ThinkWiki - User contributions [en]

User:Quartsize

2009-07-18T17:02:21Z

Quartsize: switched again

Jaunty on a Thinkpad Z61t.

Removed video driver packages when I was running Fedora 10 (in case anyone would like to do similarly):
<pre>
xorg-x11-drv-apm xorg-x11-drv-ast xorg-x11-drv-ati xorg-x11-drv-cirrus
xorg-x11-drv-glint xorg-x11-drv-i128 xorg-x11-drv-i740 xorg-x11-drv-mach64
xorg-x11-drv-mga xorg-x11-drv-nouveau xorg-x11-drv-nv xorg-x11-drv-openchrome
xorg-x11-drv-r128 xorg-x11-drv-rendition xorg-x11-drv-s3virge xorg-x11-drv-savage
xorg-x11-drv-siliconmotion xorg-x11-drv-sis xorg-x11-drv-sisusb xorg-x11-drv-tdfx
xorg-x11-drv-trident xorg-x11-drv-vmware xorg-x11-drv-voodoo
</pre>

User:Quartsize

2009-02-13T14:14:01Z

Quartsize: switched to Arch

Arch on a Thinkpad Z61t.

Removed video driver packages when I was running Fedora 10 (in case anyone would like to do similarly):
<pre>
xorg-x11-drv-apm xorg-x11-drv-ast xorg-x11-drv-ati xorg-x11-drv-cirrus
xorg-x11-drv-glint xorg-x11-drv-i128 xorg-x11-drv-i740 xorg-x11-drv-mach64
xorg-x11-drv-mga xorg-x11-drv-nouveau xorg-x11-drv-nv xorg-x11-drv-openchrome
xorg-x11-drv-r128 xorg-x11-drv-rendition xorg-x11-drv-s3virge xorg-x11-drv-savage
xorg-x11-drv-siliconmotion xorg-x11-drv-sis xorg-x11-drv-sisusb xorg-x11-drv-tdfx
xorg-x11-drv-trident xorg-x11-drv-vmware xorg-x11-drv-voodoo
</pre>

User:Quartsize

2008-12-03T21:22:45Z

Quartsize:

Fedora 10 on a Thinkpad Z61t.

Removed video driver packages (in case anyone would like to do similarly):
<pre>
xorg-x11-drv-apm xorg-x11-drv-ast xorg-x11-drv-ati xorg-x11-drv-cirrus
xorg-x11-drv-glint xorg-x11-drv-i128 xorg-x11-drv-i740 xorg-x11-drv-mach64
xorg-x11-drv-mga xorg-x11-drv-nouveau xorg-x11-drv-nv xorg-x11-drv-openchrome
xorg-x11-drv-r128 xorg-x11-drv-rendition xorg-x11-drv-s3virge xorg-x11-drv-savage
xorg-x11-drv-siliconmotion xorg-x11-drv-sis xorg-x11-drv-sisusb xorg-x11-drv-tdfx
xorg-x11-drv-trident xorg-x11-drv-vmware xorg-x11-drv-voodoo
</pre>

How to enable the integrated fingerprint reader with ThinkFinger

2008-11-07T17:53:29Z

Quartsize: /* Ubuntu */ order by release

[[How to enable the fingerprint reader]] has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called [http://thinkfinger.sourceforge.net ThinkFinger] which does the same, but open.

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]

== Installing ==
=== From source ===

Download thinkfinger-0.3.tar.gz from the [http://thinkfinger.sourceforge.net/ homepage] and unpack it somewhere, make sure you have the gcc compiler, libtool, pkg-config, libusb-dev and libpam0g-dev installed, then:

{{cmduser|cd thinkfinger-0.3}}

<code style="white-space:nowrap;color:#495988;background-color:white;"><nowiki>$</nowiki> ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger</code>

{{cmduser|make}}

{{cmdroot|make install}}

{{NOTE|/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!}}

"make install" doesn't create the birdir we specified (where thinkfinger will store users' biometric info), so create it:

{{cmdroot|mkdir /etc/pam_thinkfinger}}

If everything went OK assert that you find pam_thinkfinger.so in /lib/security typing:

{{cmduser|ls /lib/security}}

=== From package ===

==== Debian ====
[http://packages.debian.org/source/experimental/thinkfinger Packages] arrived in Debian experimental on Aug 2nd, 2007 (cf. [http://bugs.debian.org/409563 bug #409563]). To access the experimental packages via apt, add the following lines to your sources.list:
<pre>
# experimental
deb ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
deb-src ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
</pre>
where of course you may replace mirrors.kernel.org with your mirror of choice. Just make sure that it hosts the experimental repositories.

{{cmdroot|aptitude update}}

{{cmdroot|aptitude install libthinkfinger0 libpam-thinkfinger thinkfinger-tools}}

should then get you up and running.

To make everything work you'll have to have permission to work the device ({{cmduser|sudo adduser myself plugdev}} worked for me), and you'll also have to follow instructions below about adding the device to your PAM methods.

==== Ubuntu ====

===== Gutsy =====

From https://wiki.ubuntu.com/ThinkFinger

Add PPA repositories to your sources.list:
<pre>
deb http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
deb-src http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
</pre>

Install necessary packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

===== Hardy =====

Hardy includes the latest thinkfinger and it is up to date with subversion. Install packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

Update the pam configuration files:

{{cmduser|sudo /usr/lib/pam-thinkfinger/pam-thinkfinger-enable}}

Enroll your fingerprint (creates $HOME/.thinkfinger.bir). If this gives an error about claiming the USB device then a reboot was claimed to work, but in fact it may just be a permissions problem. {{NOTE|Do not try to enroll using 'sudo' - it will cause hidden permission problems}}

{{cmduser|tf-tool --acquire}}

Check fingerprint enrollment

{{cmduser|tf-tool --verify}}

You can expect everything to work correctly. Note that you still have to enter your username if prompted but will be able
to swipe your finger instead of the password. The prompt will usually be "Password or swipe finger"

* Graphical login
* Text console login
* sudo
* screen lock/screen saver
* Administrative password prompt (eg for update or package managers). (Note no "or swipe finger" in prompt).

