Support for changing stack order or module priority

[bjoern-tantau]

I want to add the fprintd module so that I can authenticate with a fingerprint. But I still want password to be the first module asked for and only if that is empty to ask for the fingerprint.

When I do pam-config --add --fprintd and pam-config --add --unix --nullok the resulting /etc/pam.d/common-auth looks like:

auth    sufficient      pam_fprintd.so
auth    required        pam_unix.so     nullok try_first_pass

But I would need it to look like

auth    sufficient      pam_unix.so     nullok try_first_pass
auth    sufficient      pam_fprintd.so

As far as I can see this can currently not be achieved with pam-config.

[thkukuk]

Correct, this is not possible with the current pam-config design. All you can do is to disable pam-config and maintain the configuration file manual.