ThinkWiki - User contributions [en]

Problems with SATA and Linux

2006-01-11T21:28:32Z

Keegan: change tense: 2.6.15 is out now

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
Some ThinkPad models use a SATA controller for the system hard disk. This causes several complications for Linux installation. The following lists these problems and known workarounds. Note that the details are often version- and distribution-specific.

===Models using a SATA disk interface===
Models using a SATA controller and a SATA system disk:
*ThinkPad {{Z60t}}, {{Z60m}}
Models using a SATA controller and a PATA (IDE) system disk with a SATA-to-PATA bridge:
*ThinkPad {{T43}}, {{T43p}}
*ThinkPad {{R52}}
*ThinkPad {{X41}}, {{X41T}}

{{NOTE|Some of these problems (namely SMART support, power management and disk information) are solved in Linux 2.6.15 with the inclusion of libata pass-through. See the SATA driver [http://linux.yyz.us/sata/features.html features], [http://linux.yyz.us/sata/software-status.html software status] and [http://linux.yyz.us/sata/sata-status.html hardware status].}}
|}

==Hang on resume from suspend to RAM==

Linux kernels (as of 2.6.15-rc3) do not support suspend and resume for SATA devices. As a result, the machine hangs upon the first disk access after resume. A kernel patch ([http://lkml.org/lkml/2005/5/2/46 LKML posting]) fixes this by adding SATA power management support.

Current kernel snapshots from the git-repository [http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9b847548663ef1039dd49f0eb4463d001e596bc3 have the patch already included], so hopefully no more patching will be necessary with 2.6.16.

===Patches===
* [http://shamrock.dyndns.org/~ln/linux/sata_pm.2.6.12.diff Patch for kernel 2.6.12]
* [http://shamrock.dyndns.org/~ln/linux/sata_pm.2.6.13-rc5.diff Patch for kernel 2.6.13-rc5]
* [http://lkml.org/lkml/2005/9/23/97 Patch for kernel 2.6.14]
* [http://www.xenotime.net/linux/SATA/2.6.15-rc/libata_suspend.patch Patch for kernel 2.6.15-rc4]
* [http://tpctl.sourceforge.net/tmp/sata_pm.2.6.15-rc6.patch Patch for kernels 2.6.15-rc6 through 2.6.15]

Some distributions already include this patch (e.g., {{Ubuntu}} Breezy), but some don't (e.g., {{Fedora}} 4).

===Links===
* RedHat Bugzilla [https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169201 bug 169201: "SATA drives fail on laptop suspend"]

==Failed resume from suspend to disk==

Suspend to disk (using swsusp or [[Software Suspend 2]]) needs to load the memory image from the SATA disk. For this to work, you either need an initrd with all the necessary SATA modules, or the SATA drivers compiled into the kernel.

==DVD drive not recognized==

The <tt>ata_piix</tt> SATA driver grabs ownership over the IDE ports when it is loaded, but (by default) does not support PATA ATAPI devices such as the Ultrabay optical drives. Thus, if the <tt>ide</tt> driver is compiled as a module and loaded after <tt>ata_piix</tt>, the DVD drive will not be recognized by either driver.

Either of the following configurations will work:
* For kernel 2.6.14 and newer: enable ATAPI support in the SATA system using {{bootparm|libata.atapi_enabled|1}} (see below; this is experimental).
* Compile IDE into the kernel (non-module).
* Compile both IDE and SATA as modules and make sure IDE is loaded first (the module is called 'ide_generic').

Note that the optical drive must be in the Ultrabay during system boot (Ultrabay device swapping is currently unsupported).

==No DMA on DVD drive==

Using the IDE driver, DMA support cannot be enabled on an Ultrabay optical drive:

# hdparm -d1 /dev/hdc

/dev/hdc:
setting using_dma to 1 (on)
HDIO_SET_DMA failed: Operation not permitted
using_dma = 0 (off)

As a result, the optical drive is slow, and in particular, too slow to play video DVDs.

