[Thinkfinger-devel] thinkfinger pam patch

[W***@gmx.de]

Hello Mailinglist,

At first, thanks for this Project its.... wow :)

The attached patch make the subversion Revision 43 works with Gentoo.
Using pam-0.78-r5.

PS: where is pam_prompt used ? I dont found it in very old PAM source
code, but in the current pam 0.99 it isnt documented ,too.

my PAM_CONV conv code works with this versions.

More infos in the Patch header.

Perhaps it helps someone.

Additional it pretends the Pam-modul for remote_user by using multiple
checks for a local or remote login.

(Remote User logged in with ssh can't make a su with fingerprint
anymore)

Greets,

White2001


ps: Second try. It seems, the first e-mail goes to the wrong Adresse.

[Luca Capello]

Hello!

Some comments from a non-pam expert and a not-so-skilled programmer.

On Mon, 29 Jan 2007 17:56:42 +0100, > Hello Mailinglist,

Post by W***@gmx.de
The attached patch make the subversion Revision 43 works with Gentoo.
Using pam-0.78-r5.

Have you tried the patch at [1]? If yes and it didn't work, please
post your problem. If no, can you give it a try?

Post by W***@gmx.de
PS: where is pam_prompt used ? I dont found it in very old PAM source
code, but in the current pam 0.99 it isnt documented ,too.

FWIW, pam_prompt() only information I could find is at [2].

Post by W***@gmx.de
More infos in the Patch header.

As I stated, I'm not a skilled programmer, but I'd say that your patch
is quite invasive: AFAIK pam_prompt() is what we need (at least for
PAM versions >= 0.99.1.0), so removing it instead of implementing it
for PAM <= 0.99.1.0 seems faulty to me.

Post by W***@gmx.de
Additional it pretends the Pam-modul for remote_user by using multiple
checks for a local or remote login.
(Remote User logged in with ssh can't make a su with fingerprint
anymore)

FYI, with the patch at [1], `ssh $MY_X60` gives me a "normal" prompt,
i.e. "Password: ", thus I guess pam_prompt() already takes care of
local or remote login.

Post by W***@gmx.de
Index: configure.in
===================================================================
--- configure.in (revision 43)
+++ configure.in (working copy)
@@ -33,6 +33,7 @@
AC_PROG_CC
AC_PROG_INSTALL
AC_PROG_LIBTOOL
+AM_PROG_CC_C_O

This removes the following warning on my Debian sid, too:

pam/Makefile.am:6: compiling `pam_thinkfinger.c' with per-target \
flags requires `AM_PROG_CC_C_O' in `configure.in'

Post by W***@gmx.de
Index: pam/pam_thinkfinger.c
===================================================================
--- pam/pam_thinkfinger.c (revision 43)
+++ pam/pam_thinkfinger.c (working copy)

[...]

Post by W***@gmx.de
+/* Password Management API's */
+PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
+ int argc, const char **argv)
+{
+ return PAM_SUCCESS;
+}

Please check the thread at [3].

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=56
[2] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/pam_vprompt.c?revision=1.1&view=markup
[3] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=19

[W***@gmx.de]

Hello

Post by Luca Capello
Some comments from a non-pam expert and a not-so-skilled programmer.
On Mon, 29 Jan 2007 17:56:42 +0100, > Hello Mailinglist,

Post by W***@gmx.de
The attached patch make the subversion Revision 43 works with Gentoo.
Using pam-0.78-r5.

Have you tried the patch at [1]? If yes and it didn't work, please
post your problem. If no, can you give it a try?

Ok, now i see it. Yes this is the good solution...
Why isn't this in SVN :)

Post by Luca Capello

Post by W***@gmx.de
PS: where is pam_prompt used ? I dont found it in very old PAM source
code, but in the current pam 0.99 it isnt documented ,too.

FWIW, pam_prompt() only information I could find is at [2].

Oh thanks... I thought pam_prompt is a obsoluete Function...
Now i understand...

Post by Luca Capello
As I stated, I'm not a skilled programmer, but I'd say that your patch
is quite invasive: AFAIK pam_prompt() is what we need (at least for
PAM versions >= 0.99.1.0), so removing it instead of implementing it
for PAM <= 0.99.1.0 seems faulty to me.

Soory, i'm missing the Information. But i looked at your [1].
But using this Function... not everybody using pam-0.99.

Post by Luca Capello

Post by W***@gmx.de
Additional it pretends the Pam-modul for remote_user by using multiple
checks for a local or remote login.
(Remote User logged in with ssh can't make a su with fingerprint
anymore)

FYI, with the patch at [1], `ssh $MY_X60` gives me a "normal" prompt,
i.e. "Password: ", thus I guess pam_prompt() already takes care of
local or remote login.

No it dont do this.
I think, on your setup you dont have pam_thinkpad in the ssh auth
chain ?

Do you use pam_thinkfinger for 'su' ?
Please try to use 'su' after a remote login.

