ThinkWiki - User contributions [en]

User:Blackhold

2010-03-07T15:29:56Z

Blackhold:

'''owned:'''<br>
- lenovo 3000 v100<br>
- lenovo thinkpad x200<br>
- lenovo thinkpad x200s<br>

User:Blackhold

2010-03-07T15:29:32Z

Blackhold: â†Created page with 'owned: - lenovo 3000 v100 - lenovo thinkpad x200 - lenovo thinkpad x200s'

owned:
- lenovo 3000 v100
- lenovo thinkpad x200
- lenovo thinkpad x200s

Talk:How to enable the integrated fingerprint reader with ThinkFinger

2010-03-07T15:28:57Z

Blackhold: /* Thinkfinger on lenovo thinkpad x200s */

about fingerpring security or should we pay more for it?
* [http://www.ccc.de/biometrie/fingerabdruck_kopieren?language=en How to fake fingerprints]
* [http://events.ccc.de/congress/2006/Fahrplan/events/1578.en.html Hacking fingerprint recognition systems (PDF file - 1.0 MB)]

== GDM ==

Howdy.

With latest versions of GDM, PAM and ThinFinger you may experience a GDM segfault when using the Face Browser to select a user.
This stops you from using the aforementioned software combination to log in to a pure tablet system. That is, you're going to need a keyboard to type the username.
Please see [http://bugs.gentoo.org/show_bug.cgi?&id=199106 this bug] report and contribute if you can.

== Problem ==

Hello! I have Lenovo R61i and Debian 4.0 (sid). I have done all what was in this article, but when I do:

pokorski@debian:~$ sudo tf-tool --acquire

the terminal is writing:

ThinkFinger 0.3 (http://thinkfinger.sourceforge.net/)
Copyright (C) 2006, 2007 Timo Hoenig <thoenig@suse.de>

Initializing...USB device not found.

I read manuals and howtos but I can't install it on my R61i. On M$ Windows biometric reader worked correctly. Can anybody help me? Sorry for my English (I'm Polish)

- Hi, I have the same notebook, runnning ubuntu 8.04, and it seems this device isn't supported by thinkfinger, what worked for me is libfprint, the newest version.
regards

== Intrepid Ibex ==
Has anyone got thinkfinger to work with pam in Ubuntu Intrepid Ibex? If so, how did you configure /etc/pam.d/common_auth?

Configuration of thinkfinger has been simplified, but the change was not not documented in the man page... This [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/203973 bug report] will probably help. Install the modified packages mentioned in the [http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger#Intrepid HowTo]. My {{path|/etc/pam.d/common-auth}} (note "-" not "_") looks like following.
Best, [[User:Tec|Tec]] 02:20, 19 November 2008 (CET)

# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
#auth [success=1 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

== Security issue ==

Hello,
I think adding pam_thinkfinger.so to /etc/pam.d/common-auth is not that good idea.
On my gentoo laptop after adding this, it is possible to login from ssh with the fingerprint reader, I think this is not good.

For example ( 169-44 is a remote host, Derex-PC is my laptop with thinkfinger ):

<pre>
derex@169-44:~$ ssh root@192.168.168.168
Password or swipe finger:
</pre>

<pre>
derex@Derex-PC ~ $ su -
Password:
</pre>

Then I swipe my finger on the laptop, and press enter (just it, no password) on the remote host, and I get this:

<pre>
derex@169-44:~$ ssh root@192.168.168.168
Password or swipe finger:
Last login: Wed Jan 28 13:36:15 EET 2009 from 192.168.168.1 on pts/1
Last login: Wed Jan 28 13:48:17 2009 from 192.168.168.1
Derex-PC ~ #
</pre>

<pre>
derex@Derex-PC ~ $ su -
Password:
su: Authentication failure
derex@Derex-PC ~ $
</pre>

{{NOTE| "su" prompts for "Password" only, but ususally it asks "Password or swipe finger". }}

I added pam_thinkfinger.so only to gdm, gnome-screensaver, login and su in /etc/pam.d/ and now I dont have this issue.

== Trouble entering password to unlock screensaver ==

On Ubuntu Jaunty, I've got the password reader working fine, but now once gnome-screensaver kicks in, I can only unlock it using the fingerprint reader. If I enter my password, it flips to "checking" and stays that way until I cancel it. Anyone else seeing anything like this?

== Debian Squeeze - i386 issues with fingerprint reader ==

On Debian squeeze the SGS Thomson Fingerprint reader stopped working correctly with a recent update. I accidently stumbled across a [http://bugs.gentoo.org/show_bug.cgi?id=298459 gentoo bug] stating the same strange behavior (although the console is working correctly, X does not). Appearently this is due to missing sync events that should be sent to evdev which got updated in debian squeeze recently. Though as thinkfinger was a dead upstream for a long time by now (package was removed from repositories) and there was no suitable replacement I could get my hands an I finally recompiled from scratch. For those that might be in the same situation - here is what I did:

You need the package: checkinstall for a proper package management (should be in repository) and any related dependency libraries usb, pam,.... (check what ./configure is complaining about).