One workaround is to use employ the SATA driver (instead of the IDE driver) for the optical drive. This requires enabling two featues of the SATA driver, namely ATAPI support and PATA support, which are both in active development and far from stable. Using this will probably devour all your data and go on to eat all the food in your fridge. But if you have full backups and an empty fridge, do the following:

* Grab the latest kernel (must be 2.6.14 or newer; the relevant code is under active development).
* Do one of the following:
** Configure the SATA system (and in particular <tt>ata_piix</tt> and <tt>libata</tt>) as built-in and add {{bootparm|libata.atapi_enabled|1}} to your kernel command line (e.g., in in {{path|/boot/grub/menu.lst}}).
** Configure the SATA system as module (this is often the default) and add "<tt>options libata atapi_enabled=1</tt>" to your {{path|/etc/modprobe.conf}} (or the equivalent in your distribution).
* Do one of the following:
** Disable the IDE system.
** Build the IDE driver as built-in (this is often the default) and add the {{bootparm|hdc|noprobe}} kernel argument (e.g., in in {{path|/boot/grub/menu.lst}}).
** Build the IDE driver as module and add "<tt>options ide hdc=noprobe</tt>" to your {{path|/etc/modprobe.conf}} (or the equivalent in your distribution).
* If you chose to use modules above, regenerate your <tt>initrd</tt> file.

If this doesn't work, use {{cmd|lspci -vn|}} to check whether one of the following chipsets is used in the Thinkpad:
{| border="1" cellspacing="0" cellpadding="2"
|-
!PCI ID
!Name
|-
|8086:7111
|Intel 82371AB/EB/MB PIIX4 IDE
|-
|8086:24db
|Intel 82801EB/ER (ICH5/ICH5R) IDE Controller
|-
|8086:25a2
|Intel 6300ESB PATA Storage Controller
|}
If yes, enable support for these chipsets has to be enabled by setting
#define ATA_ENABLE_PATA
in {{path|include/linux/libata.h}} (and report your ThinkPad model in the discussion page).

There have been reports that DVD burning doesn't work under this configuration, but it seems to work with kernel 2.6.14 and later (tested on a ThinkPad {{T43}} and {{T43p}} with a [[UltraBay Slim DVD Multi-Burner Plus]]).

===Links===
* RedHat Bugzilla [https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163418 bug 163418: "can't enable DMA on DVD drive"]

==No DMA on system hard disk==

In some Linux kernels, both the SATA driver and the IDE driver can handle the system hard disk. With the SATA driver, it shows as {{path|/dev/sda}} and DMA is enabled. With the IDE driver, it shows as {{path|/dev/hda}} and DMA is disabled.

The simplest way to enable DMA is to force the IDE driver to ignore the system hard disk by passing the {{bootparm|hda|noprobe}} kernel argument. The driver will then be handled by the SATA driver. Note that this will change its device name to {{path|/dev/sda}} (which may require changes in {{path|/etc/fstab}} and the boot loader) and may cause other problems as listed above.

(Observed on a ThinkPad T43 with Fedora Core kernel 2.6.13-1.1526_FC4.)

==No SMART support==

Prior to kernel 2.6.15, the Linux SATA system did not support SMART commands (e.g., via smartctl).

The necessary capability is "libata pass-through", which was incorporated into Linux 2.6.15-rc1 and later. A patch is available for older kernels:
* Kernel 2.6.12: http://rtr.ca/dell_i9300/kernel/kernel-2.6.12/03_libata_passthru.patch
* Kernel 2.6.13: http://rtr.ca/dell_i9300/kernel/kernel-2.6.13/02_libata_passthru.patch
* Kernel 2.6.14: http://www.foo.fh-furtwangen.de/~koenigr/02_libata_passthru.fixed.again.patch
* Kernel 2.6.14 with the above suspend-to-RAM patch: http://linux.spiney.org/system/files?file=02_libata_passthru.fixed.patch

After applying the patch, run smartctl with the "-d ata" parameter:
:{{cmdroot|smartctl -d ata -a /dev/sda}}

==No disk power management==

Prior to kernel 2.6.15, the Linux SATA system did not support power management commands on these models.

