ThinkWiki - User contributions [en]

How to enable integrated fingerprint reader with BioAPI

2006-07-12T10:11:58Z

Nax: nax.hn.org -> www.nax.cz

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the [[Integrated Fingerprint Reader|integrated fingerprint reader]] to work under Linux. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4 and 5, RHEL4, SuSE 9.3, SuSE 10, and {{Gentoo}}.
|}

==Basic installation==
===Installing the bioapi framework===
====Automated installation script====
The [[Script for enabling the fingerprint reader]] automates the installation of most components (bioapi framework, driver, pam_bioapi, pam setup, device permissions, pamtester and enrolling), for some Linux distributions.

====Binary packages====

Note that these packages only take care of this one section. If you can use one, you should do so and then proceed to the section entitled, Installing and Configuring the Driver.

=====Debian/ Ubuntu Dapper=====
*If you're using {{Debian}} Sid (the unstable branch) or {{Ubuntu}} Dapper Drake 6.06 LTS you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.

{{HINT|Ignore the warning about not finding ''/usr/lib/libqtpwbsp.so'', it's not fatal.}}

=====Gentoo=====
You can either grab the [http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2 ebuild], or use the source-install procedure below.

Also see [http://toe.ch/~tsa/ibm-fingerprint/ http://toe.ch/~tsa/ibm-fingerprint/] for alternative documentation on installing on Gentoo including ebuilds for all the packages used.
=====Fedora Core=====
RPM packages for Fedora Core and installation instructions are available [[Installing Fedora Core 5 on a ThinkPad X41 Tablet#Fingerprint_Reader|here]]

====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-latest.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-latest.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
*Bioapi (at least version 1.2.2) doesn't compile with GCC4. You need to patch it:
*This is neccessary to compile on SUSE 10.1 which it using gcc version 4.1.0.
:{{cmduser|wget http://upir.cz/linux/patches/bioapi-1.2.2-gcc4.patch}}
:{{cmduser|patch -p1 < bioapi-1.2.2-gcc4.patch}}
*Patch for gcc 4.1 is available here - http://cvs.pld-linux.org/cgi-bin/cvsweb/SOURCES/bioapi-c++.patch?rev=1.3
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:When installing the driver (below), tell it the new install path: {{cmdroot|sh install.sh /opt/bioapi/lib}}

====Adjusting ldconfigs library search path====
At least on {{Fedora}} or {{Aurox}} 11, you may need to add {{path|/usr/local/lib}} to the library path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. The usual way to do this is adding it to the ldconfig configuration:
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
Alternatively you can add it to the LD_LIBRARY variable.

If you see bioapi libs in the output of
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

===Installing and configuring the driver===
====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from the [http://www.upek.com/support/dl_linux_bsp.asp UPEK support site] and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If you're running Gentoo or Ubuntu Dapper, use
:{{cmdroot|sh install.sh /usr/lib}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
:May there still occures and error, which means mod_install: command not found.
:Then login as root - not su!
:Do this:
:{{cmdroot|sh install.sh}}
:again. It should work. SU to root does not work since then the /usr/local/bin directory is not used per default.

====Configuring permissions for non-root use====
If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), you may need to do all or at least some of the things in this section. More details on what is necessary on which distributions would be greately appreciated.
*Create two groups, one for access to BioAPI files and the other for access to the usb files. (This is done for full generality; i.e., you may have other USB devices which you want accessable to other users, without exposing your BioAPI configuration to them). Add your normal user (the one you wish to use PAM-aware applications with) to both of these groups.
On {{Debian}} this is done with
:{{cmdroot|addgroup --system bioapi}}
:{{cmdroot|addgroup --system usbfs}}
:{{cmdroot|adduser yournormaluser bioapi}}
:{{cmdroot|adduser yournormaluser usbfs}}
On {{SUSE}} this is done with
:{{cmdroot|groupadd --system bioapi}}
:{{cmdroot|groupadd --system usbfs}}
:{{cmdroot|groupmod -A yournormaluser bioapi}}
:{{cmdroot|groupmod -A yournormaluser usbfs}}
On {{Mandriva}} this is done with
:{{cmdroot|groupadd -r bioapi}}
:{{cmdroot|groupadd -r usbfs}}
:{{cmdroot|usermod -G bioapi,usbfs yournormaluser}}

