Biometric Authentication Stack for Linux Systems
FaceAuth is a high-performance biometric security framework that implements deep learning-based facial verification directly into the Linux PAM (Pluggable Authentication Modules) stack. It bridges the gap between hardware-level camera access and system-level authentication, enabling secure, passwordless access for GDM, Sudo, and Terminal sessions.
- Inference Engine: Optimized SCRFD for face detection and ArcFace for feature embedding extraction.
- Liveness Validation: Integrated MiniFASNetV2 for hardware-level anti-spoofing against digital and physical presentation attacks.
- PAM Integration: Native shared library (
pam_faceauth.so) providing seamless hooks into system authentication requests. - Non-Persistent Data: Biometric data is stored as 512-bit normalized mathematical vectors. No raw imagery is ever written to disk.
- Policy Enforcement: Fully integrated with PolicyKit to ensure administrative operations follow system-wide security policies.
The framework operates through three distinct layers ensuring process isolation and security:
- faceauthd (Service Layer): A C++ daemon managing the continuous camera lifecycle and asynchronous AI inference.
- faceauth-cli (Control Layer): A secure administrative interface for identity enrollment and database management.
- pam_faceauth (Bridge Layer): The library interface connecting system auth calls to the service layer via Unix Domain Sockets.
- Operating System: Linux (Debian, Ubuntu, Fedora, or Arch based)
- Hardware: USB or Integrated UVC-compliant camera
- Libraries:
OpenCV 4.x,ONNX Runtime 1.18+,libpam-dev,Polkit
The automated installer handles cross-compilation and system service configuration:
git clone https://github.com/XariaCore/FaceAuth.git
cd FaceAuth
chmod +x install.sh
sudo ./install.shThe faceauth-cli provides an intuitive management protocol:
| Action | Command Syntax | Access Level |
|---|---|---|
| Identity Enrollment | sudo faceauth-cli enroll <username> |
Root / Admin |
| Revoke Identity | sudo faceauth-cli delete <username> |
Root / Admin |
| Audit Identity List | faceauth-cli list |
Authorized User |
| Integrity Test | faceauth-cli verify |
Authorized User |
Operational thresholds can be modified in include/Config.h to suit specific environmental requirements:
/* Precision Parameters */
const float RECOG_THRESHOLD = 0.70f; // Biometric matching strictness
const float SPOOF_THRESHOLD = 0.80f; // Anti-spoofing sensitivity
const int SCAN_TIMEOUT_MS = 1024; // Temporal limit per requestIn the event of hardware failure or daemon unavailability, the PAM module returns PAM_AUTHINFO_UNAVAIL, defaulting to the standard system password prompt.
All biometric assets are stored in /opt/FaceAuth/data, restricted by 700 permissions to the root user.
FaceAuth is open-source software, licensed under the GPL-3.0.
Review the LICENSE file for further legal details.