===== Intrepid =====
After installing from the normal repositories coming with Ubuntu 8.10, you would have to press enter after sweeping finger. (This bug: [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429 https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429])
Therefore Jon Oberheide made an update that can be found here:
[https://launchpad.net/~jon-oberheide/+archive https://launchpad.net/~jon-oberheide/+archive]

Add the PPA repositories to your source.list (/etc/apt/source.list):
<pre>
deb http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
deb-src http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
</pre>

Update installer:

{{cmduser|sudo apt-get update}}

And install:

{{cmduser|sudo apt-get thinkfinger-tools}}

==== Fedora/Fedora Core ====
{{cmdroot|yum install thinkfinger}}

==== Gentoo ====
{{cmdroot|emerge sys-auth/thinkfinger}}

==== OpenSUSE ====
openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages [http://beta1.suse.com/private/thoenig/10.2/thinkfinger/ here].

== Testing the driver ==

Now the driver is installed and should be working. You can try it (as root) with

{{cmdroot|tf-tool --acquire}}

and

{{cmdroot|tf-tool --verify}}

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

== Configuring PAM to use ThinkFinger ==
Now you can configure PAM to use ThinkFinger:

Open {{path|/etc/pam.d/common-auth}} (In FC6, F7, and Gentoo, this file is {{path|/etc/pam.d/system-auth}}):

{{cmdroot|nano -w /etc/pam.d/common-auth}}

Add this line before any pam_unix or pam_unix2 directives:
auth sufficient pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in
the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.
auth required pam_unix.so try_first_pass

For instance, {{path|/etc/pam.d/common-auth}} looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:
auth required pam_env.so
auth sufficient pam_thinkfinger.so
auth required pam_unix2.so

On Ubuntu 8.10 - Intrepid Ibex you should just add the following line the the /etc/pam.d/common-auth file so it looks like this:
<pre>
....
# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
....
</pre>

Now we are ready to add users to thinkfinger. You can add a fingerprint for a user with:

{{cmdroot|tf-tool --add-user $USERNAME}}

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

{{cmdroot|tf-tool --add-user root}}

{{NOTE|You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!}}

== xscreensaver/gnome-screensaver ==
{{NOTE|In Fedora 7, the package has been modified in such a way as to make doing this unnecessary.}}

If you'd like to be able to unlock your screen using the fingerprint reader, you must have current versions of xscreesaver (>~5.03) or gnome-screensaver (>~2.18.2). Then you must give yourself access to the fingerprint reader and your bir-file, because unlike login/gdm/su/sudo, both gnome-screensaver and xscreensaver do not run as root. The following procedure will make the fingerprint reader accessible to members of the "fingerprint" group.

Make the group: {{cmdroot|groupadd fingerprint}}

Save the following as {{path|/etc/udev/rules.d/60-thinkfinger.rules}} and run {{cmdroot|sudo /sbin/udevtrigger}} (you may need to reboot for this to take effect if udev trigger does not work):
#
# udev rules file for the thinkfinger fingerprint scanner
#
# gives access to the fingerprint reader to those in the "fingerprint" group
#
# Taken from:
# http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger
# which was taken and modified from:
# http://article.gmane.org/gmane.linux.drivers.thinkfinger/329
#

# SGS Thomson Microelectronics Fingerprint Reader
SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"

# the also-needed uinput device
KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

Finally, edit {{path|/etc/pam.d/gnome-screensaver}} so that it looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

Per user:

# Add him to the group: {{cmdroot|gpasswd -a $USERNAME fingerprint}}
# Make him owner of his bir-file: {{cmdroot|chown $USERNAME:root /etc/pam_thinkfinger/$USERNAME.bir}}
# Give him read-only access to his bir-file: {{cmdroot|chmod 400 /etc/pam_thinkfinger/$USERNAME.bir}}
# Give "execute only" access to everyone for the /etc/pam_thinkfinger/ directory: {{cmdroot|chmod o+x /etc/pam_thinkfinger}} (WARNING: this opens up security a little).

== GNOME ==

{{NOTE|1=This problem should be solved if you're using sudo >= 1.6.9p9. Links: [http://savannah.nongnu.org/bugs/?19132], [http://www.sudo.ws/bugs/show_bug.cgi?id=180], [https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843]}}

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:
* Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
* Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.
<pre>
--- libgksu-2.0.3/libgksu/libgksu.c.orig 2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c 2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
*/
for (counter = 0; counter < 50; counter++)
{
- if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
break;

read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
if (context->debug)
fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");

- if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
{
gchar *password = NULL;
gboolean prompt_grab;
</pre>

== KDE ==

Integration in KDE and kdm seems not to be easily possible now. There is a filed [https://bugs.kde.org/show_bug.cgi?id=116682 bug] at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

Another workaround is to use Fprint from [http://www.reactivated.net/fprint/wiki/Main_Page] which works quite nicely on my X61s and Kubuntu Hardy.

This Howto was copied from [[Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader]] and then slightly modified.

== Fix for the fingerprint reader getting too hot ==

If you notice that your fingerprint reader occasionally gets very hot then you might be interested in this section. Thanks to Tino Keitel, he actually gave me this solution through the linux-thinkpad mailing list.

First we need to determine if the reader is not on autosuspend mode.
Open a terminal and run:

for i in `find /sys/devices/*/*/usb* -name level` ; do echo -n "$i: " ; cat $i ; done

We care about the devices that are with "on" state and we need to determine if one of those is the reader. So for each of those run something like:

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idVendor
0483

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idProduct
2016

Use the corresponding path of the devices that you got with "on" state and then compare the output with the output of the lsusb command. An example:

lsusb output: Bus 001 Device 004: ID 0483:2016 SGS Thomson Microelectronics Fingerprint Reader

Which matches the output above (0483:2016). Once you have determined the path of your reader then become root with su - and:

echo "auto" > /sys/<path-to-device>/power/level

After this, the fingerprint reader should be in "autosuspend" and will not get hot anymore. And it will still work as normal.