:(where {{cmd|yournormaluser|}} is your normal user name). You will need to log out and log back in for this to take effect.
*Set permissions on the BioAPI config/registry directory:
:{{cmdroot|chown -R root:bioapi /usr/local/var/bioapi/}}
:{{cmdroot|chmod -R 770 /usr/local/var/bioapi/}}
:(change this path if you used an alternate BioAPI install directory above)
*Set permissions on the files in {{path|/proc/bus/usb}}:
:{{cmdroot|chown -R root:usbfs /proc/bus/usb}}
:{{cmdroot|chmod -R g+X /proc/bus/usb}}
:{{cmdroot|chown root:usbfs /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:{{cmdroot|chmod 660 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro. It might be necessary to put these lines into a script which is run at startup and resume from suspend/hibernate.
*As an alternative to the {{cmd|chown|}}/{{cmd|chmod|}} commands above, you can set mount options for usbfs with a line in {{path|/etc/fstab|}}; an example would be
none /proc/bus/usb usbfs defaults,devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660 0 0
:where 108 is replaced with the numerical group ID of the usbfs group (you can determine this with something like {{cmd|cat /etc/group <nowiki>|</nowiki> grep usbfs <nowiki>|</nowiki> cut -d':' -f 3|}}). Make sure you only have one {{path|/proc/bus/usb}} entry in {{path|/etc/fstab}}. See the {{cmd|mount(8)|}} manpage for more information on these options. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*You may also have files in {{path|/dev/bus/usb}}, which the driver will try before {{path|/proc/bus/usb}}. If this is another usbfs mount point ({{cmd|mount|}} shows a line containing {{cmdresult|/dev/bus/usb type usbfs}}), then simply follow the above instructions with {{path|/dev/bus/usb}} rather than {{path|/proc/bus/usb}}. Otherwise, you may be running a new kernel (i.e. 2.6.15) that makes usbfs-like files available through {{path|/dev/bus/usb}}.
*On systems running udev these files are dynamically created; you can configure their permissions by editing a udev config file. On Debian this is done by changing the <tt>usb_device</tt> line of {{path|/etc/udev/permissions.rules}} to read
SUBSYSTEM=="usb_device", MODE="0660", GROUP="usbfs"
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chown root:bioapi /var/log/BSP.log && chmod 660 /var/log/BSP.log}}

====Miscellaneous configuration====
* To increase the security level (minimize false accept rate), set this in {{path|/etc/tfmessbsp.cfg}}:
security-level="5"
{{WARN|Please see discussion section Security Level!}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-latest.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-latest.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*If you get 'configure: error: cannot find required header: security/_pam_macros.h' and are on a Debian-like system, do "apt-get install libpam0g-dev" and try again. If you are using a Mandriva distribution, do "urpmi libpam0-devel" instead.
*If you get 'PAM [dlerror: /lib/security/pam_bioapi.so: undefined symbol: BioAPIMemoryFuncs]' error in your syslog, replace 'LIBS = ' line in {{path|libpam_bioapi/makefile}} with the following (of course, replace {{path|/opt/bioapi/}} with the path where you installed bioapi):
LIBS = -L/opt/bioapi/lib -lbioapi100 -lbioapi_mds300 -lmds_util
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or {{SUSE}} you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
For '''Gentoo'''-Users - this allows you to attempt a password first. If you simply press enter, it then prompts for a fingerprints. Create a file named {{path|/etc/pam.d/bioapi}}. This also means that remote services, such as SSH keep working:

auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_deny.so

account required pam_unix.so

session required pam_limits.so
session required pam_unix.so

----

Now, simply replace "auth include system-auth" in all services that you wish to use fingerprint for with "auth include bioapi". For example, {{path|/etc/pam.d/kde}} by default contains

auth include system-auth
auth required pam_nologin.so

account include system-auth

password include system-auth

session include system-auth

Simply replace the first "system-auth" with bioapi and you can also get rid of KDE desktop lock with a fingerprint. If you do not wish to allow for "password fallback" then remove

auth sufficient pam_unix.so likeauth nullok

from {{path|/etc/pam.d/bioapi}}.

{{WARN|If su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings... }}
{{WARN|Not only SuSE 10 requires root.bir to be available for su to work. Just make sure you have root.bir when su is not working with your fingerprint reader but other applications are...}}
Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

In {{Fedora}} the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

{{HINT|The setup described above will/could affect remote ssh logins to also use biometric logins, which is a bit silly (who wants to remote ssh to the laptop, and then have to walk over to it and swipe your finger) To avoid that you can copy the default <tt>/etc/pam.d/system-auth</tt> to <tt>/etc/pam.d/sshd</tt> which will allow the sshd service to use the standard authentication procedure.}}

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

===Application support===
The implementation of fingerprint scanning support in the relevant applications varies.

