. The first is that only the Yubikey 4 series keys are compatible, not the vastly superior series 5. I bought the series 5.

But that’s a moot point because of the second, much bigger, issue: Yubikey removed their Windows Hello solution from the Microsoft store in September of 2019. Because Microsoft deprecated their Companion Device Framework for Windows Hello, the integration no longer worked.

The separate "Use a Security Key" sign-in option in settings is only for logging into Windows sans Hello, so it's just not a working solution in this case currently.
 
Last edited:
Hmmm Perhaps there's a trick. I just tried, and as I have Windows Hello setup for facial recognition, it set that up, but when I clicked cancel, it offered the FIDO2 option.

I tired to post the pictures inline, but the system here just doesn't let me post anything of a useful size... sorry. Here's the links to the three pics.

snipboard.io

Upload and share screenshots and images - print screen online | Snipboard.io

Easy and free screenshot and image sharing - upload images online with print screen and paste, or drag and drop.
snipboard.io snipboard.io

snipboard.io

Upload and share screenshots and images - print screen online | Snipboard.io

Easy and free screenshot and image sharing - upload images online with print screen and paste, or drag and drop.
snipboard.io snipboard.io

snipboard.io

Upload and share screenshots and images - print screen online | Snipboard.io

Easy and free screenshot and image sharing - upload images online with print screen and paste, or drag and drop.
snipboard.io snipboard.io
 
You must log in or register to reply here.

Similar threads

Akin
Windows 10 "Your device is missing important security and quality fixes"
Replies
3
Views
896
Operating Systems
PHolder
P
C
TPM 2 on USB stick possible for W11???
Replies
3
Views
3K
Operating Systems
JakeofArk
JakeofArk
P
Windows is [re]pushing KB4589212 for Intel Microcode updates
Replies
0
Views
1K
Operating Systems
PHolder
P
H
When W11 is forced on your PC
Replies
9
Views
2K
Operating Systems
hpoehrli
H
Top Bottom
Back