This will only work for the current session. If you want to make this change persistent and have [http://linux-diag.sourceforge.net/Sysfsutils.html sysfsutils] installed, edit the file {{path|/etc/sysfs.conf}} and add the line

<path-to-device>/power/level = auto

Following the above example, that would be

devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/power/level = auto

Alternatively, you can install an init script:

sudo gedit /etc/init.d/ReaderNoMoreHot

Paste the following into it:

#!/bin/bash
#
echo "auto" > /sys/<path-to-device>/power/level

Save and close. Then:

sudo chmod 755 /etc/init.d/ReaderNoMoreHot
sudo update-rc.d ReaderNoMoreHot defaults 90

--[[User:Lunatico|Lunatico]] 19:19, 1 August 2008 (CEST), extended by --[[User:Michaelthomas h|Michaelthomas h]] 23:36, 9 August 2008 (CEST)

How to enable the integrated fingerprint reader with ThinkFinger

2008-11-07T17:49:12Z

Quartsize: /* Debian */ pre -> cmdroot template

[[How to enable the fingerprint reader]] has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called [http://thinkfinger.sourceforge.net ThinkFinger] which does the same, but open.

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]

== Installing ==
=== From source ===

Download thinkfinger-0.3.tar.gz from the [http://thinkfinger.sourceforge.net/ homepage] and unpack it somewhere, make sure you have the gcc compiler, libtool, pkg-config, libusb-dev and libpam0g-dev installed, then:

{{cmduser|cd thinkfinger-0.3}}

<code style="white-space:nowrap;color:#495988;background-color:white;"><nowiki>$</nowiki> ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger</code>

{{cmduser|make}}

{{cmdroot|make install}}

{{NOTE|/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!}}

"make install" doesn't create the birdir we specified (where thinkfinger will store users' biometric info), so create it:

{{cmdroot|mkdir /etc/pam_thinkfinger}}

If everything went OK assert that you find pam_thinkfinger.so in /lib/security typing:

{{cmduser|ls /lib/security}}

=== From package ===

==== Debian ====
[http://packages.debian.org/source/experimental/thinkfinger Packages] arrived in Debian experimental on Aug 2nd, 2007 (cf. [http://bugs.debian.org/409563 bug #409563]). To access the experimental packages via apt, add the following lines to your sources.list:
<pre>
# experimental
deb ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
deb-src ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
</pre>
where of course you may replace mirrors.kernel.org with your mirror of choice. Just make sure that it hosts the experimental repositories.

{{cmdroot|aptitude update}}

{{cmdroot|aptitude install libthinkfinger0 libpam-thinkfinger thinkfinger-tools}}

should then get you up and running.

To make everything work you'll have to have permission to work the device ({{cmduser|sudo adduser myself plugdev}} worked for me), and you'll also have to follow instructions below about adding the device to your PAM methods.

==== Ubuntu ====

===== Hardy =====

Hardy includes the latest thinkfinger and it is up to date with subversion. Install packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

Update the pam configuration files:

{{cmduser|sudo /usr/lib/pam-thinkfinger/pam-thinkfinger-enable}}

Enroll your fingerprint (creates $HOME/.thinkfinger.bir). If this gives an error about claiming the USB device then a reboot was claimed to work, but in fact it may just be a permissions problem. {{NOTE|Do not try to enroll using 'sudo' - it will cause hidden permission problems}}

{{cmduser|tf-tool --acquire}}

Check fingerprint enrollment

{{cmduser|tf-tool --verify}}

You can expect everything to work correctly. Note that you still have to enter your username if prompted but will be able
to swipe your finger instead of the password. The prompt will usually be "Password or swipe finger"

* Graphical login
* Text console login
* sudo
* screen lock/screen saver
* Administrative password prompt (eg for update or package managers). (Note no "or swipe finger" in prompt).

===== Gutsy =====

From https://wiki.ubuntu.com/ThinkFinger

Add PPA repositories to your sources.list:
<pre>
deb http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
deb-src http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
</pre>

Install necessary packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

===== Intrepid Ibex =====
After installing from the normal repositories coming with Ubuntu 8.10, you would have to press enter after sweeping finger. (This bug: [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429 https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429])
Therefore Jon Oberheide made an update that can be found here:
[https://launchpad.net/~jon-oberheide/+archive https://launchpad.net/~jon-oberheide/+archive]

Add the PPA repositories to your source.list (/etc/apt/source.list):
<pre>
deb http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
deb-src http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
</pre>

Update installer:

{{cmduser|sudo apt-get update}}

And install:

{{cmduser|sudo apt-get thinkfinger-tools}}

==== Fedora/Fedora Core ====
{{cmdroot|yum install thinkfinger}}

==== Gentoo ====
{{cmdroot|emerge sys-auth/thinkfinger}}

==== OpenSUSE ====
openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages [http://beta1.suse.com/private/thoenig/10.2/thinkfinger/ here].

== Testing the driver ==

Now the driver is installed and should be working. You can try it (as root) with

{{cmdroot|tf-tool --acquire}}

and

{{cmdroot|tf-tool --verify}}

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

== Configuring PAM to use ThinkFinger ==
Now you can configure PAM to use ThinkFinger:

Open {{path|/etc/pam.d/common-auth}} (In FC6, F7, and Gentoo, this file is {{path|/etc/pam.d/system-auth}}):

{{cmdroot|nano -w /etc/pam.d/common-auth}}

Add this line before any pam_unix or pam_unix2 directives:
auth sufficient pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in
the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.
auth required pam_unix.so try_first_pass

For instance, {{path|/etc/pam.d/common-auth}} looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:
auth required pam_env.so
auth sufficient pam_thinkfinger.so
auth required pam_unix2.so

On Ubuntu 8.10 - Intrepid Ibex you should just add the following line the the /etc/pam.d/common-auth file so it looks like this:
<pre>
....
# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
....
</pre>

Now we are ready to add users to thinkfinger. You can add a fingerprint for a user with:

{{cmdroot|tf-tool --add-user $USERNAME}}

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

{{cmdroot|tf-tool --add-user root}}

{{NOTE|You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!}}

== xscreensaver/gnome-screensaver ==
{{NOTE|In Fedora 7, the package has been modified in such a way as to make doing this unnecessary.}}

If you'd like to be able to unlock your screen using the fingerprint reader, you must have current versions of xscreesaver (>~5.03) or gnome-screensaver (>~2.18.2). Then you must give yourself access to the fingerprint reader and your bir-file, because unlike login/gdm/su/sudo, both gnome-screensaver and xscreensaver do not run as root. The following procedure will make the fingerprint reader accessible to members of the "fingerprint" group.

