[Thinkfinger-devel] (no subject)

[Christoph Siegenthaler]

Hi Sigi,

I can't use a clean rev 65 build of thinkfinger to login.
The strange thing is that "su" works. If I try to login and swipe my
finger the login fails without an error and the login-shell reappears.
I haven't changed anything in my pam settings in between.
Is this likely to be a somehow misconfigured pam or could there be an
error in the changes made to thinkfinger in between?

What version of PAM are you using?
Timo

Hi Timo

I'm using pam 0.81 and have configured it like this -> [1].
My problem has slightly altered - after a reboot "su" no longer works at all. Login with password works, but "su" directly results in a "password incorrect" (if I remember correctly, I'm not at my Linux box atm).

Cheers Sigi

[1] http://wiki.archlinux.org/index.php/Thinkfinger

[Timo Hoenig]

Hi Sigi,

Post by Christoph Siegenthaler
I'm using pam 0.81 and have configured it like this -> [1].

The revision you've been using was not playing well with PAM < 0.99.1.0.
SVN HEAD should work fine, also the upcoming release (ThinkFinger 0.2.2)
which I'm about to roll includes those fixes.

Post by Christoph Siegenthaler
My problem has slightly altered - after a reboot "su" no longer works
at all. Login with password works, but "su" directly results in a
"password incorrect" (if I remember correctly, I'm not at my Linux box
atm).

Please get back if you still have problems.

Thanks,

Timo

[Christoph Siegenthaler]

Hi again
and please excuse the missing subject of my previous mail - I hate
webmail UIs...

ThinkFinger rev 72 works perfectly without patching! Thank you a lot for
adding support for pam <= 0.81.

Sigi

Hi Sigi,

Post by Christoph Siegenthaler
I'm using pam 0.81 and have configured it like this -> [1].

The revision you've been using was not playing well with PAM < 0.99.1.0.
SVN HEAD should work fine, also the upcoming release (ThinkFinger 0.2.2)
which I'm about to roll includes those fixes.

Post by Christoph Siegenthaler
My problem has slightly altered - after a reboot "su" no longer works
at all. Login with password works, but "su" directly results in a
"password incorrect" (if I remember correctly, I'm not at my Linux box
atm).

Please get back if you still have problems.
Thanks,
Timo

[Timo Hoenig]

Hi Sigi,

Post by Christoph Siegenthaler
Hi again
and please excuse the missing subject of my previous mail - I hate
webmail UIs...

No worries.

Post by Christoph Siegenthaler
ThinkFinger rev 72 works perfectly without patching! Thank you a lot for
adding support for pam <= 0.81.

Perfect. Thanks for getting back. Oh. and by the way: All the credit
for the PAM < 0.99.1.0 support goes directly to Stephan and Luca ;-)

Timo

[Christoph Siegenthaler]

Post by Timo Hoenig
Perfect. Thanks for getting back. Oh. and by the way: All the credit
for the PAM < 0.99.1.0 support goes directly to Stephan and Luca ;-)

Thank you Stephan and Luca for the submitted changes and the competent
help in the ML!

And now to something completely different:
I recently stumbled over slock [1], a simple screen locker for x and a
patch to get it working with ThinkFinger. I like the idea of being able
to lock the screen with a keystroke and unlocking it with a finger
swipe. I have to problems:
- the patch uses lt-tf-tool which isn't in thinkfinger (anymore?)
- I need root privileges to run tf-tool (or - to be more precisely - to
access the usb device)

Do I need to use pam in any way to use slock as "unprivileged" user?

Evening all,
Sigi

[1] http://www.suckless.org/wiki/tools/xlib

[Luca Capello]

Hello!

Post by Christoph Siegenthaler

Perfect. Thanks for getting back. Oh. and by the way: All the
credit for the PAM < 0.99.1.0 support goes directly to Stephan and
Luca ;-)

Thank you Stephan and Luca for the submitted changes and the
competent help in the ML!

You're welcome :-D

Post by Christoph Siegenthaler
I recently stumbled over slock [1], a simple screen locker for x and
a patch to get it working with ThinkFinger. I like the idea of being
able to lock the screen with a keystroke and unlocking it with a
- the patch uses lt-tf-tool which isn't in thinkfinger (anymore?)
- I need root privileges to run tf-tool (or - to be more precisely -
to access the usb device)

I guess the patch you stumbled over is at [1]. Please read the full
thread and Timo's reply: directly calling tf-tool isn't the proper way
to use PAM authentication, thus you should contact slock upstream
author and discuss the problem with him.

