How to enable the integrated fingerprint reader with ThinkFinger

How to enable the fingerprint reader has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called ThinkFinger which does the same, but open.

Installing

From source

Download thinkfinger-0.3.tar.gz from the homepage and unpack it somewhere, make sure you have the gcc compiler, libtool, pkg-config, libusb-dev and libpam0g-dev installed, then:

$ cd thinkfinger-0.3

$ ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger

$ make

# make install

NOTE!

/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!

"make install" doesn't create the birdir we specified (where thinkfinger will store users' biometric info), so create it:

# mkdir /etc/pam_thinkfinger

If everything went OK assert that you find pam_thinkfinger.so in /lib/security typing:

$ ls /lib/security

From package

• Debian
  • packages for Debian (testing) are available here.
  • packages arrived in Debian experimental on Aug 2nd, 2007 (cf. bug #409563).
• Fedora/Fedora Core
  • packages for Fedora Core 6 are available in "extras" repository (# yum install thinkfinger).
  • packages for Fedora 7 are available in the "updates" repository (# yum install thinkfinger).
• Gentoo
  • emerge sys-auth/thinkfinger
• OpenSUSE
  • openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages here.

Testing the driver

Now the driver is installed and should be working. You can try it (as root) with

# tf-tool --acquire

and

# tf-tool --verify

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

Configuring PAM to use ThinkFinger

Now you can configure PAM to use ThinkFinger:

Open /etc/pam.d/common-auth (In FC6 and F7 this file is /etc/pam.d/system-auth):

# nano -w /etc/pam.d/common-auth

Add this line before any pam_unix or pam_unix2 directives:

auth     sufficient     pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.

auth     required     pam_unix.so try_first_pass

For instance, /etc/pam.d/common-auth looks like this:

auth    sufficient      pam_thinkfinger.so
auth    required        pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:

auth    required        pam_env.so
auth    sufficient      pam_thinkfinger.so
auth    required        pam_unix2.so

Now we are ready to add users to thinkfinger. You can add a fingerprint for a user with:

# tf-tool --add-user $USERNAME

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

# tf-tool --add-user root

NOTE!

You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!

GNOME

gksu/gksudo

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:

• Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
• Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.

--- libgksu-2.0.3/libgksu/libgksu.c.orig	2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c		2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
        */
       for (counter = 0; counter < 50; counter++)
 	{
-	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
 	    break;
 
 	  read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
       if (context->debug)
 	fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");
 
-      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
 	{
 	  gchar *password = NULL;
 	  gboolean prompt_grab;

gnome-screensaver

If you'd like to be able to unlock your screen using the fingerprint reader, you must give yourself access to the fingerprint reader and your bir-file, because unlike login/gdm/su/sudo, gnome-screensaver does not run as root. The following procedure will make the fingerprint reader accessible to members of the "fingerprint" group.

Make the group: # groupadd fingerprint

Save the following as /etc/udev/rules.d/60-thinkfinger.rules (you may need to reboot for this to take effect):

#
# udev rules file for the thinkfinger fingerprint scanner
# 
# gives access to the fingerprint reader to those in the "fingerprint" group
#

# SGS Thomson Microelectronics Fingerprint Reader
SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"

# the also-needed uinput device
KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

Per user:

1. Add him to the group: # gpasswd -a $USERNAME fingerprint

2. Give him access to his bir-file (one of the following):

• Make him owner of his bir-file: # chown $USERNAME /etc/pam_thinkfinger/$USERNAME.bir (any system)
• Give him read-only access to his bir-file # setfacl -m u:$USERNAME:r /etc/pam_thinkfinger/$USERNAME.bir (for systems with FACLs enabled)
• Give his private user group read-only access to his bir-file # chgrp $GROUP /etc/pam_thinkfinger/$USERNAME.bir and # chmod 0640 /etc/pam_thinkfinger/$USERNAME.bir (for systems where users have private groups)

KDE

Integration in KDE and kdm seems not to be easily possible now. There is a filed bug at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

This Howto was copied from Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader and then slightly modified.