Post by Luca Capello

Post by W***@gmx.de
+AM_PROG_CC_C_O

Good, i thought every line is bad.
Now i'm happy.. one line made you happy :)

Post by Luca Capello

Post by W***@gmx.de
Index: pam/pam_thinkfinger.c
===================================================================
--- pam/pam_thinkfinger.c (revision 43)
+++ pam/pam_thinkfinger.c (working copy)

[...]

Post by W***@gmx.de
+/* Password Management API's */
+PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
+ int argc, const char **argv)
+{
+ return PAM_SUCCESS;
+}

Please check the thread at [3].

Ok, i See its in Patch at [1] already included.
(I don't like this static PAM, too.)

Post by Luca Capello
Thx, bye,
Gismo / Luca
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=56
[2] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/pam_vprompt.c?revision=1.1&view=markup
[3] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=19

Perhaps this Patch should be integrated in the current Release,
Instead to set pam 0.99 as minimum Version.


I clean up and repost it without the elements out of [1] ?

Greets,

[Luca Capello]

Hello!

On Mon, 29 Jan 2007 20:11:42 +0100, > Hello

Post by W***@gmx.de

Post by Luca Capello
On Mon, 29 Jan 2007 17:56:42 +0100, > Hello Mailinglist,

Post by W***@gmx.de
The attached patch make the subversion Revision 43 works with Gentoo.
Using pam-0.78-r5.

Have you tried the patch at [1]? If yes and it didn't work, please
post your problem. If no, can you give it a try?

Ok, now i see it. Yes this is the good solution...
Why isn't this in SVN :)

Because the support for PAM < 0.99.1.0 isn't finished yet. I planned
to add the pam_syslog() as of [1], in order to fully mimic upstream
pam_vprompt().

Post by W***@gmx.de

Post by Luca Capello

Post by W***@gmx.de
Additional it pretends the Pam-modul for remote_user by using
multiple checks for a local or remote login.
(Remote User logged in with ssh can't make a su with fingerprint
anymore)

FYI, with the patch at [1], `ssh $MY_X60` gives me a "normal"
prompt, i.e. "Password: ", thus I guess pam_prompt() already takes
care of local or remote login.

No it dont do this.
I think, on your setup you dont have pam_thinkpad in the ssh auth
chain ?

Actually, my /etc/pam.d/ssh includes /etc/pam.d/common-auth, where
I've put pam_thinkfinger, thus SSH includes pam_thinkfinger as well.

Post by W***@gmx.de
Do you use pam_thinkfinger for 'su' ?

Sure!

Post by W***@gmx.de
Please try to use 'su' after a remote login.

Done and indeed you're right.

Post by W***@gmx.de
Perhaps this Patch should be integrated in the current Release,
Instead to set pam 0.99 as minimum Version.

Actually, this will be the case as soon as the patch will be
considered "completed", i.e. with pam_syslog().

Post by W***@gmx.de
I clean up and repost it without the elements out of [1] ?

Yes please, so I could test your patch from a remote login.

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=65

[Christoph Siegenthaler]

Hi and thank you at first for ThinkFinger! Looks promissing

I'm trying to write a PKGBUILD to use thinkfinger on ArchLinux [1],
which still has pam 0.81 in it's current repository.
(A PKGBUILD is a set of instructions for package installation similiar
to ebuilds, etc) See below..

I tried to build it with the current svn rev 54 and White2001's patch.
tf-tool seems to work for acquiring and verifying swipes but I can't get
it to accept a fingerprint for my user login.

I followed the README for editing /etc/pam.d/common-auth, which
strengely didn't exist before.

Any hints where to start looking for errors?

Cheers
Christoph Siegenthaler (aka Sigi)

[1] http://www.archlinux.org

PKGBUILD:
# Contributor: Christoph Siegenthaler
pkgname=thinkfinger-svn
pkgver=54
pkgrel=1
pkgdesc="ThinkFinger is a driver for the SGS Thomson Microelectronics
fingerprint reader found in most IBM/Lenovo ThinkPads"
url="http://thinkfinger.sourceforge.net/"
license="GPL"
depends=(pam)
makedepends=('subversion')
conflicts=('thinkfinger')
provides=('thinkfinger')
source=(pam.patch)
md5sums=()

_svntrunk=https://thinkfinger.svn.sourceforge.net/svnroot/thinkfinger
_svnmod=thinkfinger

build() {
cd $startdir/src

svn co $_svntrunk --config-dir ./ -r $pkgver $_svnmod

msg "SVN checkout done or server timeout"
msg "Starting make..."

cp -r $_svnmod $_svnmod-build
cd $_svnmod-build

patch -p0 -i ../pam.patch

./autogen.sh
./configure --prefix=/usr --with-securedir=/lib/security
--with-birdir=/etc/pam_thinkfinger
make || return 1
make DESTDIR=$startdir/pkg install
mkdir -p $startdir/pkg/etc/pam_thinkfinger
}

[Timo Hoenig]

Hi Christoph,

Post by Christoph Siegenthaler
I followed the README for editing /etc/pam.d/common-auth, which
strengely didn't exist before.