AFAIK, ATM only one "end-user" program (i.e., not authentication ones
like su or sudo) works out-of-the-box with ThinkFinger and it's GDM.

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/78

[Sean McNamara]

Post by Luca Capello
Hello!

Post by Christoph Siegenthaler

Perfect. Thanks for getting back. Oh. and by the way: All the
credit for the PAM < 0.99.1.0 support goes directly to Stephan and
Luca ;-)

Thank you Stephan and Luca for the submitted changes and the
competent help in the ML!

You're welcome :-D

Post by Christoph Siegenthaler
I recently stumbled over slock [1], a simple screen locker for x and
a patch to get it working with ThinkFinger. I like the idea of being
able to lock the screen with a keystroke and unlocking it with a
- the patch uses lt-tf-tool which isn't in thinkfinger (anymore?)
- I need root privileges to run tf-tool (or - to be more precisely -
to access the usb device)

I guess the patch you stumbled over is at [1]. Please read the full
thread and Timo's reply: directly calling tf-tool isn't the proper way
to use PAM authentication, thus you should contact slock upstream
author and discuss the problem with him.
AFAIK, ATM only one "end-user" program (i.e., not authentication ones
like su or sudo) works out-of-the-box with ThinkFinger and it's GDM.

How did you get GDM to work with ThinkFinger?

I am using ThinkFinger 0.2 release on Fedora Core 6 x86_64 with a
Thinkpad X60. Finger-swiping works perfectly with "su" for either root
or a user.

[***@vk5rms ~]$ su root
Password or swipe finger:
[***@vk5rms sean]#

Fedora Core 6 by default uses gdm as the desktop manager, even though I
am using KDE. When I swipe, nothing happens (even if I have first typed
my username and hit enter). I have confirmed I'm using gdm by running
`ps -ef | grep gdm`. Do you think this is a Fedora-specific issue with gdm?

Also, what kind of work needs to be done to support this in kdesu and
kdesktop_lock? It's unfortunate that this seems to be an issue where
code changes are necessary for each program using Thinkfinger.. I
thought the purpose of PAM is to facilitate adapting varied
authentication mechanisms to varied program frontends?

But really, this is good progress :) For console apps I do have
perfectly-good finger support as it stands today. Looks like you guys
took the ball and ran with it since I posted last - great job!

Thanks,

Sean

Post by Luca Capello
Thx, bye,
Gismo / Luca
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/78
------------------------------------------------------------------------
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
------------------------------------------------------------------------
_______________________________________________
Thinkfinger-devel mailing list
https://lists.sourceforge.net/lists/listinfo/thinkfinger-devel

[Sean McNamara]

The short answer is: yes. I don't have a common-auth, however.

My gdm file is this: http://glue.umd.edu/~jcd/gdm.txt [.txt for MIME
recognition by httpd]

The directory listing is: http://glue.umd.edu/~jcd/pamd.txt

Thanks for your help,

Sean M.

Post by Sean McNamara
How did you get GDM to work with ThinkFinger?
I am using ThinkFinger 0.2 release on Fedora Core 6 x86_64 with a
Thinkpad X60. Finger-swiping works perfectly with "su" for either root
or a user.
Fedora Core 6 by default uses gdm as the desktop manager, even though I
am using KDE. When I swipe, nothing happens (even if I have first typed
my username and hit enter). I have confirmed I'm using gdm by running
`ps -ef | grep gdm`. Do you think this is a Fedora-specific issue with gdm?

Long time ago since I last used Fedora - is there something like
/etc/pam.d/gdm on your system?

[Sean McNamara]

Hi:

So, after my experiences so far with ThinkFinger... I have noticed that
a TON of applications, between Fedora and KDE, have this habit of asking
for "Password for root". This may be a different PAM API call that is
not being hooked up to thinkfinger (just my intuition). These are mostly
system administration utilities, which pop up and ask you for the root
password:

Loading Image...

