I don't know at all ArchLinux, but what strikes me is that you add
four different lines for pam_thinkfinger, while AFAIK the one in the
README is sufficient.

Mostly, if you go for /etc/pam.d/thinkfinger, I'd do the following
(untested, but I guess it should work):
=3D=3D=3D=3D=3D
/etc/pam.d/thinkfinger:
auth sufficient pam_thinkfinger.so
[pam_unix.so doesn't belong to thinkfinger]

/etc/pam.d/other:
#%PAM-1.0
@include thinkfinger
auth required pam_unix.so
account required pam_unix.so
password required pam_unix.so
session required pam_unix.so
[only one line modification]

/etc/pam.d/su:
#%PAM-1.0
@include thinkfinger
auth required pam_unix.so
account required pam_unix.so
session required pam_unix.so
[only one line modification]
=3D=3D=3D=3D=3D

About /etc/pam.d/su I don't understand why it doesn't include
/etc/pam.d/other, but this is another story :-)

Moreover, have you tried to authenticate with a password when the
prompt says "Password or swipe finger: "? AFAIK you need the
try_first_pass option for pam_unix.so, as explained at [2].
In both cases the user should change something, so I'll go for a mix
of both: add /etc/pam.d/thinkfinger and let the user apply the
one-line modification to any service he needs.
Well, I'm mostly for one-solution-for-all in the upstream sources than
different solution for different distributions ;-)

Thx, bye,
Gismo / Luca

Footnotes:=20
[1] I'm refactoring the patch to be separated from pam_thinkfinger.c,
as discussed with Timo
[2] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=3D68

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFvz8uVAp7Xm10JmkRAiUEAKCQBDsNsKEj4sUycRv1h48kgBiJZgCeLo3C
RAuXhGYawWgOZ+uP6MxSOwY=
=JcIA
-----END PGP SIGNATURE-----
--=-=-=--