Make the group: {{cmdroot|groupadd fingerprint}}

Save the following as {{path|/etc/udev/rules.d/60-thinkfinger.rules}} and run {{cmdroot|sudo /sbin/udevtrigger}} (you may need to reboot for this to take effect if udev trigger does not work):
#
# udev rules file for the thinkfinger fingerprint scanner
#
# gives access to the fingerprint reader to those in the "fingerprint" group
#
# Taken from:
# http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger
# which was taken and modified from:
# http://article.gmane.org/gmane.linux.drivers.thinkfinger/329
#

# SGS Thomson Microelectronics Fingerprint Reader
SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"

# the also-needed uinput device
KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

Finally, edit {{path|/etc/pam.d/gnome-screensaver}} so that it looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

Per user:

# Add him to the group: {{cmdroot|gpasswd -a $USERNAME fingerprint}}
# Make him owner of his bir-file: {{cmdroot|chown $USERNAME:root /etc/pam_thinkfinger/$USERNAME.bir}}
# Give him read-only access to his bir-file: {{cmdroot|chmod 400 /etc/pam_thinkfinger/$USERNAME.bir}}
# Give "execute only" access to everyone for the /etc/pam_thinkfinger/ directory: {{cmdroot|chmod o+x /etc/pam_thinkfinger}} (WARNING: this opens up security a little).

== GNOME ==

{{NOTE|1=This problem should be solved if you're using sudo >= 1.6.9p9. Links: [http://savannah.nongnu.org/bugs/?19132], [http://www.sudo.ws/bugs/show_bug.cgi?id=180], [https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843]}}

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:
* Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
* Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.
<pre>
--- libgksu-2.0.3/libgksu/libgksu.c.orig 2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c 2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
*/
for (counter = 0; counter < 50; counter++)
{
- if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
break;

read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
if (context->debug)
fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");

- if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
{
gchar *password = NULL;
gboolean prompt_grab;
</pre>

== KDE ==

Integration in KDE and kdm seems not to be easily possible now. There is a filed [https://bugs.kde.org/show_bug.cgi?id=116682 bug] at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

Another workaround is to use Fprint from [http://www.reactivated.net/fprint/wiki/Main_Page] which works quite nicely on my X61s and Kubuntu Hardy.

This Howto was copied from [[Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader]] and then slightly modified.

== Fix for the fingerprint reader getting too hot ==

If you notice that your fingerprint reader occasionally gets very hot then you might be interested in this section. Thanks to Tino Keitel, he actually gave me this solution through the linux-thinkpad mailing list.

First we need to determine if the reader is not on autosuspend mode.
Open a terminal and run:

for i in `find /sys/devices/*/*/usb* -name level` ; do echo -n "$i: " ; cat $i ; done

We care about the devices that are with "on" state and we need to determine if one of those is the reader. So for each of those run something like:

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idVendor
0483

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idProduct
2016

Use the corresponding path of the devices that you got with "on" state and then compare the output with the output of the lsusb command. An example:

lsusb output: Bus 001 Device 004: ID 0483:2016 SGS Thomson Microelectronics Fingerprint Reader

Which matches the output above (0483:2016). Once you have determined the path of your reader then become root with su - and:

echo "auto" > /sys/<path-to-device>/power/level

After this, the fingerprint reader should be in "autosuspend" and will not get hot anymore. And it will still work as normal.

This will only work for the current session. If you want to make this change persistent and have [http://linux-diag.sourceforge.net/Sysfsutils.html sysfsutils] installed, edit the file {{path|/etc/sysfs.conf}} and add the line

<path-to-device>/power/level = auto

Following the above example, that would be

devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/power/level = auto

Alternatively, you can install an init script:

sudo gedit /etc/init.d/ReaderNoMoreHot

Paste the following into it:

#!/bin/bash
#
echo "auto" > /sys/<path-to-device>/power/level

Save and close. Then:

sudo chmod 755 /etc/init.d/ReaderNoMoreHot
sudo update-rc.d ReaderNoMoreHot defaults 90

--[[User:Lunatico|Lunatico]] 19:19, 1 August 2008 (CEST), extended by --[[User:Michaelthomas h|Michaelthomas h]] 23:36, 9 August 2008 (CEST)

How to enable the integrated fingerprint reader with ThinkFinger

2008-11-07T17:46:56Z

Quartsize: /* Gentoo */ pre => cmdroot template

[[How to enable the fingerprint reader]] has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called [http://thinkfinger.sourceforge.net ThinkFinger] which does the same, but open.

