Local biometric authentication

Look at your laptop.
You’re in.

Iris brings fast, infrared-first face authentication to Ubuntu and GNOME—from the first login to everyday elevation prompts.

Install Iris View v0.1.0

Face data stays encrypted on your computer. No account. No cloud.

Iris dial scanning and resolving into a green success checkmark

Looking at your face…

Infrared camera active

Built for Ubuntu 26.04 GNOME 50 Wayland AGPL-3.0

One face. Four surfaces.

Authentication that feels native.

Iris joins the Linux authentication stack instead of sitting beside it, so the same local recognition path works wherever PAM is supported.

First login

The dial appears on the GDM greeter before your desktop session starts.

GDM

Screen unlock

GNOME ScreenShield begins recognition when you wake or lock the machine.

Super + L

Terminal elevation

Authenticate compatible sudo requests without interrupting your flow.

sudo

App authorization

Polkit dialogs show the same calm scan and success motion as login.

polkit

Small, separated, inspectable

The password prompt never becomes the face engine.

A narrow PAM module sends a bounded request to a root-owned local daemon. Camera access, models, matching, and encrypted templates stay out of the authentication client.

Read the security architecture

GDMsudopolkit

Minimal clientpam_iris.so

/run/irisd/socket

Root-owned serviceirisdBounded request · fail-through

IR cameraONNX modelsEncrypted store

Security without mystery

Private by architecture. Honest by design.

Iris is explicit about what it protects, what it stores, and where biometrics remain weaker than a secret you know.

No network path

Recognition runs locally. Iris has no account system, telemetry endpoint, or cloud API.

Encrypted embeddings

Only mathematical face templates are retained, protected with AES-256-GCM and optional TPM 2.0 sealing.

Password fallback

Camera, match, transport, or timeout failures return control to the remaining PAM stack.

A deliberate setup

Test recognition.
Then enable login.

Iris keeps PAM disabled during the first install. Enroll and test your face first; only then opt in to each authentication surface.

1
InstallBuild the daemon, app, extension, and PAM module.
2
Enroll & testConfirm your camera and fallback work reliably.
3
Opt inEnable GDM, sudo, or polkit individually.

Terminal

# Get Iris and install reviewed Ubuntu packages
git clone https://github.com/roryjmahoney/Iris.git
cd Iris
sed '/^[[:space:]]*#/d; /^[[:space:]]*$/d' \
  requirements-apt.txt | xargs sudo apt install
sudo ./install.sh

# Enroll and prove recognition before changing PAM
sudo iris enroll
sudo iris test

# Enable GDM login and GNOME unlock
sudo ./install.sh --gdm

Know what runs at login

Documentation made for recovery, too.

InstallationPrerequisites, setup, PAM opt-in, and removal.

ConfigurationCameras, thresholds, timeouts, and defaults.

TroubleshootingCamera, daemon, PAM, Shell, and TPM diagnosis.

RecoveryPassword fallback and recovery from a bad PAM edit.

Straight answers

Before you install.

Does Iris upload my face?

No. Detection and matching run on your machine. Iris stores encrypted numerical embeddings, never enrollment photographs, under the root-owned local data directory.

What happens when recognition fails?

Iris fails through to the rest of the PAM stack. Your password remains available when the camera is missing, matching times out, or the daemon cannot answer.

Do I need an infrared camera?

Infrared is strongly preferred and receives first-class hardware selection and strobe handling. Consult the hardware guide before relying on a conventional webcam.

Is every Linux desktop supported?

Not yet. Iris currently targets Ubuntu 26.04, GNOME 50, and Wayland. The core PAM path is portable in principle, but other distributions and shells are not release targets for v0.1.0.

Open source. Local first.

Make Linux login feel effortless.

Explore the source Report an issue