The above patches for SMART support resolves this, and in particular enables the following commands:
* {{cmdroot|hdparm -y}} (spin down)
* {{cmdroot|hdparm -S num}} (automatic spin down timeout)
* {{cmdroot|hdparm -B num}} (advanced power management level)
Note that this command is still rejected:
* {{cmdroot|hdparm -M num}} (acoustic management)
(Tested with patched kernels 2.6.13.1 and 2.6.12-4 and a 60GB 7200RPM disk model HTS726060M9AT00.)

Note that even when [[Laptop-mode]] is used, the "hddtemp" daemon (as shipped with Fedora Core 4) will wake up the disk every minute, and must thus be disabled for power management to be effective. Its accesses are not visibile through the {{path|/proc/sys/vm/block_dump}} facility. It is unclear whether disk temperature can be monitored without causing the disk to spin up (on the {{T43}}, none of the {{path|/proc/acpi/ibm/thermal}} values corresponds to the disk's built-in temperature sensor).

==No disk information==

Prior to kernel 2.6.15, on these models the disk information could not be read by the standard commands such as:
*{{cmdroot|hdparm -i /dev/sda}}
*{{cmdroot|hdparm -I /dev/sda}}
The latter is fixed by the above patch for SMART support.

==No swapping of UltraBay device==

The <tt>libata</tt> driver does not yet support hot-swapping (or warm-swapping) of PATA devices. If you use a DVD or 2nd PATA HDD via the <tt>libata</tt> (SATA) driver, to swap them in or out you must power down the machine.

If you use the <tt>ide</tt> driver for a PATA UltraBay device, hot-swapping might work using <tt>hdparm</tt>, <tt>idectl</tt> or <tt>hotswap</tt> (please report). However, DMA will be disabled on these models (see above).

If you use a SATA device in the UltraBay, <tt>libata</tt> hot-swapping might work (please report).

Swapping of the [[UltraBay Slim Battery]] does work.

==BIOS error 2010 on user-installed hard disk==

While not a Linux issue, note that there is an issue with installing alternative PATA (IDE) hard disks as the system drive. Unless the disk is one of the few approved disks listed inside the BIOS, you will get an BIOS error 2010 during system boot, and the disk may operate unreliably. See [[Problem with non-ThinkPad hard disks]].

How to enable integrated fingerprint reader with BioAPI

2006-01-07T01:08:28Z

Keegan: /* Installing the driver */ reorganized, improved permissions with usergroups, mentioned udev creating /dev/bus/usb

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the [[Integrated Fingerprint Reader|integrated fingerprint reader]] to work under Linux. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 9.3, SuSE 10, and {{Gentoo}}.
|}

==Basic installation==
===Installing the bioapi framework===
====Automated installation script====
The [[Script for enabling the fingerprint reader]] automates the installation of most components (bioapi framework, driver, pam_bioapi, pam setup, device permissions, pamtester and enrolling), for some Linux distributions.

====Binary packages====
=====Debian=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for {{Ubuntu}} Breezy/Dapper too, so save yourself some trouble and grab it.
=====Gentoo=====
You can either grab the [http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2 ebuild], or use the source-install procedure below.

Also see [http://toe.ch/~tsa/ibm-fingerprint/ http://toe.ch/~tsa/ibm-fingerprint/] for alternative documentation on installing on Gentoo including ebuilds for all the packages used.