I would like for utilities like this to be supported by ThinkFinger. Do
any of you know whether this is a limitation of ThinkFinger, or a
limitation of the utility? What would be required for the utility to
automatically enter the user it wants to authenticate as (root, 99% of
the time), but allow the user to swipe their finger? This is common to:

kdesu, kdesktop_lock, pirut, smart, kuser, Smart Package Manager, and
all the Red Hat admin utilities.

It's obvious that PAM is being used differently, where gdm and a shell
both ask you for a username then a password, but the other applications
ask you for "Password for root" and have apparently hard-coded that it
will request PAM to authenticate the root user. pam_thinkfinger.so
appears to be capable of inserting the string "Password or swipe finger:
" into every application that supports PAM properly.

Is this a limitation of the apps I'm using, like Timo said?

Thanks for looking into this some more,

-Sean

#%PAM-1.0
auth sufficient pam_thinkfinger.so
auth required pam_env.so use_first_pass nullok_secure
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
session optional pam_console.so
?
Cheers Sigi

[Luca Capello]

Hello!

Post by Sean McNamara
So, after my experiences so far with ThinkFinger... I have noticed that
a TON of applications, between Fedora and KDE, have this habit of asking
for "Password for root". This may be a different PAM API call that is
not being hooked up to thinkfinger (just my intuition). These are mostly
system administration utilities, which pop up and ask you for the root
http://i56.photobucket.com/albums/g162/allquixotic/laptop/kdesu.png

I'm not a KDE user, but isn't this just a frontend to su?

Post by Sean McNamara
I would like for utilities like this to be supported by ThinkFinger.

/me too.

Post by Sean McNamara
Do any of you know whether this is a limitation of ThinkFinger, or a
limitation of the utility?

As Timo said, I think this is a limitation of the utility, otherwise
all the others wouldn't work.

Post by Sean McNamara
What would be required for the utility to automatically enter the

[...]

Post by Sean McNamara
It's obvious that PAM is being used differently, where gdm and a
shell both ask you for a username then a password, but the other
applications ask you for "Password for root"

Well, GDM and login (which is what I guess you're referring as shell)
deal with authenticating every user on the system, while most of the
others let you become root through su, usually.

Post by Sean McNamara
Is this a limitation of the apps I'm using, like Timo said?

As I already said, I think so.

I'd go for an application by application approach, which I'm sorry as
Timo I'm not going to deal with, as I don't really have the time.

Thx, bye,
Gismo / Luca

[Aaron Mulder]

My experience with the non-free driver is that even once you set up
PAM for it, it requires a nontrivial amount of tweaking to get
everything working "just right", KDE included. What I can recall of
this under openSUSE 10.2 is:
- You probably don't want to enable it for *everything* (such as, the
SSH daemon)
- KDM did not show a graphical prompt at first, but if I hit "enter"
in the password field and then swiped, it worked
- kdesu appeared to hang when invoked originally -- I think it wasn't
showing a graphical prompt but expected input to one nevertheless --
no amount of swiping helped. After a *long* timeout it did something
else
- su and sudo from the command prompt had different behavior -- I
think one gave a text prompt and the other a graphical prompt (but
both prompts for finger swipes)
- logging in at a text console gave a text prompt for a finger swipe
- I fixed most of the KDE problems by applying a hack to save certain
X data to environment variables and making the PAM module aware of
that. That made KDE and kdesu give visible graphical prompts, but it
broke either sudo or su and kdesu prompted twice always
- With some more hacking with PAM parameters I got the sudo/su
working again after the KDE change
- There was still the issue that kdesu prompted twice always
(Speculating once for user and once for password? Or once to cache a
password and again when it found the password wasn't cached?). I also
suppressed that by commenting out a big chunk of kdesu code and
rebuilding it.

For what it's worth, in SuSE there's a "common-auth" PAM file that
pretty much everything else uses, and putting the settings in there is
the best way to get everything to *try* to use the fingerprint reader.
Then you can back it out of the places you specifically don't want
it.

Thanks,
Aaron

Post by Luca Capello
Hello!