Here is the behaviour of the most common ones:
* In gdm enter your username and there should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.
* kdm doesn't give any visual indication, other than that the cursor stops blinking. Just swipe your finger and hope it lets you log in.
* In xdm, enter your username and a blank password, then swipe (there is no popup as well).
* The KDE screen saver in SUSE 10 requires you to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt.
* For Fedora users, the redhat-config tools will crash if no root.bir presents. Also, there won't be any visual idication unless X server is properly configured for root to access. Just swipe your finger when the HDD stopped blinking or issue the following command in advance:
:{{cmduser|xhost +local:}}
* For RHEL4 users gdm, console (virtual terminal) logins and the xscreensaver all work

===kdm support===
To add graphical popup to kdm, you need following:
* Patch for pam_bioapi. This patch adds third parameter to {{path|pam_bioapi.so}} module, which is a name of file with additional environment variables that will be supplied to the UPEK driver.
:{{cmdroot|wget http://upir.cz/linux/patches/pam_bioapi-0.2.1-alter-environ.patch}}
:{{cmdroot|patch -p1 < pam_bioapi-0.2.1-alter-environ.patch}}
* Edit your {{path|Xsetup}} file (on SUSE 10 it's {{path|/etc/X11/xdm/Xsetup}}) and add these lines:
echo "XAUTHORITY=$XAUTHORITY" > /var/lib/xdm/kdm_env
echo "DISPLAY=$DISPLAY" >> /var/lib/xdm/kdm_env
* In {{path|/etc/pam.d/xdm}} file, add {{path|/var/lib/xdm/kdm_env}} as a third parameter for {{path|pam_bioapi.so}} module:
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/ /var/lib/xdm/kdm_env

Please note, that this won't work if you have more than one Xserver.

==Make xscreensaver use the scanner==
If you are using Gentoo, you can get a portage overlay with the necessary patches here: http://www.zzamboni.org/brt/files/xscreensaver-fingerprint-overlay.tar.gz
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://www.nax.cz/pub/bioapi/2005/xscreensaver/xscreensaver-4.22_alternativeAuth.diff mirror: http://zepan.org/files/xscreensaver-4.22_alternativeAuth.diff For xscreensaver 5.00, you can get a patch here: http://www.zzamboni.org/brt/files/xscreensaver-5.00-alternativeauth.patch}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you receive an error like "Couldn't find X11 headers/libs" and are running a Debian-like system, try "apt-get install xlibs-dev"
*If you receive an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
*In case it doesn't, try adjusting your PATH.

Talk:How to enable integrated fingerprint reader with BioAPI

2006-07-09T21:59:47Z

Nax: /* GNOME Screensaver support */

== chmod 777 -R /usr/local/var/bioapi/ ==

Is the above necessary? I just made a debian package of xscreensaver with the patch applied, and when using the bioapi debian pacakge from [http://www.qrivy.net/~michael/temp/ Michael R. Crusoe's site] which has this directory put in /usr/var/bioapi I had not to change the permissions to world-writeable there. Write access to the logfile and usb device are necessary, but that directory works with 755 as well (even though it comes with 777 in Michael's package), and all files and subdirectories are 644/755 too.

--[[User:Spiney|spiney]] 00:08, 11 Nov 2005 (CET)
----

== Qt Compilation Success ==

Here it worked with qt ;)

--

I didn't get it to work anyway, but I'm curious about your Qt version(s) as it seemed to want Qt 3 when I was playing with it.

--[[User:Keegan|keegan]] 05:07, 24 Dec 2005 (CET)

== using absolute paths for commands ==

I don't know whether using absolute paths in the articles is a good idea, at least not for tools like {{cmd|lsusb|}} which are not established utilities (i.e. used for more than a decade or something ;)) and happen to be in different locations in different distributions. E.g. said {{cmd|lsusb|}} resides in {{path|/usr/sbin|}} on Debian systems.

--[[User:Spiney|spiney]] 16:45, 12 Nov 2005 (CET)
----

I'm using debian testing and it's in {{path|/usr/bin|}}. I agree that the confusion is bad; dropping the absolute paths and adding a general note about checking {{cmd|$PATH|}} in case of problems is probably good.

--[[User:keegan|keegan]]

== BioAPI error #3 ==

Its kind of strage it used to work with everythig (kdm,console,lock,etc)
Now it only works with kdm. It allways gives back:

pam_bioapi[8113]: Unable to initialize Bioapi framework, BioAPI error #:3.

Even when I set the right permissions on /proc/bus/usb.

I am able to run the Sample program as normal user after setting the permissions, but when I change within a user session by su I amnot able to run the Sample program a also get an error Code #3.

From an other terminal (alt+strg+Fx) I am able to run the Sample program but at the login I still get the error #3.

I cant remember to have changed anything an d bevor I was able to login in a console with my fingerprint now only kdm is working even kde lock-session
isnt working anymore.

Any suggestions ?