====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-latest.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-latest.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:When installing the driver (below), tell it the new install path: {{cmdroot|sh install.sh /opt/bioapi/lib}}

===Installing and configuring the driver===
====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from the [http://www.upek.com/support/dl_linux_bsp.asp UPEK support site] and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If you're running Gentoo, use
:{{cmdroot|sh install.sh /usr/lib}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
====Configuring permissions for non-root use====
If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), you may need to do all or at least some of the things in this section. More details on what is necessary on which distributions would be greately appreciated.
*Create two groups, one for access to BioAPI files and the other for access to the usb files. (This is done for full generality; i.e., you may have other USB devices which you want accessable to other users, without exposing your BioAPI configuration to them). Add your normal user (the one you wish to use PAM-aware applications with) to both of these groups. On Debian this is done with
:{{cmdroot|addgroup --system bioapi}}
:{{cmdroot|addgroup --system usbfs}}
:{{cmdroot|adduser yournormaluser bioapi}}
:{{cmdroot|adduser yournormaluser usbfs}}
:(where {{cmd|yournormaluser|}} is your normal user name). You will need to log out and log back in for this to take effect.
*Set permissions on the BioAPI config/registry directory:
:{{cmdroot|chown -R root:bioapi /usr/local/var/bioapi/}}
:{{cmdroot|chmod -R 770 /usr/local/var/bioapi/}}
:(change this path if you used an alternate BioAPI install directory above)
*Set permissions on the files in {{path|/proc/bus/usb}}:
:{{cmdroot|chown -R root:usbfs /proc/bus/usb}}
:{{cmdroot|chmod -R g+X /proc/bus/usb}}
:{{cmdroot|chown root:usbfs /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:{{cmdroot|chmod 660 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro. It might be necessary to put these lines into a script which is run at startup and resume from suspend/hibernate.
*As an alternative to the {{cmd|chown|}}/{{cmd|chmod|}} commands above, you can set mount options for usbfs with a line in {{path|/etc/fstab|}}; an example would be
none /proc/bus/usb usbfs defaults,devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660 0 0
:where 108 is replaced with the numerical group ID of the usbfs group (you can determine this with something like {{cmd|cat /etc/group <nowiki>|</nowiki> grep usbfs <nowiki>|</nowiki> cut -d':' -f 3|}}). Make sure you only have one {{path|/proc/bus/usb}} entry in {{path|/etc/fstab}}. See the {{cmd|mount(8)|}} manpage for more information on these options. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*You may also have files in {{path|/dev/bus/usb}}, which the driver will try before {{path|/proc/bus/usb}}. If this is another usbfs mount point ({{cmd|mount|}} shows a line containing {{cmdresult|/dev/bus/usb type usbfs}}), then simply follow the above instructions with {{path|/dev/bus/usb}} rather than {{path|/proc/bus/usb}}. Otherwise, you may be running a new kernel (i.e. 2.6.15) that makes usbfs-like files available through {{path|/dev/bus/usb}}. On systems running udev these files are dynamically created; you can configure their permissions by editing a udev config file. On Debian this is done by changing the <tt>usb_device</tt> line of {{path|/etc/udev/permissions.rules}} to read
SUBSYSTEM=="usb_device", MODE="0660", GROUP="usbfs"
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chown root:bioapi /var/log/BSP.log && chmod 660 /var/log/BSP.log}}
====Miscellaneous configuration====
* To increase the security level (minimize false accept rate), set this in {{path|/etc/tfmessbsp.cfg}}:
security-level="5"

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-latest.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-latest.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_unix.so

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-30T19:07:37Z

Keegan: /* Installing the driver */ clarified /dev/bus/usb vs /proc/bus/usb

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the [[Integrated Fingerprint Reader|integrated fingerprint reader]] to work under Linux. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic installation==
===Installing the bioapi framework===
====Binary packages====
=====Debian=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
====Automated installation script====
The [[Script for enabling the fingerprint reader]] automates the installation of most components (bioapi framework, driver, pam_bioapi, pam setup, device permissions, pamtester and enrolling), for some Linux distributions.