Post by Sean McNamara
So, after my experiences so far with ThinkFinger... I have noticed that
a TON of applications, between Fedora and KDE, have this habit of asking
for "Password for root". This may be a different PAM API call that is
not being hooked up to thinkfinger (just my intuition). These are mostly
system administration utilities, which pop up and ask you for the root
http://i56.photobucket.com/albums/g162/allquixotic/laptop/kdesu.png

I'm not a KDE user, but isn't this just a frontend to su?

Post by Sean McNamara
I would like for utilities like this to be supported by ThinkFinger.

/me too.

Post by Sean McNamara
Do any of you know whether this is a limitation of ThinkFinger, or a
limitation of the utility?

As Timo said, I think this is a limitation of the utility, otherwise
all the others wouldn't work.

Post by Sean McNamara
What would be required for the utility to automatically enter the

[...]

Post by Sean McNamara
It's obvious that PAM is being used differently, where gdm and a
shell both ask you for a username then a password, but the other
applications ask you for "Password for root"

Well, GDM and login (which is what I guess you're referring as shell)
deal with authenticating every user on the system, while most of the
others let you become root through su, usually.

Post by Sean McNamara
Is this a limitation of the apps I'm using, like Timo said?

As I already said, I think so.
I'd go for an application by application approach, which I'm sorry as
Timo I'm not going to deal with, as I don't really have the time.
Thx, bye,
Gismo / Luca
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Thinkfinger-devel mailing list
https://lists.sourceforge.net/lists/listinfo/thinkfinger-devel

[Sean McNamara]

Aaron,

Thanks for sharing your experiences with the non-free driver. Have you
tried to use your patched kdesu with ThinkFinger? If so, what are the
results? If not, I can readily test any patches you have against the
kdesu source with my own (working) ThinkFinger 0.2 on Fedora6 x86_64.

As Timo has said before, no one really wants to have to patch tons of
applications across tons of distros to be compatible with ThinkFinger. I
don't disagree, but it seems like individual app patches are necessary
in cases where authors have only partially implemented PAM
authentication (perhaps by assuming password authentication only). An
effort by ThinkFinger enthusiasts to get e.g. KDE developers to enhance
kdesu, kdm, etc. to support ThinkFinger may also benefit future
projects, for other fingerprint readers, that decide to use PAM
authentication. Since I'm pretty active in the KDE testing community,
I'll start this off by talking with some of the KDE core team about it.
I will try to look at one of the simplest examples of incomplete PAM
support (kdesu may be just the right app to look at) and isolate where
the code does this. Hopefully this will motivate their desire to enhance
these apps, either for 3.5 or KDE4 or both.

On an unrelated note, it would be nice (but likely introduce even more
problems) if pam_thinkfinger had graphical support similar to what is
offered in the non-free driver. Not sure if this is being worked on
right now. The 0.2 release seems to be "functional" in the sense that it
gets the job done at the low level; anything on top of this is just
icing on the cake.

Luca,

Yes, gdm, login, and su are the main ones I've tested and which work
flawlessly with pam_thinkfinger. I think I understand the issues at hand
here - but since I'm really more of a power user/tester/enthusiast than
a master of PAM, I'm not well-equipped to provide patches to development
teams that have released apps with incomplete PAM support. I guess all I
can do (and what I intend to do) is to be as specific as possible when
speaking with maintainers of e.g. the KDE apps that use PAM
authentication, in telling them what I'd like to see improved. Before
doing this I am going to spend a weekend trying to build the latest
development nightly of KDE4 to see if any work has already been done on
this. Presently I am not *that* concerned with getting other utilities
(e.g. Fedora's system administration stack) to support ThinkFinger... I
am just going to focus on KDE apps for now, since kdesu is one of the
most frequent prompts for my password that I encounter on a daily basis.