==Permission errors exclusive to xscreensaver==

I followed the instructions above and got everything working, including non-root programs like xscreensaver. However, the script to change usbfs permissions is finicky and fails to work with a lot of things like suspend/resume. Therefore, I switched to specifying <tt>devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660</tt> as mount parameters for usbfs, where group 108 is a group I created and added my normal user to. This seems like a much better way of doing things, and it almost works. However, xscreensaver (using the newer patch) gives the familiar <tt>Unable to load BioAPI BSP with UUID of <nowiki>{</nowiki>5550454b-2054-464d-2f45-535320425350<nowiki>}</nowiki>, BioAPI error #194d.</tt> error in {{path|/var/log/auth.log|}}. I don't think this is a straightfoward permissions problem because
<ul>
<li>the permissions in {{path|/proc/bus/usb|}} are correct by inspection</li>
<li>I can write to the device file as my normal user</li>
<li>other programs like {{cmd|test_verify-pam_bioapi|}} and [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}] work as my normal user</li>
<li>the weirdest one: xscreensaver works when the {{cmd|xscreensaver|}} daemon is launched from within {{cmd|strace|}}. It's still running as my normal user ({{cmd|strace|}} is not setuid root). I have absolutely no idea what would cause this. I thought it might be an environment issue, but the difference in environment between the {{cmd|strace|}} session and my normal session is trivial.</li>
</ul>

At this point I'm hoping it's something dumb, but I'm out of ideas. The {{cmd|xscreensaver|}} error is <tt>pam_authenticate (...) ==> 7 (Authentication failure)</tt>, for the record.

--[[User:keegan|keegan]]
----

Could you provide all the log lines between pam_start and pam_end when running {{cmd|xscreensaver -verbose|}}?

BTW, the idea with using the mount options for usbfs is very good, maybe you should add that info to the article page? I use the permission changing script without problems, also after resume, but the usbfs version is probably easier to set up, most people will be able to find {{path|/etc/fstab|}}.

--[[User:Spiney|spiney]] 10:12, 23 Dec 2005 (CET)
----
<pre>
xscreensaver: 20:56:01: alternative_pam: 1 -> pam service: xscreensaver-alternative
xscreensaver: 20:56:01: pam_start ("xscreensaver-alternative", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:01: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:01: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:03: pam_authenticate (...) ==> 7 (Authentication failure)
xscreensaver: 20:56:03: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:03: prompting for password.
xscreensaver: 20:56:03: 0: creating password dialog.
xscreensaver: 20:56:03: 0: mouse is at 442,412.
xscreensaver: 20:56:03: grabbing server...
xscreensaver: 20:56:03: 0: ungrabbing mouse (was 0x48).
xscreensaver: 20:56:03: 0: grabbing mouse on 0xe0002b... GrabSuccess.
xscreensaver: 20:56:03: ungrabbing server.
xscreensaver: 20:56:05: alternative_pam: 12582928 -> pam service: xscreensaver
xscreensaver: 20:56:05: pam_start ("xscreensaver", "keegan", ...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_set_item (p, PAM_TTY, ":0.0") ==> 0 (Success)
xscreensaver: 20:56:05: PAM ECHO_OFF("Password: ") ==> password
xscreensaver: 20:56:05: pam_authenticate (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_acct_mgmt (...) ==> 9 (Authentication service cannot retrieve authentication info.)
xscreensaver: 20:56:05: pam_setcred (...) ==> 0 (Success)
xscreensaver: 20:56:05: pam_end (...) ==> 0 (Success)
xscreensaver: 20:56:05: password correct.
</pre>
So we've got the first attempt with {{cmd|pam_bioapi|}}, which fails immediately (no sign of the GUI fingerprint prompt, nor a "silent" chance to swipe the finger as with xdm), then the fallback to {{cmd|pam_unix|}} which succeeds. Earlier I had xscreensaver set up to only try {{cmd|pam_bioapi|}}, with essentially the same result -- it gives up on pam entirely and does unix auth itself.

I'd really like to strace the pam module and see what it's attempting to do to {{path|/proc/bus/usb|}}, but as that actually fixes the problem I'm kinda at a loss. Maybe there's some kernel option to print debugging info for usbfs? I'd be all for changing the article to suggest using mount options in {{path|/etc/fstab|}}, if it weren't for this one weird bug. Has anyone else had the same problem?

-- [[User:keegan|keegan]]

Same here, I had the whole setup workin flawlessly (I really need to get that 'never-touch-a-running-system' mantra burnt into the back of my hands), but after a fresh install of the same distro (Ubuntu) and following the same procedure to get things working i get exactly this behaviour. Login works (now even with multifinger, although there are other issues with that), I can use test_verify-pam_bioapi as a user. and the stock xscreensaver works, albeit only after entering a bogus password first.
The patched xscreensaver works when run within a strace (Now that sucks) but fails otherwise. And as i said before, I had this working...

