Discussion:
[Thinkfinger-devel] Release: ThinkFinger 0.2
Timo Hoenig
2007-01-12 15:02:15 UTC
Permalink
Hello,

I'm happy to announce the release of ThinkFinger 0.2.

You can download the tar ball in the files section of the project on
SourceForge:

* http://sf.net/project/showfiles.php?group_id=179573

As this is the first official release I am quoting the complete README
below to give an explanation what ThinkFinger is about and what it does.

Thanks goes out to all early birds who were testing the library even at
the very first steps in development. I appreciate this very much.

Thanks,

Timo

ThinkFinger
===========

ThinkFinger is a driver for the SGS Thomson Microelectronics fingerprint
reader found in most IBM/Lenovo ThinkPads.

It is devided into two parts: libthinkfinger and pam_thinkfinger.

libthinkfinger is a library to be used in order to communicate with the
fingerprint reader. The utility 'tf-tool' can be used to acquire and to
verify fingerprints.

Simple test tool: tf-tool
=========================

Usage: tf-tool [--acquire | --verify] [--verbose] [--no-init]

To acquire a fingerprint run 'tf-tool --acquire'. You will be prompted
to swipe your finger. It needs three successful swipes to get a
fingerprint. This fingerprint is being stored in '/tmp/test.bir'.

To verify a fingerprint run 'tf-tool --verify'. tf-tool will read a
fingerprint image from '/tmp/test.bir' and compare that with the finger
which is being swiped.

Note: It is likely that you have to run 'tf-tool' as root as it needs
to access the USB device. On most distribution the device node can not
be accessed by a regular user.

Pluggable Authentication Module: pam_thinkfinger
================================================

The pluggable authentication module pam_thinkfinger can be used for PAM
(e.g. to log into your system). The module needs to be copied to the
location where PAM expects the modules to reside. On most GNU/Linux
distributions PAM modules are stored in '/lib/security'.

In order to use pam_thinkfinger, PAM needs to be aware of the module.
To achieve this please edit '/etc/pam.d/common-auth'. You are required
to add the following directives:

auth sufficient pam_thinkfinger.so
password sufficient pam_thinkfinger.so

See [1] for a complete example how '/etc/pam.d/common-auth' looks like.

The module does only trigger for users which have deposited their
fingerprint in '/etc/pam_thinkfinger/'.

E.g. if the user 'bob' wants to login using his fingerprint, his
fingerprint needs to be stored at '/etc/pam_thinkfinger/bob.bir'. See
[2] for a more detailed example.

On some systems it is required to execute 'tf-init' once to initialize
the fingerprint reader.

PAM Compatibility
=================

The pluggable authentication module pam_thinkfinger should work with all
PAM aware applications.

Authors
=======

Timo Hoenig <***@suse.de>, <***@nouse.net>
Pavel Machek <***@suse.cz>

Project Page
============

* http://www.sourceforge.net/projects/thinkfinger

SVN
===

* svn co https://svn.sourceforge.net/svnroot/thinkfinger

Mailing List
============

* https://lists.sourceforge.net/lists/listinfo/thinkfinger-devel

[1] Example for a ThinkFinger-enabled '/etc/pam.d/common-auth'

#%PAM-1.0

auth required pam_env.so
auth sufficient pam_thinkfinger.so
password sufficient pam_thinkfinger.so
auth required pam_unix2.so

[2] Example how to store a fingerprint image for user 'bob'

***@host~> tf-tool --acquire

( Now user 'bob' has to swipe his finger three times )

tf-tool: intialization: success
Please swipe your finger...
Please swipe your finger...
Please swipe your finger...
Writing bir file...
tf-tool: acquire successful
tf-tool: fingerprint bir: /tmp/test.bir
***@host:~> ls -al /tmp/test.bir
-rw------- 1 root root 174 2007-01-12 14:59 /tmp/test.bir
***@host:~> mv /tmp/test.bir /etc/pam_thinkfinger/bob.bir

Now 'bob' can authenticate himself by swiping his finger.
Alexander Reelsen
2007-01-12 16:09:23 UTC
Permalink
Hi Timo (and the rest)

On Fri, 12 Jan 2007 16:02:15 +0100
Post by Timo Hoenig
Hello,
I'm happy to announce the release of ThinkFinger 0.2.
tf-tool works, but the pam module does not compile on Debian sid -
looks like the pam module uses pam_prompt() which does not seem to be
available under Debian at a first glance (I have no time to investigate
the issue further at the moment). Furthermore I do not have a
security/pam_ext.h include file. Does Debian ship with a too old or not
patched PAM?
A short investigation revealed that pam_prompt() seems to be some
addition. Perhaps you can clear that up, as I am no PAM programmer and
have no knowledge whether there is currently a maintained upstream
release.