Get the source code [http://ppa.launchpad.net/jon-oberheide/ppa/ubuntu/pool/main/t/thinkfinger/thinkfinger_0.3+r118.orig.tar.gz thinkfinger_0.3+r118.orig.tar.gz] the necessary [http://ppa.launchpad.net/jon-oberheide/ppa/ubuntu/pool/main/t/thinkfinger/ patch] from Jon Oberheide (thinkfinger_0.3+r118-0ubuntu5~ppa1.diff.gz worked great for) and the [http://bugs.gentoo.org/attachment.cgi?id=214331&action=view gentoo patch] of course (I named the file: patch_evdev_gentoo.diff). Then fire up your favorite console, unpack and apply the patches:
<pre>
~ $ tar -xvzf thinkfinger_0.3+r118.orig.tar.gz
~ $ gzip -d thinkfinger_0.3+r118-0ubuntu5~ppa1.diff.gz
~ $ patch -p0 < thinkfinger_0.3+r118-0ubuntu5~ppa1.diff
~ $ cp patch_evdev_gentoo.diff thinkfinder-0.3+118/
~ $ cd thinkfinger-0.3+118
~ $ patch -p0 < patch_evdev_gentoo.diff
</pre>
than configure (there might be packages missing - look what {{path|./configure}} is complaining about) compile, pack and install the software
<pre>
~ $ ./configure --prefix=/usr --with-securedir=/lib/security --sysconfdir=/etc
~ $ make
~ $ su
~ # checkinstall
</pre>
Don't forget about package documentation - the packed package should be installed defaultly. As tf-tool is installed in /usr/sbin it is not in path for normal users. The workaround I choose was a symbolic link in {{path|/usr/local/bin}} (quick and dirty, sorry - but suitable in my case)
<pre>
~ # cd /usr/local/bin
~ # ln -s /usr/sbin/tf-tool
</pre>
In case you had a working fingerprint reader before everything should be working normally. If not you might want to go through the [http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger#Debian setup page] and apply initial configuration (as debian squeeze has the recent udev package you need as well to adapt your udev rules according to the ubuntu karmic section)

== Thinkfinger on lenovo thinkpad x200s ==

Hi guys,
I'm configuring thinkfinger on my laptop, I could install with no problems thinkfinger, but on testing it shows me that:

salnitre:/home/laura/bin/dit/thinkfinger-0.3# tf-tool --acquire

ThinkFinger 0.3 (http://thinkfinger.sourceforge.net/)
Copyright (C) 2006, 2007 Timo Hoenig <thoenig@suse.de>

Initializing...USB device not found.

<nowiki>#</nowiki> lsusb |grep 08ff
Bus 004 Device 002: ID 08ff:2810 AuthenTec, Inc. AES2810

before trying to install thinkfinger I also tried with fprint, but I had some problem with dependencies :(

--[[User:Blackhold|Blackhold]] 15:28, 7 March 2010 (UTC)

Talk:How to enable the integrated fingerprint reader with ThinkFinger

2010-03-07T15:28:14Z

Blackhold: /* Thinkfinger on lenovo thinkpad x200s */ new section

about fingerpring security or should we pay more for it?
* [http://www.ccc.de/biometrie/fingerabdruck_kopieren?language=en How to fake fingerprints]
* [http://events.ccc.de/congress/2006/Fahrplan/events/1578.en.html Hacking fingerprint recognition systems (PDF file - 1.0 MB)]

== GDM ==

Howdy.

With latest versions of GDM, PAM and ThinFinger you may experience a GDM segfault when using the Face Browser to select a user.
This stops you from using the aforementioned software combination to log in to a pure tablet system. That is, you're going to need a keyboard to type the username.
Please see [http://bugs.gentoo.org/show_bug.cgi?&id=199106 this bug] report and contribute if you can.

== Problem ==

Hello! I have Lenovo R61i and Debian 4.0 (sid). I have done all what was in this article, but when I do:

pokorski@debian:~$ sudo tf-tool --acquire

the terminal is writing:

ThinkFinger 0.3 (http://thinkfinger.sourceforge.net/)
Copyright (C) 2006, 2007 Timo Hoenig <thoenig@suse.de>

Initializing...USB device not found.

I read manuals and howtos but I can't install it on my R61i. On M$ Windows biometric reader worked correctly. Can anybody help me? Sorry for my English (I'm Polish)

- Hi, I have the same notebook, runnning ubuntu 8.04, and it seems this device isn't supported by thinkfinger, what worked for me is libfprint, the newest version.
regards

== Intrepid Ibex ==
Has anyone got thinkfinger to work with pam in Ubuntu Intrepid Ibex? If so, how did you configure /etc/pam.d/common_auth?

Configuration of thinkfinger has been simplified, but the change was not not documented in the man page... This [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/203973 bug report] will probably help. Install the modified packages mentioned in the [http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger#Intrepid HowTo]. My {{path|/etc/pam.d/common-auth}} (note "-" not "_") looks like following.
Best, [[User:Tec|Tec]] 02:20, 19 November 2008 (CET)

# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
#auth [success=1 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

== Security issue ==

Hello,
I think adding pam_thinkfinger.so to /etc/pam.d/common-auth is not that good idea.
On my gentoo laptop after adding this, it is possible to login from ssh with the fingerprint reader, I think this is not good.