====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:When installing the driver (below), tell it the new install path: {{cmdroot|sh install.sh /opt/bioapi/lib}}

===Installing the driver===
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:Some (older?) distros mount usbfs at {{path|/dev/bus/usb}} instead or additionally; in this case, modify these instructions accordingly.
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
* To increase the security level (minimize false accept rate), set this in {{path|/etc/tfmessbsp.cfg}}:
:<tt>security-level="5"</tt>
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

Integrated Fingerprint Reader

2005-12-27T02:36:53Z

Keegan: /* Related Links */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:fingerprintreader.jpg|IBM Integrated Fingerprint Reader]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Integrated Fingerprint Reader===
IBM released a second generation of T42 models in autumn 2004 featuring Intel Pentium M 765 processors and an integrated fingerprint reader.

The fingerprint reader is produced by a company called UPEK, which is specialized to fingerprint readers.

It seems to be integrated as a USB device.

Furthermore, IBM states that there's an interface with the [[Embedded Security Subsystem]].
</div>
|}

==Linux Support==
A closed source driver from the vendor has been released. It interfaces to the hardware as a user-space USB driver through {{path|/proc/bus/usb|}} and provides a BioAPI 1.10 device, which can then be interfaced to pam for authentication by user programs. The driver can be downloaded from http://www.upek.com/support/dl_linux_bsp.asp; see the [[How to enable the fingerprint reader|according HOWTO]] for detailed instructions.

==Related Links==
* [http://www.upek.com/customers/ct_notebook_ibm.asp UPEK customer report about the deal with IBM]
* [http://www.trustedreviews.com/article.aspx?page=1643&head=36 Review from TrustedReviews of the fingerprint scanner]
* [http://biomark.org.ru/en/ A (Russian) project that provides support for a (different model) of fingerprint scanner] (also a USB device, though)
* [http://linuxbiometrics.com/modules/newbb/viewtopic.php?topic_id=8&forum=1 Discussion of the T42/T42p fingerprint scanner on the Linux Biometrics site]
* [http://linuxbiometrics.com/modules/news/article.php?storyid=16 UPEK announcement (planned, closed-source) support for BioAPI on Linux] The first release was scheduled for September 2005; the final driver came out in December 2005.

==Models featuring this Technology==
*ThinkPad {{T42}}, {{T42p}}, {{T43}}, {{T43p}}
*ThinkPad {{X41}}, {{X41T}}
*ThinkPad {{Z60m}}, {{Z60t}}

[[Category:Glossary]]

Integrated Fingerprint Reader

2005-12-27T02:35:01Z

Keegan: reflecting release of final UPEK driver

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:fingerprintreader.jpg|IBM Integrated Fingerprint Reader]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Integrated Fingerprint Reader===
IBM released a second generation of T42 models in autumn 2004 featuring Intel Pentium M 765 processors and an integrated fingerprint reader.

The fingerprint reader is produced by a company called UPEK, which is specialized to fingerprint readers.

It seems to be integrated as a USB device.

Furthermore, IBM states that there's an interface with the [[Embedded Security Subsystem]].
</div>
|}

==Linux Support==
A closed source driver from the vendor has been released. It interfaces to the hardware as a user-space USB driver through {{path|/proc/bus/usb|}} and provides a BioAPI 1.10 device, which can then be interfaced to pam for authentication by user programs. The driver can be downloaded from http://www.upek.com/support/dl_linux_bsp.asp; see the [[How to enable the fingerprint reader|according HOWTO]] for detailed instructions.

==Related Links==
* [http://www.upek.com/customers/ct_notebook_ibm.asp UPEK customer report about the deal with IBM]
* [http://www.trustedreviews.com/article.aspx?page=1643&head=36 Review from TrustedReviews of the fingerprint scanner]
* [http://biomark.org.ru/en/ A (Russian) project that provides support for a (different model) of fingerprint scanner] (also a USB device, though)
* [http://linuxbiometrics.com/modules/newbb/viewtopic.php?topic_id=8&forum=1 Discussion of the T42/T42p fingerprint scanner on the Linux Biometrics site]
* [http://linuxbiometrics.com/modules/news/article.php?storyid=16 UPEK announcement (planned, closed-source) support for BioAPI on Linux] The first release is currently scheduled for September 2005.