Have a nice day and a big thx for putting up the effort for creating
such a free tool.


--Alexander
--
http://www.emplify.de
Timo Hoenig
2007-01-12 16:39:50 UTC
Permalink
Hi Alexander,
Post by Alexander Reelsen
tf-tool works, but the pam module does not compile on Debian sid -
looks like the pam module uses pam_prompt() which does not seem to be
available under Debian at a first glance (I have no time to investigate
the issue further at the moment). Furthermore I do not have a
security/pam_ext.h include file. Does Debian ship with a too old or not
patched PAM?
Uh, doesn't sound too good. I'd have to get my hands on some recent
Debian/Ubuntu machine to investigate. If someone on the list knows by
heart, please speak up.
Post by Alexander Reelsen
A short investigation revealed that pam_prompt() seems to be some
addition. Perhaps you can clear that up, as I am no PAM programmer and
have no knowledge whether there is currently a maintained upstream
release.
Oh, I'm not a PAM programmer either -- at least until the day before
yesterday :-) But it's definitely something which should be can easily.
Post by Alexander Reelsen
Have a nice day and a big thx for putting up the effort for creating
such a free tool.
Very welcome!

Have a nice weekend,

Timo
Michael
2007-01-12 20:17:18 UTC
Permalink
Post by Alexander Reelsen
Post by Timo Hoenig
I'm happy to announce the release of ThinkFinger 0.2.
tf-tool works, but the pam module does not compile on Debian sid -
looks like the pam module uses pam_prompt() which does not seem to be
available under Debian at a first glance (I have no time to
investigate the issue further at the moment). Furthermore I do not
have a security/pam_ext.h include file. Does Debian ship with a too
old or not patched PAM?
FYI, I also have the same issue on my Gentoo 2006.1, which uses PAM
0.78-r3.
Alexander Reelsen
2007-01-12 20:29:00 UTC
Permalink
Hi

On Fri, 12 Jan 2007 15:17:18 -0500
Post by Michael
Post by Alexander Reelsen
tf-tool works, but the pam module does not compile on Debian sid -
looks like the pam module uses pam_prompt() which does not seem to
be available under Debian at a first glance (I have no time to
investigate the issue further at the moment). Furthermore I do not
have a security/pam_ext.h include file. Does Debian ship with a too
old or not patched PAM?
FYI, I also have the same issue on my Gentoo 2006.1, which uses PAM
0.78-r3.
Ooops. Forgot to send my last post to the whole ML... Here's a snippet

Debian uses PAM 0.79, whereas the pam_prompt() function has been
introduced later (the changelog entry about adding pam_prompt() in the
pam source dates back to 2005 though). Seems it has been added in PAM
0.81...

Is there anything special with PAM 0.99 that noone is using it? Any
significant changes?

Debian used the freeze as reason not to introduce it, see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360460

It might be in Debians experiemental tree, but I have no time to check
that at the moment.


--Alexander
--
http://www.emplify.de
Timo Hoenig
2007-01-13 12:59:20 UTC
Permalink
Post by Alexander Reelsen
Ooops. Forgot to send my last post to the whole ML... Here's a snippet
Debian uses PAM 0.79, whereas the pam_prompt() function has been
introduced later (the changelog entry about adding pam_prompt() in the
pam source dates back to 2005 though). Seems it has been added in PAM
0.81...
Thanks for the update.

Probably there is a way to add support for older PAM versions, too.
Patches welcome, otherwise I will look at it myself once I find some
time.
Post by Alexander Reelsen
Is there anything special with PAM 0.99 that noone is using it? Any
significant changes?
Noone using it?

***@nouse:~> rpm -qv pam
pam-0.99.6.3-24

;-)
Post by Alexander Reelsen
Debian used the freeze as reason not to introduce it, see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360460
It might be in Debians experiemental tree, but I have no time to check
that at the moment.
Even if it is in the experimental tree, I think that having support for
PAM <= 0.81 would be nice.

Timo

Loading...