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]

== Installing ==
=== From source ===

Download thinkfinger-0.3.tar.gz from the [http://thinkfinger.sourceforge.net/ homepage] and unpack it somewhere, make sure you have the gcc compiler, libtool, pkg-config, libusb-dev and libpam0g-dev installed, then:

{{cmduser|cd thinkfinger-0.3}}

<code style="white-space:nowrap;color:#495988;background-color:white;"><nowiki>$</nowiki> ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger</code>

{{cmduser|make}}

{{cmdroot|make install}}

{{NOTE|/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!}}

"make install" doesn't create the birdir we specified (where thinkfinger will store users' biometric info), so create it:

{{cmdroot|mkdir /etc/pam_thinkfinger}}

If everything went OK assert that you find pam_thinkfinger.so in /lib/security typing:

{{cmduser|ls /lib/security}}

=== From package ===

==== Debian ====
[http://packages.debian.org/source/experimental/thinkfinger Packages] arrived in Debian experimental on Aug 2nd, 2007 (cf. [http://bugs.debian.org/409563 bug #409563]). To access the experimental packages via apt, add the following lines to your sources.list:
<pre>
# experimental
deb ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
deb-src ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
</pre>
where of course you may replace mirrors.kernel.org with your mirror of choice. Just make sure that it hosts the experimental repositories.
<pre>
aptitude update
aptitude install libthinkfinger0 libpam-thinkfinger thinkfinger-tools
</pre>
should then get you up and running.

To make everything work you'll have to have permission to work the device ({{cmduser|sudo adduser myself plugdev}} worked for me), and you'll also have to follow instructions below about adding the device to your PAM methods.

==== Ubuntu ====

===== Hardy =====

Hardy includes the latest thinkfinger and it is up to date with subversion. Install packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

Update the pam configuration files:

{{cmduser|sudo /usr/lib/pam-thinkfinger/pam-thinkfinger-enable}}

Enroll your fingerprint (creates $HOME/.thinkfinger.bir). If this gives an error about claiming the USB device then a reboot was claimed to work, but in fact it may just be a permissions problem. {{NOTE|Do not try to enroll using 'sudo' - it will cause hidden permission problems}}

{{cmduser|tf-tool --acquire}}

Check fingerprint enrollment

{{cmduser|tf-tool --verify}}

You can expect everything to work correctly. Note that you still have to enter your username if prompted but will be able
to swipe your finger instead of the password. The prompt will usually be "Password or swipe finger"

* Graphical login
* Text console login
* sudo
* screen lock/screen saver
* Administrative password prompt (eg for update or package managers). (Note no "or swipe finger" in prompt).

===== Gutsy =====

From https://wiki.ubuntu.com/ThinkFinger

Add PPA repositories to your sources.list:
<pre>
deb http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
deb-src http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
</pre>

Install necessary packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

===== Intrepid Ibex =====
After installing from the normal repositories coming with Ubuntu 8.10, you would have to press enter after sweeping finger. (This bug: [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429 https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429])
Therefore Jon Oberheide made an update that can be found here:
[https://launchpad.net/~jon-oberheide/+archive https://launchpad.net/~jon-oberheide/+archive]

Add the PPA repositories to your source.list (/etc/apt/source.list):
<pre>
deb http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
deb-src http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
</pre>

Update installer:

{{cmduser|sudo apt-get update}}

And install:

{{cmduser|sudo apt-get thinkfinger-tools}}

==== Fedora/Fedora Core ====
{{cmdroot|yum install thinkfinger}}

==== Gentoo ====
{{cmdroot|emerge sys-auth/thinkfinger}}

==== OpenSUSE ====
openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages [http://beta1.suse.com/private/thoenig/10.2/thinkfinger/ here].

== Testing the driver ==

Now the driver is installed and should be working. You can try it (as root) with

{{cmdroot|tf-tool --acquire}}

and

{{cmdroot|tf-tool --verify}}

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

== Configuring PAM to use ThinkFinger ==
Now you can configure PAM to use ThinkFinger:

Open {{path|/etc/pam.d/common-auth}} (In FC6, F7, and Gentoo, this file is {{path|/etc/pam.d/system-auth}}):

{{cmdroot|nano -w /etc/pam.d/common-auth}}

Add this line before any pam_unix or pam_unix2 directives:
auth sufficient pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in
the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.
auth required pam_unix.so try_first_pass

For instance, {{path|/etc/pam.d/common-auth}} looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:
auth required pam_env.so
auth sufficient pam_thinkfinger.so
auth required pam_unix2.so

On Ubuntu 8.10 - Intrepid Ibex you should just add the following line the the /etc/pam.d/common-auth file so it looks like this:
<pre>
....
# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
....
</pre>

Now we are ready to add users to thinkfinger. You can add a fingerprint for a user with:

{{cmdroot|tf-tool --add-user $USERNAME}}

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

{{cmdroot|tf-tool --add-user root}}

{{NOTE|You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!}}

== xscreensaver/gnome-screensaver ==
{{NOTE|In Fedora 7, the package has been modified in such a way as to make doing this unnecessary.}}

If you'd like to be able to unlock your screen using the fingerprint reader, you must have current versions of xscreesaver (>~5.03) or gnome-screensaver (>~2.18.2). Then you must give yourself access to the fingerprint reader and your bir-file, because unlike login/gdm/su/sudo, both gnome-screensaver and xscreensaver do not run as root. The following procedure will make the fingerprint reader accessible to members of the "fingerprint" group.

Make the group: {{cmdroot|groupadd fingerprint}}

Save the following as {{path|/etc/udev/rules.d/60-thinkfinger.rules}} and run {{cmdroot|sudo /sbin/udevtrigger}} (you may need to reboot for this to take effect if udev trigger does not work):
#
# udev rules file for the thinkfinger fingerprint scanner
#
# gives access to the fingerprint reader to those in the "fingerprint" group
#
# Taken from:
# http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger
# which was taken and modified from:
# http://article.gmane.org/gmane.linux.drivers.thinkfinger/329
#

# SGS Thomson Microelectronics Fingerprint Reader
SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"

# the also-needed uinput device
KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

Finally, edit {{path|/etc/pam.d/gnome-screensaver}} so that it looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

Per user:

# Add him to the group: {{cmdroot|gpasswd -a $USERNAME fingerprint}}
# Make him owner of his bir-file: {{cmdroot|chown $USERNAME:root /etc/pam_thinkfinger/$USERNAME.bir}}
# Give him read-only access to his bir-file: {{cmdroot|chmod 400 /etc/pam_thinkfinger/$USERNAME.bir}}
# Give "execute only" access to everyone for the /etc/pam_thinkfinger/ directory: {{cmdroot|chmod o+x /etc/pam_thinkfinger}} (WARNING: this opens up security a little).