----
<pre>
open("/dev/bus/usb", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 13
fstat64(13, {st_mode=S_IFDIR|0755, st_size=140, ...}) = 0
fcntl64(13, F_SETFD, FD_CLOEXEC) = 0
getdents64(13, /* 7 entries */, 4096) = 168
getdents64(13, /* 0 entries */, 4096) = 0
close(13) = 0
open("/dev/bus/usb/003", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 13
fstat64(13, {st_mode=S_IFDIR|0755, st_size=80, ...}) = 0
fcntl64(13, F_SETFD, FD_CLOEXEC) = 0
getdents64(13, /* 4 entries */, 4096) = 96
open("/dev/bus/usb/003/002", O_RDWR) = -1 EACCES (Permission denied)
open("/dev/bus/usb/003/002", O_RDONLY) = 14
ioctl(14, USBDEVFS_CONNECTINFO, 0xafd5bd34) = -1 EPERM (Operation not permitted)
read(14, "\22\1\0\1\0\0\0\10\203\4\26 \1\0\1\2\0\1", 18) = 18
read(14, "\t\2\'\0\1\1\0\240", 8) = 8
read(14, "2\t\4\0\0\3\377\0\0\0\7\5\201\2@\0\0\7\5\2\2@\0\0\7\5\203"..., 31) = 31
close(14) = 0
</pre>

Here is all the excitement from the strace on xscreensaver. As I originally thought, you cannot get away with just playing with the proc entries :P You also need to deal with the counterpart in /dev. We can wrap up all the permissions issues with a single UDEV rule:

<pre>
# fingerprint fun
BUS=="usb", DRIVER=="usb", SYSFS{product}=="Biometric Coprocessor", GROUP="bioapi", SYMLINK="misc/fingerprint", RUN+="/bin/sh -c 'chgrp bioapi /proc/$RESULT; chmod g+rw /proc/$RESULT'"
</pre>

I created a 'bioapi' group and configured pam to add groups to anyone logging in ''locally''. Now all you need to do is amend the pam configuraion files below. We use 'wdm', but of course its as applicable for all those resource hungry touchy-feely gdm/kdm folk out there too ;)

/etc/security/group.conf
<pre>
# local group settings
login; tty*; *; al0000-2400; audio,floppy,video,cdrom,nvram,plugdev,bioapi
wdm; :*; *; al0000-2400; audio,floppy,video,cdrom,nvram,plugdev,bioapi
</pre>

/etc/pam.d/login
<pre>
[snipped]

# group *has* to go here
auth optional pam_group.so

# fingerprint action
auth sufficient /usr/local/lib/security/pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/

# Standard Un*x authentication.
@include common-auth

# This allows certain extra groups to be granted to a user
# based on things like time of day, tty, service, and user.
# Please edit /etc/security/group.conf to fit your needs
# (Replaces the `CONSOLE_GROUPS' option in login.defs)
#auth optional pam_group.so

[snipped]
</pre>

/etc/pam.d/wdm
<pre>
#%PAM-1.0
auth required pam_nologin.so
auth required pam_env.so

# local tweak
auth optional pam_group.so

# fingerprint action
auth sufficient /usr/local/lib/security/pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/

@include common-auth
@include common-account
@include common-session
</pre>

'''N.B.''' as with all pam related things, the order is important

-- [[User:Jim diGriz|Jim diGriz]]
----

==Driver Expiring!!!==
Don't anyone notice that both betas of the UPEK driver is expiring in
about a month in the new year, Jan 1st 2006? They really mean it!
I set my computer date to next year and get a message "the driver has expired" when using fingerprint reader! This is a grave threat to our computer lifestyle, i.e. for those of us who got it working and use it
daily:)
Is there any workaround other than setting the date back a year when
new year come and wait for new driver? Is there a way to figure out where exactly in the driver it checked the date and how? The must have set it
somewhere in file libtfmessbsp.so, but it is binary and I can't figure out how to Reverse Engineer it.

---Jiang

Yes, the beta driver will expire. The final version (which is due REALLY soon now) will not.

Sumedha

Any news? Just 9 days left to expiry. --[[User:Thinker|Thinker]] 21:36, 22 Dec 2005 (CET)

The final is out, get it at [http://www.upek.com/support/dl_linux_bsp.asp UPEK's download page]. And how does one edit the industry watch section of the main page?

--[[User:Spiney|spiney]] 21:39, 22 Dec 2005 (CET)

Ah, great! Both the article page and the driver page it points to are out of date... For the news, just follow the "[[ThinkWiki:News|News]]" link in the main page.

--[[User:Thinker|Thinker]] 21:44, 22 Dec 2005 (CET)

As this is now very soon I've updated the article page to link to the final driver, which is better in a few ways anyway. This is unless anyone minds (are there any unresolved issues with the final that don't exist in the betas?).

--[[User:Keegan|keegan]] 05:06, 24 Dec 2005 (CET)

== Updated xscreensaver patch ==

I've tried to address some usability issues with the old patch, e.g. that it calls the PAM bioapi module twice before falling back to the normal authentication methods. It can be found on my [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader Fingerprint Reader] page, feedback is very welcome.

