irlume
A face and fingerprint authentication system for Linux login, lock screen, sudo and app prompts, using infrared cameras with anti-spoofing checks on by default and TPM-sealed embeddings.
irlume authenticates Linux users by face or fingerprint for login, the lock screen, sudo and application prompts such as Bitwarden, including in the dark using an infrared camera. It stores 512-dimension face embeddings rather than images, sealed with AES-256-GCM on machines with a TPM, and always keeps a password fallback available.
Presentation-attack detection runs by default using paired ViT RGB and FLIR IR models verified against signed checksums at startup; the project documents that a printed photo alone passes the infrared gate in 69 of 70 measured presentations, which is why the shipped anti-spoofing pair is required rather than optional. It supports GNOME, KDE, Cinnamon and Omarchy lock screens, with XFCE's screensaver unsupported, polkit prompts, and a live terminal UI that can repair PAM configuration faults after updates.
It is written in Rust, GPL-3.0 licensed, and installs via a shell script or as a NixOS module.