Approve Linux authentication on your Android phone with a fresh strong biometric. syauth connects a Linux PAM module, a desktop Bluetooth daemon, and an Android companion that signs each request through Android Keystore.
Documentation · Downloads · How it works · Security boundaries
On a supported Linux desktop:
curl -fsSL https://mewplane.github.io/syauth/install.sh | shThe installer resolves the latest release, chooses the native package for your distribution and CPU, checks its SHA-256 checksum, and installs it with apt, dnf, zypper, or pacman. It requests sudo when needed. It leaves PAM configuration and service activation to you.
Prefer to review the script first?
curl -fsSLo install-syauth.sh https://mewplane.github.io/syauth/install.sh
less install-syauth.sh
sh install-syauth.sh --dry-run
sh install-syauth.shRelease downloads include DEB, RPM, Arch Linux packages, and manual Linux archives for x86_64 and ARM64, plus a signed Android APK, source archive, signing certificate, build metadata, and SHA256SUMS. See installation and verification for direct package commands and version-pinned downloads.
Use Debian 12+, Ubuntu 24.04+, a current Fedora/openSUSE/Arch installation, or a compatible derivative, with glibc 2.36+, PAM, systemd user services, BlueZ, and a BLE adapter capable of advertising. The phone needs Android 13+ with a supported Ed25519 Keystore implementation and an enrolled strong biometric. The APK can install on older Android versions, but that does not establish signing-key support.
- Install the desktop package and signed Android companion.
- Follow storage and user-service setup.
- Run
syauth pair, complete numeric comparison on both devices, and confirm the bond withsyauth list. - Read the PAM policy reference, configure one service, and complete your first unlock.
syauth pair
syauth list
syauth doctorBeing nearby prepares the connection; each authentication still needs explicit approval and a strong biometric. Keep the existing recovery method available while configuring PAM. The security guide describes the current implementation's differences from the design specification, including bond derivation and desktop key storage.
- First unlock tutorial
- Install, pair and revoke, troubleshoot
- CLI, configuration, protocol
- Illustrated mechanics with animated pairing, discovery, and unlock
- Release builds and signing
The Rust workspace is under crates/; the Android app is under syauth-android/. Build from source with a toolchain compatible with the committed Cargo.lock and development packages for D-Bus, PAM, and Bluetooth:
make build
make test
make lint
python3 -m unittest discover -s tests -p 'test_release_*.py'
python3 -m unittest discover -s tests -p test_installer.pySee documentation development, release development, and AGENTS.md for contributor contracts. Open an issue with reproduction steps and sanitized diagnostics, or a pull request with the user-visible change and relevant test evidence. Avoid posting bond files, private keys, or unreviewed logs.
Maintained by dmytrogajewski and contributors.
MIT.