PAM is probably configured in a different way on ArchLinux. Maybe it
would help if you get in touch with the ArchLinux PAM maintainers if
you're not able to find out how it needs to be configured yourself.

Please keep me posted on the progress.

Thanks,

Timo

[Christoph Siegenthaler]

Hi again

I've got it working now.
Great work guys!

The Package is available here [1].
I somehow tried to apply the patch for rev 43 to the rev 54, stupid me.
Anyway, it works now and I hope to be able to help other people using
your code...

Thanks again,
Christoph

[1] http://aur.archlinux.org/packages.php?do_Details=1&ID=8250

Post by Timo Hoenig
Hi Christoph,

Post by Christoph Siegenthaler
I followed the README for editing /etc/pam.d/common-auth, which
strengely didn't exist before.

PAM is probably configured in a different way on ArchLinux. Maybe it
would help if you get in touch with the ArchLinux PAM maintainers if
you're not able to find out how it needs to be configured yourself.
Please keep me posted on the progress.
Thanks,
Timo

[Luca Capello]

Hello!

Post by Christoph Siegenthaler
I've got it working now.
Great work guys!
The Package is available here [1].

Since we'd like to have only one implementation for PAM < 0.99.1.0 ,
can you try the patch available at [1] and report the result, please?

From [2], have you tried to follow the README? Thus adding only:

auth sufficient pam_thinkfinger.so

BTW, AFAIK you can add that line to a common file and then

@include /patch/to/common/file

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=56
[2] http://wiki.archlinux.org/index.php/Thinkfinger#Pam

[Christoph Siegenthaler]

Hello!

Post by Luca Capello
Since we'd like to have only one implementation for PAM < 0.99.1.0 ,
can you try the patch available at [1] and report the result, please?

Well, I've spent hours to get this thing working and I'm very happy with the results. Everything works as it should (at least what I tried so far...): login and su, which both display "Password or swipe finger:" and work well. I think the patch [1] I created is small and solves all the issues I had before. Wouldn't I have to patch pam itself if I followed your advice?

[Luca Capello]

Hello!

Some comments, don't take them personal, please :-)

Post by Christoph Siegenthaler

Post by Luca Capello
Since we'd like to have only one implementation for PAM < 0.99.1.0
, can you try the patch available at [1] and report the result,
please?

Well, I've spent hours to get this thing working and I'm very happy
with the results. Everything works as it should (at least what I
tried so far...): login and su, which both display "Password or
swipe finger:" and work well.

I know about frustation when something doesn't work as expecteed,
but...

Post by Christoph Siegenthaler
I think the patch [1] I created is small and solves all the issues I
had before.

...FWIW I still think that the patch I created based on Stephan
Berberig's one is the way to go [1], for different reasons:

1) it mimics PAM-0.99.1.0 behavior, thus no functional changes between
old and new PAM users

2) with my not-PAM-expert hat on, pam_prompt() from PAM-0.99.1.0 does
exactly what you implemented from scratch

3) obviously, our (Stephan and mine) patch adds more code, but this
same code can be cleanly removed as soon as we want to drop support
for older PAM versions [1]

Post by Christoph Siegenthaler
Wouldn't I have to patch pam itself if I followed your advice?

No, PAM doesn't need to be patched, only configure.in and
pam_thinkfinger.c with that patch version.

[W***@gmx.de]

Hello,

you are 100% right the old patch which implement pam_prompt is the
better and cleaner solution.

Post by Luca Capello
Hello!
Some comments, don't take them personal, please :-)

Post by Christoph Siegenthaler

Post by Luca Capello
Since we'd like to have only one implementation for PAM < 0.99.1.0
, can you try the patch available at [1] and report the result,
please?

Well, I've spent hours to get this thing working and I'm very happy
with the results. Everything works as it should (at least what I
tried so far...): login and su, which both display "Password or
swipe finger:" and work well.

I know about frustation when something doesn't work as expecteed,
but...

Post by Christoph Siegenthaler
I think the patch [1] I created is small and solves all the issues I
had before.

...FWIW I still think that the patch I created based on Stephan
1) it mimics PAM-0.99.1.0 behavior, thus no functional changes between
old and new PAM users
2) with my not-PAM-expert hat on, pam_prompt() from PAM-0.99.1.0 does
exactly what you implemented from scratch
3) obviously, our (Stephan and mine) patch adds more code, but this
same code can be cleanly removed as soon as we want to drop support
for older PAM versions [1]

Post by Christoph Siegenthaler
Wouldn't I have to patch pam itself if I followed your advice?

No, PAM doesn't need to be patched, only configure.in and
pam_thinkfinger.c with that patch version.

[Timo Hoenig]

Hi,

Post by W***@gmx.de
The attached patch make the subversion Revision 43 works with Gentoo.
Using pam-0.78-r5.

Thanks for your time working on this issue which needs definitely fixed.
I'm not able to help much as I do not have any machines with PAM <
0.99.1. Luca and Stephan are currently working on the patch, I guess
they are happy to include your proposals.

Thanks,

Timo