How to enable the integrated fingerprint reader with ThinkFinger

2007-03-31T10:57:21Z

Pvajko: /* Configuring PAM to use ThinkFinger */

[[How to enable the fingerprint reader]] has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called [http://thinkfinger.sourceforge.net ThinkFinger] which does the same, but open.

== Installing from source ==
Speaking for Debian, there are no packages of ThinkFinger in the repositories yet (cf. [http://bugs.debian.org/409563 bug #409563]), so I describe the installation from source. If you're on Gentoo, you can find an ebuild at [https://bugs.gentoo.org/show_bug.cgi?id=162297 bug 162297].

{{NOTE|packages for Debian (testing) are available here: [http://www.rubixlinux.org/debian/thinkfinger/]}}
{{NOTE|packages for Fedora Core 6 are available in "extras" repository (#yum install thinkfinger)}}

Download thinkfinger-0.2.2.tar.gz from the [http://thinkfinger.sourceforge.net/ homepage] and unpack it somewhere, make sure you have libusb-dev and libpam0g-dev installed, then:

{{cmduser|cd thinkfinger-0.2.2}}

<code style="white-space:nowrap;color:#495988;background-color:white;"><nowiki>$</nowiki> ./configure --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger</code>

{{cmduser|make}}

{{cmdroot|make install}}

{{NOTE|/lib/security is the dir, where pam assumes its modules on Debian, it may vary for your distro!}}

If everything went ok assert that you find pam_thinkfinger.so in /lib/security typing:

{{cmduser|ls /lib/security}}

== Testing the driver ==
Now the driver is installed and should be working. You can try it with

{{cmdroot|tf-tool --acquire}}

and

{{cmdroot|tf-tool --verify}}

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

== Configuring PAM to use ThinkFinger ==
Now you can configure pam to use ThinkFinger:

Open /etc/pam.d/common-auth:
{{NOTE|In FC6 this file is "/etc/pam.d/system-auth"}}

{{cmdroot|nano -w /etc/pam.d/common-auth}}

Add this line before any pam_unix or pam_unix2 directives:
auth sufficient pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in
the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.
auth required pam_unix.so try_first_pass

For instance my /etc/pam.d/common-auth looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

Now we are ready to add users to thinkfinger. As make install did not create /etc/pam_thinkfinger, we need to create it now:

{{cmdroot|mkdir /etc/pam_thinkfinger}}

And now we can add a fingerprint for a user with:

{{cmdroot|tf-tool --add-user $USERNAME}}

Now the user should be able to login with his finger, instead of the password.

{{NOTE|You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!}}

This Howto was copied from [[Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader]] and then slightly modified by me.

ThinkWiki - User contributions [en]

How to enable the integrated fingerprint reader with ThinkFinger