== GNOME ==

{{NOTE|1=This problem should be solved if you're using sudo >= 1.6.9p9. Links: [http://savannah.nongnu.org/bugs/?19132], [http://www.sudo.ws/bugs/show_bug.cgi?id=180], [https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843]}}

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:
* Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
* Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.
<pre>
--- libgksu-2.0.3/libgksu/libgksu.c.orig 2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c 2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
*/
for (counter = 0; counter < 50; counter++)
{
- if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
break;

read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
if (context->debug)
fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");

- if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
{
gchar *password = NULL;
gboolean prompt_grab;
</pre>

== KDE ==

Integration in KDE and kdm seems not to be easily possible now. There is a filed [https://bugs.kde.org/show_bug.cgi?id=116682 bug] at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

Another workaround is to use Fprint from [http://www.reactivated.net/fprint/wiki/Main_Page] which works quite nicely on my X61s and Kubuntu Hardy.

This Howto was copied from [[Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader]] and then slightly modified.

== Fix for the fingerprint reader getting too hot ==

If you notice that your fingerprint reader occasionally gets very hot then you might be interested in this section. Thanks to Tino Keitel, he actually gave me this solution through the linux-thinkpad mailing list.

First we need to determine if the reader is not on autosuspend mode.
Open a terminal and run:

for i in `find /sys/devices/*/*/usb* -name level` ; do echo -n "$i: " ; cat $i ; done

We care about the devices that are with "on" state and we need to determine if one of those is the reader. So for each of those run something like:

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idVendor
0483

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idProduct
2016

Use the corresponding path of the devices that you got with "on" state and then compare the output with the output of the lsusb command. An example:

lsusb output: Bus 001 Device 004: ID 0483:2016 SGS Thomson Microelectronics Fingerprint Reader

Which matches the output above (0483:2016). Once you have determined the path of your reader then become root with su - and:

echo "auto" > /sys/<path-to-device>/power/level

After this, the fingerprint reader should be in "autosuspend" and will not get hot anymore. And it will still work as normal.

This will only work for the current session. If you want to make this change persistent and have [http://linux-diag.sourceforge.net/Sysfsutils.html sysfsutils] installed, edit the file {{path|/etc/sysfs.conf}} and add the line

<path-to-device>/power/level = auto

Following the above example, that would be

devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/power/level = auto

Alternatively, you can install an init script:

sudo gedit /etc/init.d/ReaderNoMoreHot

Paste the following into it:

#!/bin/bash
#
echo "auto" > /sys/<path-to-device>/power/level

Save and close. Then:

sudo chmod 755 /etc/init.d/ReaderNoMoreHot
sudo update-rc.d ReaderNoMoreHot defaults 90

--[[User:Lunatico|Lunatico]] 19:19, 1 August 2008 (CEST), extended by --[[User:Michaelthomas h|Michaelthomas h]] 23:36, 9 August 2008 (CEST)

How to enable the integrated fingerprint reader with ThinkFinger

2008-11-07T17:42:02Z

Quartsize: /* Fedora/Fedora Core */ merged bullets into the single relevant command

[[How to enable the fingerprint reader]] has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called [http://thinkfinger.sourceforge.net ThinkFinger] which does the same, but open.

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]

== Installing ==
=== From source ===

Download thinkfinger-0.3.tar.gz from the [http://thinkfinger.sourceforge.net/ homepage] and unpack it somewhere, make sure you have the gcc compiler, libtool, pkg-config, libusb-dev and libpam0g-dev installed, then:

{{cmduser|cd thinkfinger-0.3}}

<code style="white-space:nowrap;color:#495988;background-color:white;"><nowiki>$</nowiki> ./configure --prefix=/usr --sysconfdir=/etc --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger</code>

{{cmduser|make}}

{{cmdroot|make install}}

{{NOTE|/lib/security is the directory, where PAM assumes its modules on Debian and openSUSE, it may vary for your distro!}}

"make install" doesn't create the birdir we specified (where thinkfinger will store users' biometric info), so create it:

{{cmdroot|mkdir /etc/pam_thinkfinger}}

If everything went OK assert that you find pam_thinkfinger.so in /lib/security typing:

{{cmduser|ls /lib/security}}

=== From package ===

==== Debian ====
[http://packages.debian.org/source/experimental/thinkfinger Packages] arrived in Debian experimental on Aug 2nd, 2007 (cf. [http://bugs.debian.org/409563 bug #409563]). To access the experimental packages via apt, add the following lines to your sources.list:
<pre>
# experimental
deb ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
deb-src ftp://mirrors.kernel.org/debian/ experimental main contrib non-free
</pre>
where of course you may replace mirrors.kernel.org with your mirror of choice. Just make sure that it hosts the experimental repositories.
<pre>
aptitude update
aptitude install libthinkfinger0 libpam-thinkfinger thinkfinger-tools
</pre>
should then get you up and running.

To make everything work you'll have to have permission to work the device ({{cmduser|sudo adduser myself plugdev}} worked for me), and you'll also have to follow instructions below about adding the device to your PAM methods.

==== Ubuntu ====

===== Hardy =====

Hardy includes the latest thinkfinger and it is up to date with subversion. Install packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

Update the pam configuration files:

{{cmduser|sudo /usr/lib/pam-thinkfinger/pam-thinkfinger-enable}}

Enroll your fingerprint (creates $HOME/.thinkfinger.bir). If this gives an error about claiming the USB device then a reboot was claimed to work, but in fact it may just be a permissions problem. {{NOTE|Do not try to enroll using 'sudo' - it will cause hidden permission problems}}

{{cmduser|tf-tool --acquire}}

Check fingerprint enrollment

{{cmduser|tf-tool --verify}}

You can expect everything to work correctly. Note that you still have to enter your username if prompted but will be able
to swipe your finger instead of the password. The prompt will usually be "Password or swipe finger"

* Graphical login
* Text console login
* sudo
* screen lock/screen saver
* Administrative password prompt (eg for update or package managers). (Note no "or swipe finger" in prompt).