--[[User:Spiney|spiney]] 20:36, 22 Dec 2005 (CET)
----

== Fingerprint or password ==

Is there any way to have PAM accept either a password or a finger swipe, right away? Sometimes one is more convenient, sometimes the other, so and it's a lot of trouble to wait for the UPEK scanner prompt and then cancel it in order to reach the password entry.

--[[User:Thinker|Thinker]] 19:27, 24 Dec 2005 (CET)

== KDE screensaver ==

If you get the following in {{path|/var/log/secure}} when you try to unlock the KDE screensaver, it means you forgot to set the USB device permissions.
localhost pam_bioapi[24981]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error #194d.

--[[User:Thinker|Thinker]] 21:21, 24 Dec 2005 (CET)
----

== fingerprint reader in action. ==

small video with fingerprint reader in action with login: http://chao.ch/tmp/mov01302.mpg

--[[User:62.202.35.30|62.202.35.30]] 17:57, 29 Dec 2005 (CET)

==A little feedback...==
...for all the editors of this article:

"[[How to enable the fingerprint reader]] over at ThinkWiki.org is some real exhaustive documentation for getting the fingerprint scanner working on the ThinkPads. There is also a troubleshooting section towards the end that might be very useful to anyone messing around with it.

Thanks to those responsible for taking the time to write up this excellent guide."

Those thanks come from [http://linuxbiometrics.com/modules/news/ LinuxBiometrics.com]

[[User:Wyrfel|Wyrfel]] 01:24, 9 Jan 2006 (CET)
----

==pam_bioapi.so is not linked to libbioapi100.so==
I downloaded the pam_bioapi package and patched the file by following the wiki. However, I got the following result:

~/soft/thinkpad/pam_bioapi-0.2.1/libpam_bioapi/.libs$ ls -la
total 48
drwxr-xr-x 2 louis users 248 2006-01-12 01:18 ./
drwxr-xr-x 4 louis users 312 2006-01-12 01:18 ../
lrwxrwxrwx 1 louis users 16 2006-01-12 01:18 pam_bioapi.la -> ../pam_bioapi.la
-rw-r--r-- 1 louis users 824 2006-01-12 01:18 pam_bioapi.lai
-rw-r--r-- 1 louis users 19716 2006-01-12 01:18 pam_bioapi.o
lrwxrwxrwx 1 louis users 19 2006-01-12 01:18 pam_bioapi.so -> pam_bioapi.so.0.0.0*
lrwxrwxrwx 1 louis users 19 2006-01-12 01:18 pam_bioapi.so.0 -> pam_bioapi.so.0.0.0*
-rwxr-xr-x 1 louis users 21789 2006-01-12 01:18 pam_bioapi.so.0.0.0*

~/soft/thinkpad/pam_bioapi-0.2.1/libpam_bioapi/.libs$ ldd pam_bioapi.so
linux-gate.so.1 => (0xffffe000)
libc.so.6 => /lib/tls/libc.so.6 (0x40025000)
/lib/ld-linux.so.2 (0x80000000)
~/soft/thinkpad/pam_bioapi-0.2.1/libpam_bioapi/.libs$

pam_bioapi.so is NOT linked to libbioapi100.so. The latter is in the ld path:

~/soft/thinkpad/pam_bioapi-0.2.1/libpam_bioapi/.libs$ ldconfig -p |grep bioapi
libtfmessbsp.so (libc6) => /opt/bioapi/lib/libtfmessbsp.so
libpwbsp.so.0 (libc6) => /opt/bioapi/lib/libpwbsp.so.0
libpwbsp.so (libc6) => /opt/bioapi/lib/libpwbsp.so
libmds_util.so.0 (libc6) => /opt/bioapi/lib/libmds_util.so.0
libmds_util.so (libc6) => /opt/bioapi/lib/libmds_util.so
libbioapi100.so.0 (libc6) => /opt/bioapi/lib/libbioapi100.so.0
libbioapi100.so (libc6) => /opt/bioapi/lib/libbioapi100.so
libbioapi_mds300.so.0 (libc6) => /opt/bioapi/lib/libbioapi_mds300.so.0
libbioapi_mds300.so (libc6) => /opt/bioapi/lib/libbioapi_mds300.so
libbioapi_dummy100.so.0 (libc6) => /opt/bioapi/lib/libbioapi_dummy100.so.0
libbioapi_dummy100.so (libc6) => /opt/bioapi/lib/libbioapi_dummy100.so

and the Sample program also works allowing me to enroll and test a fingerprint.

My system is SuSE 10 with the kernel of 2.6.13-15. Any ideas?

Thanks.

--[[User:Tyne|Tyne]] 09:51, 12 Jan 2006 (CET)

==xscreensaver 4.23+fingerprint.patch causes xscreensaver-gl to crash kernel==

I've gotten bioapi and 'Sample' to allow me to enroll my fingerprint, and I've also experienced the 'two logon' issue.

I compiled xscreensaver 4.23 (though it seemed that apt came with 4.24) and applied the patch. My goal was to have the fingerprint prompt come up and to see the "bad image" of the fingerprint scan.

The first time I did this, xscreensaver-gl took a dump and was causing kernel crashes. So I went and got the newest xscreensaver source and patches, and applied the bioapi patch to those. It worked (meaning it didnt crash the kernel anymore ;b )

It would seem that there is a /etc/pam.d/xscreensaver, so I commented everything out of that except the bioapi line.

Locking xscreensaver, then attempting to unlock didnt show me any fingerprint requirements, and my password didnt work.

I'm wondering if theres something that was left out of the xscreensaver howto? or if theres anyone out there who's gotten the xscreensaver portion of this to work, who would be willing to help me out :)

--[[User:Viss|Viss]] 11:15am, 5 Feb 2006 (PST)

== gdm hangs on kde logout ==

Hi.

I am using a Thinkpad t43, installed with gentoo.
I run gdm as the login manager, with kde 3.4 and enlightenment dr16 as the window manager.

I followed the steps in the wiki, and the biometric scanner is now working fine, appart from the fact that when I close/end the session I just get a blank screen, in place of the gdm login screen.

Disabling the biometrics (by setting the pam.d file back to their originals), the session ends fine. I do this for a few times, and then set the biometrics back again, and it work fine for a few logouts, and then back to the blank screen again.

I can do ctrl+shift+f1 to get to a console window and from there I can issue a shutdown.
Although this works ok, it is a bit of a pain.

Any ideas ?

== 'gksudo' Doesn't show biopam finger swipe prompt... ==

Hey all,

First off... this is an excellent how-to! I have no real interest in using fingerprint scanner with xscreensaver, but it was up and working with everything else on my system pretty much effortlessly.

I'm running Ubuntu Breezy Badger 5.10 on an IBM T43p (2678) and have run into two oddities:
1) /etc/pam.d/xscreensaver - as it is initially configured, if you have an xscreensaver session set to require password (or xlock with screensaver) then you get prompted for the normal text-password entry and then will be prompted to swipe your finger... This is easily fixed by commenting out the '@include common-auth' line in /etc/pam.d/xscreensaver and adding the line 'auth required pam_unix.so nullok_secure'. After that change it only prompts for the text-password entry challenge.

2) gksudo - This is more of a pain... I can use the fingerprint scanner with gksudo, but gksudo doesn't prompt with the (ugly-but-functional) finger swipe dialog the way that gdm does during login or xscreensaver does when configured as mentioned above (pre-fix). So, if I start a Gnome app launcher that is prepended with gksudo, nothing appears to happen until I swipe my finger and then the app gets launched. That's cool and all, but there are times (esp. when multi-tasking) when I forget to swipe and then go "what happened to xxxxx? oh yeah..."

Anyway... does anyone have an idea of what I can do to get the dialog to appear?

thanx

--[[User:JELaVallee|JELaVallee]] 05:56, 20 February 2006 (CET)

The gksudo problem is a restriction from the X server. It doesn't allow to grab the display for other users than the logged-in one. And the pam_bioapi is invoked as root.

--[[User:Whoopie|Whoopie]] 13:10, 20 February 2006 (CET)

That makes sense... so, now I have to wonder, is there a patchable work-around like the xscreensaver one that could allow for this to work? Where should I research such? gksu's project or is this more an issue at the X11-level?

--[[User:JELaVallee|JELaVallee]] 19:38, 27 February 2006 (CET)

I got it working. Grab out the newer pam-bioapi from CVS (http://savannah.nongnu.org/cvs/?group=pam-bioapi). This version supports "multi-finger" when using the sqlite3 database. And it supports defining the used display.
Change your line in your /etc/pam.d/ files like this:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/bioshadow.db :0

--[[User:Whoopie|Whoopie]] 14:27, 1 March 2006 (CET)

Very cool... Did you run into any issues rebuilding/installing this? I'll give it a shot this evening... THANKS!

--[[User:JELaVallee|JELaVallee]] 21:07, 1 March 2006 (CET)

Invoke 'xhost +local:' should be able to let gksudo work. Or just blindly sweap the finger. ;)

--[[User:YChao|YChao]] 21:25, 7 March 2006 (CET)

== Multifinger ==

Wow, theres a new version of pam_bioapi which supports multifinger enrollment and user identification.
I'll break my system with that this evening :)

Yes, but I'm searching the patch for xdm. The download page from Josef Hajas (http://nax.hn.org/pub/bioapi/) is down. Does anybody have it?

Update: The patch can be found here: http://www.qrivy.net/~michael/blua/xdm_bio.patch

--[[User:Whoopie|Whoopie]] 17:43, 1 March 2006 (CET)

Tried the newest pam-bioapi from CVS (http://savannah.nongnu.org/cvs/?group=pam-bioapi) on FC3. Failed on enrolling fingerprints: ({{path|/var/log/secure|}})

<code>Mar 9 15:30:40 localhost pam_bioapi[32407]: Can't open database: library routine called out of
sequence</code>

Could anyone help?