==Models featuring this Technology==
*ThinkPad {{T42}}, {{T42p}}, {{T43}}, {{T43p}}
*ThinkPad {{X41}}, {{X41T}}
*ThinkPad {{Z60m}}, {{Z60t}}

[[Category:Glossary]]

How to enable integrated fingerprint reader with BioAPI

2005-12-24T14:37:10Z

Keegan: reorganized headings for clarity

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic installation==
===Installing the bioapi framework===
====Binary packages====
=====Debian=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:Edit the install path in {{path|install.sh}} of the driver (see below).

===Installing the driver===
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T14:30:00Z

Keegan: /* Testing the driver */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:Edit the install path in {{path|install.sh}} of the driver (see below).

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:26:14Z

Keegan: /* Configuring pam */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:08:20Z

Keegan: /* Qt Compilation Success */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

--

I didn't get it to work anyway, but I'm curious about your Qt version(s) as it seemed to want Qt 3 when I was playing with it.

--[[User:Keegan|keegan]] 05:07, 24 Dec 2005 (CET)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I've updated the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:Keegan|keegan]] 05:06, 24 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:07:58Z

Keegan: /* Qt Compilation Success */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

I didn't get it to work anyway, but I'm curious about your Qt version(s) as it seemed to want Qt 3 when I was playing with it.

--[[User:Keegan|Keegan]] 05:07, 24 Dec 2005 (CET)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I've updated the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:Keegan|keegan]] 05:06, 24 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:06:51Z

Keegan: /* Driver Expiring!!! */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I've updated the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:Keegan|keegan]] 05:06, 24 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:06:29Z

Keegan: /* Driver Expiring!!! */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I've updated the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:Keegan|Keegan]] 05:06, 24 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:03:12Z

Keegan: /* Troubleshooting and Hints */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If you use kdm, there is no pop up.

In xdm, enter your username and a blank password, then swipe (there is no popup).

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:02:11Z

Keegan: /* Troubleshooting and Hints */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If you use kdm, there is no pop up.

In xdm, enter your username and a blank password, then swipe (there is no popup).

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T04:01:27Z

Keegan: /* Troubleshooting and Hints */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If you use kdm, there is no pop up.

In xdm, enter your username and a blank password, then swipe (there is no popup).

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:58:47Z

Keegan: /* Configuring pam */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If you use kdm, there is no pop up.

In xdm, enter your username and a blank password, then swipe (there is no popup).

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:51:01Z

Keegan: /* Installing pam_bioapi */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, You may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If You see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should works.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If You use kdm, there is no pop up.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:50:07Z

Keegan: /* Installing pam_bioapi */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, You may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If You see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should works.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If You use kdm, there is no pop up.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:38:47Z

Keegan: /* Installing the driver */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you use your own login username as the username to enroll here

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as the Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
{{NOTE|If encountering 'rpl_malloc' symbol, remove the related term in the makefile. (FC3)}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, You may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If You see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should works.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

If You use kdm, there is no pop up.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:22:47Z

Keegan: /* Driver Expiring!!! */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I'm going to update the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:keegan|keegan]]

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:20:02Z

Keegan: /* using absolute paths for commands */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-24T03:18:20Z

Keegan: /* Permission errors exclusive to xscreensaver */

==Changing the installation path==
By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
* Create a dedicated directory,say, {{path|/opt/bioapi}} .
* Append <tt>--prefix=/opt/bioapi</tt> to the <tt>./configure</tt> command of bioapi
* Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>
* Edit the install path in {{path|install.sh}} of the driver

--[[User:Thinker|Thinker]] 18:06, 30 Oct 2005 (CET)
----

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

Talk:How to enable integrated fingerprint reader with BioAPI

2005-12-23T08:12:54Z

Keegan: