pam: reducing auth method timeout

Question

I have set up user fingerprint auth on Fedora 37 laptops.

With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce the fingerprint timeout from 10s to 3s , as to fall back to passwords more earlier, when using the machine from remote.

I tried to modify the pam config line to

auth  sufficient   pam_fprintd.so   max_tries=1 timeout=3

but without success and the timeout still takes 10s.

Answer 1

Timeout minimum value is 10s.

See manpage:

timeout=TIMEOUT
    The amount of time before returning an authentication failure. The default timeout is 30 seconds, with 10 seconds being the minimum.

Answer 2

Have you tried editing /etc/login.defs?

#
# Max number of login retries if password is bad. This will most likely be
# overriden by PAM, since the default pam_unix module has it's own built
# in of 3 retries. However, this is a safe fallback in case you are using
# an authentication module that does not enforce PAM_MAXTRIES.
#
LOGIN_RETRIES           5

#
# Max time in seconds for login
#
LOGIN_TIMEOUT           60