Finger

Approve sudo on your Linux laptop with the fingerprint sensor on your Android phone, instead of typing your password.

Runs on: Linux · Android
Built with: Go · Kotlin
Connects over: Tailscale
Price: $5 one-time

What it does

Your phone answers the password prompt

When you run sudo, your phone shows the exact command, who is asking and on which terminal, and waits for your fingerprint. Approve it and sudo carries on. Deny it, or do nothing, and you get the ordinary password prompt.

Shows the exact command The full command line, user, target and terminal are on the phone screen before you touch the sensor.

Signed both ways Requests carry a signature, a timestamp and a one-time nonce. Approvals are signed by a key held in the Android Keystore.

Fails closed A denial, a timeout, a missing phone or a bad signature all end at the password prompt, never at a granted sudo.

No Syntax Forge server The laptop and phone talk directly over your own Tailscale network. Nothing passes through this website.

How it works

You run sudo. A PAM rule starts finger-pam, which asks the local Finger daemon for approval.
The daemon queues a signed request (command line, user, target, terminal, time and a random nonce), and your phone picks it up over Tailscale.
The phone shows the exact command. You approve with your fingerprint, and the Android Keystore key signs the answer.
finger-pam checks that signature against a root-owned key in /etc/finger/approve/. Valid and unchanged: sudo proceeds. Anything else falls back to the password prompt.

Requirements

A Linux laptop or desktop where sudo goes through PAM, with a systemd user session for the daemon.
An Android phone with a fingerprint sensor, running Android 10 or newer. So far it has been run on one Android 16 phone.
Tailscale on both devices, signed in to the same tailnet.
Root access once, to install the PAM helper and enroll your phone’s key.

What it does not do

It can never bypass authentication. The phone replaces typing the password. It does not replace authentication: only a valid signature from the phone you enrolled lets sudo through without the password.

It needs root once to install, and you add the PAM rule yourself. No installer edits it for you.
If the phone is absent, offline or ignored, the request times out after 45 seconds and the normal password prompt appears.
It covers sudo only. Polkit dialogs and screen lockers keep asking for your password.

Questions

What happens if my phone is off or out of range?

After 45 seconds without an answer, sudo shows its normal password prompt. You can always type the password instead.

Where is the approval key kept?

The signing key is created in the phone’s Android Keystore. The laptop keeps only its public half, in a root-owned file under /etc/finger/approve/.

What does the $5 cover?

A one-time license for one person, covering the current major version with its minor and patch updates, on up to two devices at a time. A license file is issued at purchase and verified offline; each device registers on first activation. Moving to a new machine is a reset you request through Support with your order ID, not a repurchase. There is no subscription. It does not allow redistributing the build; the full terms are on the Licensing page.