How to enable the integrated fingerprint reader with ThinkFinger

From ThinkWiki
Revision as of 16:22, 4 September 2007 by Whoopie79 (Talk | contribs) (Configuring PAM to use ThinkFinger: cleanup and additions)
Jump to: navigation, search

How to enable the fingerprint reader has a good explanation for using the fingerprint reader with the closed-source binary driver. But there is also an opensource project called ThinkFinger which does the same, but open.

Installing from source

Speaking for Debian, there are no packages of ThinkFinger in the repositories yet (cf. bug #409563), so I describe the installation from source. If you are using Gentoo, you can just emerge sys-auth/thinkfinger.

packages for Debian (testing) are available here: [1]
packages for Fedora Core 6 are available in "extras" repository (#yum install thinkfinger)
openSUSE 10.2 includes the package "libthinkfinger" (version 0.1-7) - you will find newer packages here: [2]

Download thinkfinger-0.3.tar.gz from the homepage and unpack it somewhere, make sure you have the gcc compiler, libtool, pkgconfig, libusb-dev and libpam0g-dev installed, then:

$ cd thinkfinger-0.3

$ ./configure --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger

$ make

# make install

/lib/security is the dir, where pam assumes its modules on Debian and openSUSE, it may vary for your distro!
for openSUSE use this configure-command:

$ ./configure --prefix=/usr --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger

If everything went ok assert that you find in /lib/security typing:

$ ls /lib/security

Testing the driver

Now the driver is installed and should be working. You can try it (as root) with

# tf-tool --acquire


# tf-tool --verify

This will ask you to swipe your finger three times, save the fingerprint to /tmp/test.bir and then verify your fingerprint with the bir-file.

Configuring PAM to use ThinkFinger

Now you can configure pam to use ThinkFinger:

Open /etc/pam.d/common-auth:

In FC6 this file is "/etc/pam.d/system-auth"

# nano -w /etc/pam.d/common-auth

Add this line before any pam_unix or pam_unix2 directives:

auth     sufficient

If your PAM uses the pam_unix and not the pam_unix2 module, you need to pass a specific argument in the /etc/pam.d/common-auth directive to make it consider the password entered at the pam_thinkfinger prompt.

auth     required try_first_pass

For instance, /etc/pam.d/common-auth looks like this:

auth    sufficient
auth    required nullok_secure try_first_pass

On openSUSE 10.2, it looks like this now:

auth    required
auth    sufficient
auth    required

Now we are ready to add users to thinkfinger. As "make install" did not create /etc/pam_thinkfinger, you need to create it now:

# mkdir /etc/pam_thinkfinger

And now, you can add a fingerprint for a user with:

# tf-tool --add-user $USERNAME

Now the user should be able to login with his finger instead of the password.

If you would like to use thinkfinger for su, you have to enroll the fingerprint for root user with:

# tf-tool --add-user root

You should see the "Password or swipe finger:" prompt when trying to sudo or su. If you don't, you probably do not have the "User level driver support" compiled into your kernel or the "uinput" module loaded!



gksu/gksudo doesn't work correctly. It just stays invisible. When starting a su privileged application such as synaptics you will not get prompted for the password. Nevertheless you can swipe your finger and it should authenticate you. Starting synaptics twice makes gksudo visible.

There are two possibilities to solve it:

  • Changing the string "Password or swipe finger:" to a plain "Password:" (like sudo normally would do) in the file pam/pam_thinkfinger.c of the thinkfinger source directory. Of course, in the console you will then only see a "Password:" instead of "Password or swipe finger:" but this is still more usefull than having gksu/gksudo crashing everytime.
  • Patching libgksu with the following patch. This is also a nasty hack until a better solution is implemented.
--- libgksu-2.0.3/libgksu/libgksu.c.orig	2007-06-17 16:00:24.000000000 +0200
+++ libgksu-2.0.3/libgksu/libgksu.c		2007-06-17 16:00:47.000000000 +0200
@@ -2663,7 +2663,7 @@
       for (counter = 0; counter < 50; counter++)
-	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0)
+	  if (strncmp (buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp (buffer, "Password or swi", 15) == 0)
 	  read_line (parent_pipe[0], buffer, 256);
@@ -2675,7 +2675,7 @@
       if (context->debug)
 	fprintf (stderr, "brute force GNOME_SUDO_PASS ended...\n");
-      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0)
+      if (strncmp(buffer, "GNOME_SUDO_PASS", 15) == 0 || strncmp(buffer, "Password or swi", 15) == 0)
 	  gchar *password = NULL;
 	  gboolean prompt_grab;


Integration in KDE and kdm seems not to be easily possible now. There is a filed bug at where you can vote for this.

Moreover, kdm in openSUSE 10.3 crashes when pam_thinkfinger is enabled. A possible "workaround" is downgrading to thinkfinger 0.2.2.

This Howto was copied from Installing Ubuntu 6.06 on a ThinkPad T43#Fingerprint_Reader and then slightly modified.