===== Gutsy =====

From https://wiki.ubuntu.com/ThinkFinger

Add PPA repositories to your sources.list:
<pre>
deb http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
deb-src http://ppa.launchpad.net/jldugger/ubuntu gutsy main restricted universe multiverse
</pre>

Install necessary packages:

{{cmduser|sudo apt-get install thinkfinger-tools libpam-thinkfinger}}

===== Intrepid Ibex =====
After installing from the normal repositories coming with Ubuntu 8.10, you would have to press enter after sweeping finger. (This bug: [https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429 https://bugs.launchpad.net/ubuntu/+source/thinkfinger/+bug/256429])
Therefore Jon Oberheide made an update that can be found here:
[https://launchpad.net/~jon-oberheide/+archive https://launchpad.net/~jon-oberheide/+archive]

Add the PPA repositories to your source.list (/etc/apt/source.list):
<pre>
deb http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
deb-src http://ppa.launchpad.net/jon-oberheide/ubuntu intrepid main
</pre>

Update installer:

{{cmduser|sudo apt-get update}}

And install:

{{cmduser|sudo apt-get thinkfinger-tools}}

==== Fedora/Fedora Core ====
{{cmdroot|yum install thinkfinger}}

==== Gentoo ====
<pre>
emerge sys-auth/thinkfinger
</pre>

==== OpenSUSE ====
openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages [http://beta1.suse.com/private/thoenig/10.2/thinkfinger/ here].

== Testing the driver ==

Now the driver is installed and should be working. You can try it (as root) with

{{cmdroot|tf-tool --acquire}}

and

{{cmdroot|tf-tool --verify}}

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

== Configuring PAM to use ThinkFinger ==
Now you can configure PAM to use ThinkFinger:

Open {{path|/etc/pam.d/common-auth}} (In FC6, F7, and Gentoo, this file is {{path|/etc/pam.d/system-auth}}):

{{cmdroot|nano -w /etc/pam.d/common-auth}}

Add this line before any pam_unix or pam_unix2 directives:
auth sufficient pam_thinkfinger.so

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in
the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.
auth required pam_unix.so try_first_pass

For instance, {{path|/etc/pam.d/common-auth}} looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:
auth required pam_env.so
auth sufficient pam_thinkfinger.so
auth required pam_unix2.so

On Ubuntu 8.10 - Intrepid Ibex you should just add the following line the the /etc/pam.d/common-auth file so it looks like this:
<pre>
....
# here are the per-package modules (the "Primary" block)
auth sufficient pam_thinkfinger.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok_secure
# here's the fallback if no module succeeds
....
</pre>

Now we are ready to add users to thinkfinger. You can add a fingerprint for a user with:

{{cmdroot|tf-tool --add-user $USERNAME}}

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

{{cmdroot|tf-tool --add-user root}}

{{NOTE|You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!}}

== xscreensaver/gnome-screensaver ==
{{NOTE|In Fedora 7, the package has been modified in such a way as to make doing this unnecessary.}}

If you'd like to be able to unlock your screen using the fingerprint reader, you must have current versions of xscreesaver (>~5.03) or gnome-screensaver (>~2.18.2). Then you must give yourself access to the fingerprint reader and your bir-file, because unlike login/gdm/su/sudo, both gnome-screensaver and xscreensaver do not run as root. The following procedure will make the fingerprint reader accessible to members of the "fingerprint" group.

Make the group: {{cmdroot|groupadd fingerprint}}

Save the following as {{path|/etc/udev/rules.d/60-thinkfinger.rules}} and run {{cmdroot|sudo /sbin/udevtrigger}} (you may need to reboot for this to take effect if udev trigger does not work):
#
# udev rules file for the thinkfinger fingerprint scanner
#
# gives access to the fingerprint reader to those in the "fingerprint" group
#
# Taken from:
# http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger
# which was taken and modified from:
# http://article.gmane.org/gmane.linux.drivers.thinkfinger/329
#

# SGS Thomson Microelectronics Fingerprint Reader
SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"

# the also-needed uinput device
KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

Finally, edit {{path|/etc/pam.d/gnome-screensaver}} so that it looks like this:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

Per user:

# Add him to the group: {{cmdroot|gpasswd -a $USERNAME fingerprint}}
# Make him owner of his bir-file: {{cmdroot|chown $USERNAME:root /etc/pam_thinkfinger/$USERNAME.bir}}
# Give him read-only access to his bir-file: {{cmdroot|chmod 400 /etc/pam_thinkfinger/$USERNAME.bir}}
# Give "execute only" access to everyone for the /etc/pam_thinkfinger/ directory: {{cmdroot|chmod o+x /etc/pam_thinkfinger}} (WARNING: this opens up security a little).

== GNOME ==

{{NOTE|1=This problem should be solved if you're using sudo >= 1.6.9p9. Links: [http://savannah.nongnu.org/bugs/?19132], [http://www.sudo.ws/bugs/show_bug.cgi?id=180], [https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843]}}

gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:
* Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
* Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.
<pre>
--- libgksu-2.0.3/libgksu/libgksu.c.orig 2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c 2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
*/
for (counter = 0; counter < 50; counter++)
{
- if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
break;

read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
if (context->debug)
fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");

- if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+ if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
{
gchar *password = NULL;
gboolean prompt_grab;
</pre>

== KDE ==

Integration in KDE and kdm seems not to be easily possible now. There is a filed [https://bugs.kde.org/show_bug.cgi?id=116682 bug] at kde.org where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

Another workaround is to use Fprint from [http://www.reactivated.net/fprint/wiki/Main_Page] which works quite nicely on my X61s and Kubuntu Hardy.

This Howto was copied from [[Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader]] and then slightly modified.

== Fix for the fingerprint reader getting too hot ==

If you notice that your fingerprint reader occasionally gets very hot then you might be interested in this section. Thanks to Tino Keitel, he actually gave me this solution through the linux-thinkpad mailing list.