--[[User:Ychao|Ychao]] 00:38, 10 March 2006 (CET)

I don't know how to solve it. It seems to be a problem with sqlite3. Which version do you use? Under Ubuntu Breezy, it's 3.2.1.

--[[User:Whoopie|Whoopie]] 12:27, 10 March 2006 (CET)

Did anybody tried multifinger with BioAPI? I am interested in multifinger at all, not only PAM.

Updated:

succesfully installed pam_bioapi with multifinger support, some info:

use: <code>auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/bioshadow.db :0</code> in pam.d, the bioshadow column is path to bioapi sqlite database.

if authentication doesn't work, edit /etc/syslog.conf and write line *.alert /var/log/syslog, so you see pam_bioapi messages in /var/log/syslog
most common error is missing biodata table, newest pam_bioapi version should create it automatically, but if it doesn't, go to /etc/bioapi/pam/ and run command <code>sqlite3 bioshadow.db</code>, then insert this:

<code>CREATE TABLE biodata (id INTEGER PRIMARY KEY,uid INTEGER,uuid TEXT,header BLOB,data BLOB,signature BLOB,type INTEGER,other BLOB);</code>

you must then enroll at least one fingerprint to the database, do it using test_enroll-pam_bioapi from pam_bioapi distribution. note that you must have root user enrolled in order to use <code>su</code> command.

--[[User:MeBa|MeBa]] 16:58, 22 March 2006 (CET)

== GNOME Screensaver support ==

Did anybody try to port the xscreensaver patch to gnome-screensaver? Since Ubuntu Dapper will be shiped with it, it would be nice to have it working then with the fingerprint reader.

Update: Initial support can be found in gnome-screensaver CVS. See [http://bugzilla.gnome.org/show_bug.cgi?id=338635 bugreport].

--[[User:Whoopie|Whoopie]] 12:36, 16 March 2006 (CET)

I'm just working on changes in pam_bioapi which makes gui callbacks from gnome-screensaver possible. But first I have to debug BioAPI error #194d after hibernation because gnome-screensaver is one of the applications returning this error.

--[[User:Nax|nax]] 23:59, 9 July 2006 (CEST)

== No sources for bioapi 1.2.3 ==

There doesn't seem to be any sources available for the recommended Debian package bioapi-1.2.3. That's rather distressing since this is security-related software. A google search doesn't seem to be turning up anything, either. Anybody have a lead on where to find sources?

--[[User:TedTso|TedTso]] 7:47, 29 Apri 2006 (EDT)

== Strange issue on GDM login ==

I successfully have the fingerprint reader running. Everything is working nicely, except when I try to login with GDM for the first time. The login seems to work fine (the PAM_BIOAPI seems to return true) but GDM hangs then. This issue does not occur when I already logged in using password and logged out again or if I kill GDM when it hangs after the first attempt. Anyone an idea on this?

--[[User:Dotxp|dotxp]] 22:54, 2 May 2006 (CEST)

== Don't ask for finger scan when lid closed ==

When using an external CRT+keyboard+mouse with the LD lid closed, it's quiet annoying to have to reach over and open the lid in order to do a finger scan.
Any idea how to make PAM use the fingerprint reader when the lid is open, but skip it when the lid is closed?

--[[User:Thinker|Thinker]] 13:30, 7 May 2006 (CEST)

I edited my /etc/gdm/Init/Default script in a way, that it changes /etc/pam.d/common-auth depending on the lid state: When the lid is closed, the file is replaced by a version without the lines for the finterprint reader, and of course the opposite action when the lid is open.

--[[User:Aerials|Aerials]] 15:52, 9 July 2006 (CEST)
----

== Unable to initialize Bioapi framework, BioAPI error #:3 ==

I see some other discussion on this page about the dreaded "Unable to initialize Bioapi framework, BioAPI error #:3" error, but the only solution i can see seems really complicated -- adding users to groups when they log in, etc. Is that really the simplest way to make xscreensaver work? I'm the only user of my laptop -- the only account who will ever log in, the only fingerprint in the database, the only person who will ever run xscreensaver. Is there some quick easy way to make xscreensaver unlock when i swipe my finger?

-- [[User:Mike Schiraldi|Mike Schiraldi]] 19:52, 16 May 2006 (CEST)

== Security level ==

[http://www.upek.com/support/pdf/BioAPI_PerfectMatchBSP1.7.pdf UPEK PerfectMatch Algorithm]
According to this link, highest security level is 0 which is opposite to 5 mentioned in the article. What is correct?

Update: Well,TFMESS_BSP_LIN.pdf, i downloaded somewhere stated 5 as highest security level. So, ?