Thanks,

Sean

Post by Aaron Mulder
My experience with the non-free driver is that even once you set up
PAM for it, it requires a nontrivial amount of tweaking to get
everything working "just right", KDE included. What I can recall of
- You probably don't want to enable it for *everything* (such as, the
SSH daemon)
- KDM did not show a graphical prompt at first, but if I hit "enter"
in the password field and then swiped, it worked
- kdesu appeared to hang when invoked originally -- I think it wasn't
showing a graphical prompt but expected input to one nevertheless --
no amount of swiping helped. After a *long* timeout it did something
else
- su and sudo from the command prompt had different behavior -- I
think one gave a text prompt and the other a graphical prompt (but
both prompts for finger swipes)
- logging in at a text console gave a text prompt for a finger swipe
- I fixed most of the KDE problems by applying a hack to save certain
X data to environment variables and making the PAM module aware of
that. That made KDE and kdesu give visible graphical prompts, but it
broke either sudo or su and kdesu prompted twice always
- With some more hacking with PAM parameters I got the sudo/su
working again after the KDE change
- There was still the issue that kdesu prompted twice always
(Speculating once for user and once for password? Or once to cache a
password and again when it found the password wasn't cached?). I also
suppressed that by commenting out a big chunk of kdesu code and
rebuilding it.
For what it's worth, in SuSE there's a "common-auth" PAM file that
pretty much everything else uses, and putting the settings in there is
the best way to get everything to *try* to use the fingerprint reader.
Then you can back it out of the places you specifically don't want
it.
Thanks,
Aaron

Post by Luca Capello
Hello!

Post by Sean McNamara
So, after my experiences so far with ThinkFinger... I have noticed that
a TON of applications, between Fedora and KDE, have this habit of asking
for "Password for root". This may be a different PAM API call that is
not being hooked up to thinkfinger (just my intuition). These are mostly
system administration utilities, which pop up and ask you for the root
http://i56.photobucket.com/albums/g162/allquixotic/laptop/kdesu.png

I'm not a KDE user, but isn't this just a frontend to su?

Post by Sean McNamara
I would like for utilities like this to be supported by ThinkFinger.

/me too.

Post by Sean McNamara
Do any of you know whether this is a limitation of ThinkFinger, or a
limitation of the utility?

As Timo said, I think this is a limitation of the utility, otherwise
all the others wouldn't work.

Post by Sean McNamara
What would be required for the utility to automatically enter the

[...]

Post by Sean McNamara
It's obvious that PAM is being used differently, where gdm and a
shell both ask you for a username then a password, but the other
applications ask you for "Password for root"

Well, GDM and login (which is what I guess you're referring as shell)
deal with authenticating every user on the system, while most of the
others let you become root through su, usually.

Post by Sean McNamara
Is this a limitation of the apps I'm using, like Timo said?

As I already said, I think so.
I'd go for an application by application approach, which I'm sorry as
Timo I'm not going to deal with, as I don't really have the time.
Thx, bye,
Gismo / Luca
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Thinkfinger-devel mailing list
https://lists.sourceforge.net/lists/listinfo/thinkfinger-devel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Thinkfinger-devel mailing list
https://lists.sourceforge.net/lists/listinfo/thinkfinger-devel

[Timo Hoenig]

Hi Sean,

Post by Sean McNamara
How did you get GDM to work with ThinkFinger?
I am using ThinkFinger 0.2 release on Fedora Core 6 x86_64 with a
Thinkpad X60. Finger-swiping works perfectly with "su" for either root
or a user.

I'm not familiar with Fedora. Anyone else on the list who could jump
in?

Post by Sean McNamara
Fedora Core 6 by default uses gdm as the desktop manager, even though I
am using KDE. When I swipe, nothing happens (even if I have first typed
my username and hit enter). I have confirmed I'm using gdm by running
`ps -ef | grep gdm`. Do you think this is a Fedora-specific issue with gdm?

Wearing my SuSE hat: It just works. Also, it seems that other
distributions (Gentoo, Debian, ArchLinux, Ubuntu) work fine -- otherwise
we'd have received more reports.

Post by Sean McNamara
Also, what kind of work needs to be done to support this in kdesu and
kdesktop_lock? It's unfortunate that this seems to be an issue where
code changes are necessary for each program using Thinkfinger.. I
thought the purpose of PAM is to facilitate adapting varied
authentication mechanisms to varied program frontends?

Hell, no. I do not want to touch *any* application to make it
compatible with ThinkFinger. Not. A. Single. One. Those which do not
work are 99% not properly prepared for PAM. They are just expecting the
common user+password authentication which obviously is not the only
one...

Post by Sean McNamara
But really, this is good progress :) For console apps I do have
perfectly-good finger support as it stands today. Looks like you guys
took the ball and ran with it since I posted last - great job!

Well, there's still a lot of work pending. Probably not on our side,
though.

Thanks,

Timo