First we need to determine if the reader is not on autosuspend mode.
Open a terminal and run:

for i in `find /sys/devices/*/*/usb* -name level` ; do echo -n "$i: " ; cat $i ; done

We care about the devices that are with "on" state and we need to determine if one of those is the reader. So for each of those run something like:

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idVendor
0483

cat /sys/devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/idProduct
2016

Use the corresponding path of the devices that you got with "on" state and then compare the output with the output of the lsusb command. An example:

lsusb output: Bus 001 Device 004: ID 0483:2016 SGS Thomson Microelectronics Fingerprint Reader

Which matches the output above (0483:2016). Once you have determined the path of your reader then become root with su - and:

echo "auto" > /sys/<path-to-device>/power/level

After this, the fingerprint reader should be in "autosuspend" and will not get hot anymore. And it will still work as normal.

This will only work for the current session. If you want to make this change persistent and have [http://linux-diag.sourceforge.net/Sysfsutils.html sysfsutils] installed, edit the file {{path|/etc/sysfs.conf}} and add the line

<path-to-device>/power/level = auto

Following the above example, that would be

devices/pci0000\:00/0000\:00\:1a.0/usb1/1-2/power/level = auto

Alternatively, you can install an init script:

sudo gedit /etc/init.d/ReaderNoMoreHot

Paste the following into it:

#!/bin/bash
#
echo "auto" > /sys/<path-to-device>/power/level

Save and close. Then:

sudo chmod 755 /etc/init.d/ReaderNoMoreHot
sudo update-rc.d ReaderNoMoreHot defaults 90

--[[User:Lunatico|Lunatico]] 19:19, 1 August 2008 (CEST), extended by --[[User:Michaelthomas h|Michaelthomas h]] 23:36, 9 August 2008 (CEST)

User:Quartsize

2008-11-06T20:45:00Z

Quartsize:

Fedora 10 on a Thinkpad Z61t.

User:Quartsize

2008-04-26T02:12:20Z

Quartsize:

Hardy on a Thinkpad Z61t.

User:Quartsize

2008-03-09T02:28:04Z

Quartsize: :-)

Arch on a Thinkpad Z61t.

User:Quartsize

2007-12-22T06:09:12Z

Quartsize:

Fedora 8 on a Thinkpad Z61t.

How to enable the integrated fingerprint reader with ThinkFinger

2007-11-24T16:31:52Z

Quartsize: /* xscreensaver/gnome-screensaver */

User:Quartsize

2007-11-22T01:13:10Z

Quartsize: It makes encrypted LVM easier. Sue me.

Gutsy on a Thinkpad Z61t.

How to enable the integrated fingerprint reader with ThinkFinger

2007-10-15T19:16:54Z

Quartsize: /* xscreensaver/gnome-screensaver */

User:Quartsize

2007-09-16T16:48:54Z

Quartsize: â†Created page with 'Fedora 7 on a Thinkpad Z61t.'

Fedora 7 on a Thinkpad Z61t.

How to enable the integrated fingerprint reader with ThinkFinger

2007-09-16T15:32:06Z

Quartsize: /* gnome-screensaver */

Integrated Fingerprint Reader

2007-09-16T13:14:06Z

Quartsize: /* Models featuring this Technology */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:fingerprintreader.jpg|IBM Integrated Fingerprint Reader]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Integrated Fingerprint Reader===
IBM released a second generation of T42 models in Autumn 2004 featuring Intel Pentium M 765 processors and an integrated fingerprint reader.

The fingerprint reader is produced by a company called UPEK, which specializes in the manufacture of fingerprint readers. It is integrated as an USB device, and does all the matching in hardware, making it rather easy to use. Furthermore, IBM states that there's an interface with the [[Embedded Security Subsystem]]. UPEK now sells the fingerprint reader as a USB peripheral bundled with the same underlying software for accessing password-protected online accounts and Windows: [http://www.upek.com/solutions/eikon Eikon Digital Privacy Manager]
</div>
|}

==Linux Support==

There is a new GPL driver at http://thinkfinger.sourceforge.net; see the [[How to enable the fingerprint reader with ThinkFinger]] for detailed instructions.

A closed source driver from the vendor has been released. It interfaces to the hardware as a user-space USB driver through {{path|/proc/bus/usb|}} and provides a BioAPI 1.10 device, which can then be interfaced to pam for authentication by user programs. The driver can be downloaded from http://www.upek.com/support/dl_linux_bsp.asp; see the [[How to enable the fingerprint reader|corresponding HOWTO]] for detailed instructions.

==Related Links==
* [http://www.trustedreviews.com/article.aspx?page=1643&head=36 Review from TrustedReviews of the fingerprint scanner]
* [http://biomark.org.ru/en/ A (Russian) project that provides support for a (different model) of fingerprint scanner] (also a USB device, though)
* [http://www.upek.com/support/pdf/UPEK_flyer_TCS3_TCD4.pdf TouchStrip TCS3/TCD4 spec sheet]
* [http://www.qrivy.net/~michael/blua/ A branch of the BioAPI reference implementation]

==Models featuring this Technology==
*ThinkPad {{R52}}, {{R60}}
*ThinkPad {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}
*ThinkPad {{X41}}, {{X41T}}, {{X60}}, {{X60s}}, {{X61s}}
*ThinkPad {{Z60m}}, {{Z60t}}, {{Z61m}}, {{Z61p}}, {{Z61t}}

[[Category:Glossary]]

How to enable the integrated fingerprint reader with ThinkFinger

2007-09-16T02:52:59Z

Quartsize:

How to enable the integrated fingerprint reader with ThinkFinger

2007-09-16T02:30:22Z

Quartsize:

How to enable the integrated fingerprint reader with ThinkFinger

2007-09-16T02:21:17Z

Quartsize: /* GNOME */

How to enable the integrated fingerprint reader with ThinkFinger

2007-09-16T01:35:14Z

Quartsize: /* Packages */