For example ( 169-44 is a remote host, Derex-PC is my laptop with thinkfinger ):

<pre>
derex@169-44:~$ ssh root@192.168.168.168
Password or swipe finger:
</pre>

<pre>
derex@Derex-PC ~ $ su -
Password:
</pre>

Then I swipe my finger on the laptop, and press enter (just it, no password) on the remote host, and I get this:

<pre>
derex@169-44:~$ ssh root@192.168.168.168
Password or swipe finger:
Last login: Wed Jan 28 13:36:15 EET 2009 from 192.168.168.1 on pts/1
Last login: Wed Jan 28 13:48:17 2009 from 192.168.168.1
Derex-PC ~ #
</pre>

<pre>
derex@Derex-PC ~ $ su -
Password:
su: Authentication failure
derex@Derex-PC ~ $
</pre>

{{NOTE| "su" prompts for "Password" only, but ususally it asks "Password or swipe finger". }}

I added pam_thinkfinger.so only to gdm, gnome-screensaver, login and su in /etc/pam.d/ and now I dont have this issue.

== Trouble entering password to unlock screensaver ==

On Ubuntu Jaunty, I've got the password reader working fine, but now once gnome-screensaver kicks in, I can only unlock it using the fingerprint reader. If I enter my password, it flips to "checking" and stays that way until I cancel it. Anyone else seeing anything like this?

== Debian Squeeze - i386 issues with fingerprint reader ==

On Debian squeeze the SGS Thomson Fingerprint reader stopped working correctly with a recent update. I accidently stumbled across a [http://bugs.gentoo.org/show_bug.cgi?id=298459 gentoo bug] stating the same strange behavior (although the console is working correctly, X does not). Appearently this is due to missing sync events that should be sent to evdev which got updated in debian squeeze recently. Though as thinkfinger was a dead upstream for a long time by now (package was removed from repositories) and there was no suitable replacement I could get my hands an I finally recompiled from scratch. For those that might be in the same situation - here is what I did:

You need the package: checkinstall for a proper package management (should be in repository) and any related dependency libraries usb, pam,.... (check what ./configure is complaining about).

Get the source code [http://ppa.launchpad.net/jon-oberheide/ppa/ubuntu/pool/main/t/thinkfinger/thinkfinger_0.3+r118.orig.tar.gz thinkfinger_0.3+r118.orig.tar.gz] the necessary [http://ppa.launchpad.net/jon-oberheide/ppa/ubuntu/pool/main/t/thinkfinger/ patch] from Jon Oberheide (thinkfinger_0.3+r118-0ubuntu5~ppa1.diff.gz worked great for) and the [http://bugs.gentoo.org/attachment.cgi?id=214331&action=view gentoo patch] of course (I named the file: patch_evdev_gentoo.diff). Then fire up your favorite console, unpack and apply the patches:
<pre>
~ $ tar -xvzf thinkfinger_0.3+r118.orig.tar.gz
~ $ gzip -d thinkfinger_0.3+r118-0ubuntu5~ppa1.diff.gz
~ $ patch -p0 < thinkfinger_0.3+r118-0ubuntu5~ppa1.diff
~ $ cp patch_evdev_gentoo.diff thinkfinder-0.3+118/
~ $ cd thinkfinger-0.3+118
~ $ patch -p0 < patch_evdev_gentoo.diff
</pre>
than configure (there might be packages missing - look what {{path|./configure}} is complaining about) compile, pack and install the software
<pre>
~ $ ./configure --prefix=/usr --with-securedir=/lib/security --sysconfdir=/etc
~ $ make
~ $ su
~ # checkinstall
</pre>
Don't forget about package documentation - the packed package should be installed defaultly. As tf-tool is installed in /usr/sbin it is not in path for normal users. The workaround I choose was a symbolic link in {{path|/usr/local/bin}} (quick and dirty, sorry - but suitable in my case)
<pre>
~ # cd /usr/local/bin
~ # ln -s /usr/sbin/tf-tool
</pre>
In case you had a working fingerprint reader before everything should be working normally. If not you might want to go through the [http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger#Debian setup page] and apply initial configuration (as debian squeeze has the recent udev package you need as well to adapt your udev rules according to the ubuntu karmic section)

== Thinkfinger on lenovo thinkpad x200s ==

Hi guys,
I'm configuring thinkfinger on my laptop, I could install with no problems thinkfinger, but on testing it shows me that:

salnitre:/home/laura/bin/dit/thinkfinger-0.3# tf-tool --acquire

ThinkFinger 0.3 (http://thinkfinger.sourceforge.net/)
Copyright (C) 2006, 2007 Timo Hoenig <thoenig@suse.de>

Initializing...USB device not found.

# lsusb |grep 08ff
Bus 004 Device 002: ID 08ff:2810 AuthenTec, Inc. AES2810

before trying to install thinkfinger I also tried with fprint, but I had some problem with dependencies :(

[[User:Blackhold|Blackhold]]--