[Thinkfinger-devel] thinkfinger-0.3 on Ubuntu 7.10 (Gutsy Gibbon)

[Daniel Murygin]

Hello,

i installed and run thinkfinger-0.3 on my ThinkPad T60 with Ubuntu
7.04 without problems. I upgraded to Ubuntu 7.10 (Gutsy Gibbon) and
reinstalled thinkfinger-0.3 from source as described here:
https://wiki.ubuntu.com/ThinkFinger
All tf-tool commands are working fine but pam authentication is not
working anymore. I could not find any error messages.

Here is my /etc/pam.d/common-auth:
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass

/lib/security/pam_thinkfinger.so is installed.

Do you have any idea how to debug?

Thanks and greetings - Daniel.

[Justin Dugger]

Post by Daniel Murygin
Hello,
i installed and run thinkfinger-0.3 on my ThinkPad T60 with Ubuntu
7.04 without problems. I upgraded to Ubuntu 7.10 (Gutsy Gibbon) and
https://wiki.ubuntu.com/ThinkFinger
All tf-tool commands are working fine but pam authentication is not
working anymore. I could not find any error messages.
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass
/lib/security/pam_thinkfinger.so is installed.
Do you have any idea how to debug?
Thanks and greetings - Daniel.

The place to check is /var/log/messages. Odds are that uinput is not
acting nicely. To get a good debug log from this, add the parameter
debug to pam_thinkfinger.so just like you have try_first_pass in
pam_unix. Once you've done that, bring up a console, and run tail -f
/var/log/messages. Then on another console, run a sudo command like
"sudo yes" or "sudo ls". That should give a first hint at what's gone
wrong.

[Daniel Murygin]

I added debug to /etc/pam.d/common-auth:

auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass debug

But there are still no pam related messages in /var/log/messages...

Post by Justin Dugger

Post by Daniel Murygin
Hello,
i installed and run thinkfinger-0.3 on my ThinkPad T60 with Ubuntu
7.04 without problems. I upgraded to Ubuntu 7.10 (Gutsy Gibbon) and
https://wiki.ubuntu.com/ThinkFinger
All tf-tool commands are working fine but pam authentication is not
working anymore. I could not find any error messages.
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass
/lib/security/pam_thinkfinger.so is installed.
Do you have any idea how to debug?
Thanks and greetings - Daniel.

The place to check is /var/log/messages. Odds are that uinput is not
acting nicely. To get a good debug log from this, add the parameter
debug to pam_thinkfinger.so just like you have try_first_pass in
pam_unix. Once you've done that, bring up a console, and run tail -f
/var/log/messages. Then on another console, run a sudo command like
"sudo yes" or "sudo ls". That should give a first hint at what's gone
wrong.

[Daniel Murygin]

Sorry - I now added debug to the right line:

auth sufficient pam_thinkfinger.so debug
auth required pam_unix.so nullok_secure try_first_pass

But i still get no output in /var/log/messages.
Are you sure thinkfinger is used by pam?


Here is my /etc/pam.d/login from Ubuntu 7.10:

#
# The PAM configuration file for the Shadow `login' service
#

# Outputs an issue file prior to each login prompt (Replaces the
# ISSUE_FILE option from login.defs). Uncomment for use
# auth required pam_issue.so issue=/etc/issue

# Disallows root logins except on tty's listed in /etc/securetty
# (Replaces the `CONSOLE' setting from login.defs)
auth requisite pam_securetty.so

# Disallows other than root logins when /etc/nologin exists
# (Replaces the `NOLOGINS_FILE' option from login.defs)
auth requisite pam_nologin.so

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session required pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session required pam_env.so readenv=1 envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# This allows certain extra groups to be granted to a user
# based on things like time of day, tty, service, and user.
# Please edit /etc/security/group.conf to fit your needs
# (Replaces the `CONSOLE_GROUPS' option in login.defs)
auth optional pam_group.so

# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on logins.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account requisite pam_time.so

# Uncomment and edit /etc/security/access.conf if you need to
# set access limits.
# (Replaces /etc/login.access file)
# account required pam_access.so

# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session required pam_limits.so

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
session optional pam_lastlog.so

# Prints the motd upon succesful login
# (Replaces the `MOTD_FILE' option in login.defs)
session optional pam_motd.so

# Prints the status of the user's mailbox upon succesful login
# (Replaces the `MAIL_CHECK_ENAB' option from login.defs).
#
# This also defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user
# also removes the user's mail spool file.
# See comments in /etc/login.defs
session optional pam_mail.so standard

# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context.
# Uncomment the following line to enable SELinux
# session required pam_selinux.so multiple

# Standard Un*x account and session
@include common-account
@include common-session
@include common-password

Post by Daniel Murygin
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass debug
But there are still no pam related messages in /var/log/messages...

Post by Justin Dugger

Post by Daniel Murygin
Hello,
i installed and run thinkfinger-0.3 on my ThinkPad T60 with Ubuntu
7.04 without problems. I upgraded to Ubuntu 7.10 (Gutsy Gibbon) and
https://wiki.ubuntu.com/ThinkFinger
All tf-tool commands are working fine but pam authentication is not
working anymore. I could not find any error messages.
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure try_first_pass
/lib/security/pam_thinkfinger.so is installed.
Do you have any idea how to debug?
Thanks and greetings - Daniel.

The place to check is /var/log/messages. Odds are that uinput is not
acting nicely. To get a good debug log from this, add the parameter
debug to pam_thinkfinger.so just like you have try_first_pass in
pam_unix. Once you've done that, bring up a console, and run tail -f
/var/log/messages. Then on another console, run a sudo command like
"sudo yes" or "sudo ls". That should give a first hint at what's gone
wrong.

--
Daniel Murygin
Email: daniel.murygin [at-nospam] googlemail [dot] com

[Justin Dugger]

Post by Daniel Murygin
auth sufficient pam_thinkfinger.so debug
auth required pam_unix.so nullok_secure try_first_pass
But i still get no output in /var/log/messages.
Are you sure thinkfinger is used by pam?

Apologies, on double checking on my 7.10 laptop, the debug stuff is
placed in /var/log/auth.log; the only thing that should show up in
messages is a uinput message. My guess is that you've lost the
setting to bring in uinput on boot during the upgrade and will have to
re-add it.

Figuring out a good way to add uinput (or remove the need for it
altogether) when installing a package is on my TODO list. Currently,
gdm, sudo and gksudo all work at least partially (the prompt doesn't
mention scanning in gdm or gksudo), but gnome-screensaver is highly
problematic still.
<snip>

As long as you haven't drastically changed the pam rules around,
common-auth is the important one.

Justin Dugger

[Daniel Murygin]

Log output was in /var/log/auth.log
After loading module uinput thinkfinger was working (temporally).
Thank you!

Post by Justin Dugger

Post by Daniel Murygin
auth sufficient pam_thinkfinger.so debug
auth required pam_unix.so nullok_secure try_first_pass
But i still get no output in /var/log/messages.
Are you sure thinkfinger is used by pam?

Apologies, on double checking on my 7.10 laptop, the debug stuff is
placed in /var/log/auth.log; the only thing that should show up in
messages is a uinput message. My guess is that you've lost the
setting to bring in uinput on boot during the upgrade and will have to
re-add it.
Figuring out a good way to add uinput (or remove the need for it
altogether) when installing a package is on my TODO list. Currently,
gdm, sudo and gksudo all work at least partially (the prompt doesn't
mention scanning in gdm or gksudo), but gnome-screensaver is highly
problematic still.
<snip>
As long as you haven't drastically changed the pam rules around,
common-auth is the important one.
Justin Dugger