Code/enable-fingerprint-reader

1. !/bin/bash
2. Install UPEK fingerprint reader driver and associated software on Linux systems.
3. Source: http://thinkwiki.org/wiki/Script_for_enabling_the_fingerprint_reader

set -e -E -x -u # verbose, abort if anything fails

WHERE=/opt/bioapi PASSWD_ENROLLS=0 # should "passwd" do fingerprint enrollment (always)?

2. Install (patched) bioapi:

mkdir -p $WHERE wget -N http://www.qrivy.net/~michael/blua/bioapi/bioapi-latest.tar.bz2 wget -N -O bioapi-c++.patch 'http://cvs.pld-linux.org/cgi-bin/cvsweb/SOURCES/bioapi-c++.patch?rev=1.3' sha1sum --check <<EOF 932425e847449e9612c6894dcbaf44630aecfc13 bioapi-latest.tar.bz2 a838e9ab9bcad9c146856d41135460e7ac29a4ec bioapi-c++.patch EOF tar xjf bioapi-latest.tar.bz2 pushd bioapi-1.2.2 patch -i ../bioapi-c++.patch -p1 ./configure --with-Qt-dir=no --prefix=$WHERE make make install install -m644 include/bioapi_util.h $WHERE/include/bioapi_util.h install -m644 include/installdefs.h $WHERE/include/installdefs.h install -m644 imports/cdsa/v2_0/inc/cssmtype.h $WHERE/include/cssmtype.h chmod o-w $WHERE/var/bioapi popd

2. Tell ldconfig about bioapi libraries:

[ -d /etc/ld.so.conf.d ] || { echo "Unsupported distribution: no /etc/ld.so.conf.d directory."; exit 1; } echo $WHERE/lib > /etc/ld.so.conf.d/bioapi.conf ldconfig ldconfig -p | grep -q bioapi || { echo "ldconfig doesn't see bioapi"; exit 1; }

2. Install UPEK driver:

wget -N http://www.upek.com/support/download/TFMESS_BSP_LIN_1.0.zip sha1sum --check <<EOF c73466b5c3b26415b300d5c5ffb76deaefadeb32 TFMESS_BSP_LIN_1.0.zip EOF mkdir -p driver pushd driver unzip ../TFMESS_BSP_LIN_1.0.zip PATH="$PATH:$WHERE/bin" sh install.sh $WHERE/lib/ cd NonGUI_Sample perl -i -pe 'print "#include <stdlib.h>\n//DISABLED: " if m!^#include "port/bioapi_port.h"$!' main.c gcc -o Sample main.c -I$WHERE/include -L$WHERE/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN install Sample -m755 $WHERE/bin/upek-NonGUI_Sample popd

SERIAL=`$WHERE/bin/BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: \(.\{9\}\)\(.\{4\}\)\(.\{4\}\)\(.\{4\}\)\(.*\)/\1-\2-\3-\4-\5/gp}"`

2. Install (patched) pam_bioapi:

wget -N http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-latest.tar.bz2 wget -N http://badcode.de/downloads/fingerprint.patch sha1sum --check <<EOF a0bdf3436e55f7dc8b4795243f08a4c9b399dec8 pam_bioapi-latest.tar.bz2 619254a5bcd3acb8bf1d72b15ea69bfe00f0f064 fingerprint.patch EOF tar xjvf pam_bioapi-latest.tar.bz2 pushd pam_bioapi-0.2.1 patch -p0 < ../fingerprint.patch CPPFLAGS="-I$WHERE/include" LDFLAGS="-L$WHERE/lib" ./configure --prefix=$WHERE make make install ln -vfs $WHERE/lib/security/pam_bioapi.so* /lib/security/ popd

2. Install pamtester:

wget http://mesh.dl.sourceforge.net/sourceforge/pamtester/pamtester-0.1.2.tar.gz sha1sum --check <<EOF 33bcc610d7f208b50a0a23c144bdbd1e2cae4ac6 pamtester-0.1.2.tar.gz EOF tar xzvf pamtester-0.1.2.tar.gz pushd pamtester-0.1.2 ./configure --prefix=$WHERE make make install popd

2. Configure pam to use pam_bioapi:

grep -Eq 'Fedora Core release [45]|Red Hat Enterprise Linux AS release 4' \

 /etc/redhat-release || { echo \
 "I don't know how to configure PAM on this distribution.
  See: http://thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader#Configuring_pam";
  exit 1; }

PAMFILE=/etc/pam.d/system-auth if ! grep -q 'pam_bioapi\.so' $PAMFILE; then

 perl -i -pe '
   if (!$a && m/^auth.*pam_unix\.so/) {$a=1; print 
     "auth        sufficient    pam_bioapi.so '$SERIAL' /etc/bioapi/pam/\n"}
   ' $PAMFILE
 if [ $PASSWD_ENROLLS == 1 ]; then
   perl -i -pe '
     if (!$p && m/^password/) {$p=1; print
       "password    required      pam_bioapi.so '$SERIAL' /etc/bioapi/pam/\n"}
     ' $PAMFILE
 fi

fi

2. USB permissions (set now and add to startup):

RC_FILE=/etc/rc.local SET_PERMS=$WHERE/bin/set_fingerprint_perms

cat > $SET_PERMS <<'EOF'

1. !/bin/bash
2. Make fingerprint reader USB device world-writable:

chmod -R a+X /proc/bus/usb chmod 666 /proc/bus/usb/`/sbin/lsusb | sed -ne "/0483:2016/s/Bus\ \(.*\)\ Device\ \(.*\):\ .*/\1\/\2/p"` EOF chmod 755 $SET_PERMS

$SET_PERMS

[ -e $RC_FILE ] || { echo "No $RC_FILE, can't handle this distribution."; exit 1; } if ! grep -q 0483:2016 $SET_PERMS; then

 echo $SET_PERMS >> $RC_FILE

fi

2. Enroll:

mkdir -p /etc/bioapi/pam/$SERIAL pushd /etc/bioapi/pam/$SERIAL read -p "Now enroll your Unix accounts, including root (press Enter to start, then 'e' to enroll)." $WHERE/bin/upek-NonGUI_Sample popd

2. Done:

set +x cat<<EOF

Success.

• To test the fingerprint-enabled PAM login, run this as root:

 $WHERE/bin/pamtester -v login USERNAME authenticate

• Add the following command to your resume-from-suspend script:

 $SET_PERMS

EOF