How to enable the integrated fingerprint reader with ThinkFinger

How to enable the fingerprint reader has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called ThinkFinger which does the same, but open.

Installing from source

Download thinkfinger-0.3.tar.gz from the homepage and unpack it somewhere, make sure you have the gcc compiler, libtool, pkgconfig, libusb-dev and libpam0g-dev installed, then:

$ cd thinkfinger-0.3

$ ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger

$ make

# make install

NOTE!

/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!

If everything went ok assert that you find pam_thinkfinger.so in /lib/security typing:

$ ls /lib/security

Packages

• Debian
  • packages for Debian (testing) are available here.
  • packages arrived in Debian experimental on Aug 2nd, 2007 (cf. bug #409563).
• Fedora Core
  • packages for Fedora Core 6 are available in "extras" repository (#yum install thinkfinger).
• Gentoo
  • emerge sys-auth/thinkfinger
• OpenSUSE
  • openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages here.

Testing the driver

Now the driver is installed and should be working. You can try it (as root) with

# tf-tool --acquire

and

# tf-tool --verify

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

Configuring PAM to use ThinkFinger

Now you can configure pam to use ThinkFinger:

Open /etc/pam.d/common-auth:

NOTE!

In FC6 this file is "/etc/pam.d/system-auth"

# nano -w /etc/pam.d/common-auth

Add this line before any pam_unix or pam_unix2 directives:

auth     sufficient     pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.

auth     required     pam_unix.so try_first_pass

For instance, /etc/pam.d/common-auth looks like this:

auth    sufficient      pam_thinkfinger.so
auth    required        pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:

auth    required        pam_env.so
auth    sufficient      pam_thinkfinger.so
auth    required        pam_unix2.so

Now we are ready to add users to thinkfinger. As "make install" did not create /etc/pam_thinkfinger, you need to create it now:

# mkdir /etc/pam_thinkfinger

And now, you can add a fingerprint for a user with:

# tf-tool --add-user $USERNAME

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

# tf-tool --add-user root

NOTE!

You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!

GNOME

gksu/gksudo

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:

• Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
• Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.

--- libgksu-2.0.3/libgksu/libgksu.c.orig	2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c		2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
        */
       for (counter = 0; counter < 50; counter++)
 	{
-	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
 	    break;
 
 	  read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
       if (context->debug)
 	fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");
 
-      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
 	{
 	  gchar *password = NULL;
 	  gboolean prompt_grab;

KDE

Integration in KDE and kdm seems not to be easily possible now. There is a filed bug at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

This Howto was copied from Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader and then slightly modified.