[Thinkfinger-devel] PAM support for <= 0.81

[Stephan Berberig]

Hi,

I tried to adopt pam_thinkfinger to be compatible with PAM <= 0.81. I
used pam_keyring [1] as an example.

Attached is my patch. But it's NOT working.

I now get a segmentation fault and I find in syslog:

PAM unable to resolve symbol: pam_sm_chauthtok


But perhaps, it helps someone who is more familiar with PAM.

Best regards,
Stephan

PS: Please CC me as I'm not subscribed to the list.

[1]
http://www.hekanetworks.com/index.php/publisher/articleview/?HEKAESSID=1974e49c17a8da0456887018b06e0f40&/1/frmArticleID/25/staticId/31/

[Luca Capello]

Hello!

Post by Stephan Berberig
I tried to adopt pam_thinkfinger to be compatible with PAM <=
0.81. I used pam_keyring [1] as an example.

Thank you Stephan! Finally I can have the fingerprint reader on
Debian :-)

Post by Stephan Berberig
Attached is my patch. But it's NOT working.

Well, at least on a clean Debian etch (pam-0.79) and following the
instructions in the READM it works with small glitches:

1) no output asking to swiping the finger on console neither on GDM
(GNOME Display Manager), but this is a known problem as of [1]

2) the login process asks for username, password and wait for the
fingerprint, both console and GDM, but on the console you don't
know it's waiting because there's no output, while on GDM there's a
new input dialog window. Thus, the proposed pam_module at [1]
isn't respected, because there's no:

Enter password *or* swipe your finger

but:

Login:
Password:
[empty message and waiting for the fingerprint]

Moreover, will a way to login without providing the username be
useful?

Post by Stephan Berberig
PAM unable to resolve symbol: pam_sm_chauthtok

I've the same message on my /var/log/auth.log, but this doesn't cause
any segmentation fault:
=====
Jan 20 16:44:12 gismo login[3568]: PAM unable to resolve symbol: pam_sm_chauthtok
Jan 20 16:44:12 gismo login[3568]: PAM unable to resolve symbol: pam_sm_chauthtok
Jan 20 16:44:16 gismo login[3568]: (pam_unix) session opened for user luca by (uid=0)
Jan 20 16:44:17 gismo login[3568]: (pam_unix) session closed for user luca
=====

BTW, if Stephane's patch will be accepted, the following patch for
README should also be applied:

--8<---------------cut here---------------start------------->8---
Index: README
===================================================================
--- README (revision 21)
+++ README (working copy)
@@ -18,8 +18,7 @@
- the GCC compiler (http://www.gnu.org/software/gcc/)
- libtool (http://www.gnu.org/software/libtool/)
- pkg-config (http://pkgconfig.freedesktop.org)
-- the Linux-PAM, development files, version >= 0.81
- (http://www.kernel.org/pub/linux/libs/pam/)
+- the Linux-PAM, development files (http://www.kernel.org/pub/linux/libs/pam/)
- libusb, development files, version >= 0.1.12 (http://libusb.sourceforge.net/)

--8<---------------cut here---------------end--------------->8---

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://sourceforge.net/mailarchive/message.php?msg_id=37877511

[Stephan Berberig]

Hi Luca,

I don't know why it's working for you.

Neither console nor GDM or sudo work here.

I'm attaching a new patch as there were some references to pam_keyring.

Best regards,
Stephan

Post by Luca Capello
Hello!

Post by Stephan Berberig
I tried to adopt pam_thinkfinger to be compatible with PAM <=
0.81. I used pam_keyring [1] as an example.

Thank you Stephan! Finally I can have the fingerprint reader on
Debian :-)

Post by Stephan Berberig
Attached is my patch. But it's NOT working.

Well, at least on a clean Debian etch (pam-0.79) and following the
1) no output asking to swiping the finger on console neither on GDM
(GNOME Display Manager), but this is a known problem as of [1]
2) the login process asks for username, password and wait for the
fingerprint, both console and GDM, but on the console you don't
know it's waiting because there's no output, while on GDM there's a
new input dialog window. Thus, the proposed pam_module at [1]
Enter password *or* swipe your finger
[empty message and waiting for the fingerprint]
Moreover, will a way to login without providing the username be
useful?

Post by Stephan Berberig
PAM unable to resolve symbol: pam_sm_chauthtok

I've the same message on my /var/log/auth.log, but this doesn't cause
=====
Jan 20 16:44:12 gismo login[3568]: PAM unable to resolve symbol: pam_sm_chauthtok
Jan 20 16:44:12 gismo login[3568]: PAM unable to resolve symbol: pam_sm_chauthtok
Jan 20 16:44:16 gismo login[3568]: (pam_unix) session opened for user luca by (uid=0)
Jan 20 16:44:17 gismo login[3568]: (pam_unix) session closed for user luca
=====
BTW, if Stephane's patch will be accepted, the following patch for
--8<---------------cut here---------------start------------->8---
Index: README
===================================================================
--- README (revision 21)
+++ README (working copy)
@@ -18,8 +18,7 @@
- the GCC compiler (http://www.gnu.org/software/gcc/)
- libtool (http://www.gnu.org/software/libtool/)
- pkg-config (http://pkgconfig.freedesktop.org)
-- the Linux-PAM, development files, version >= 0.81
- (http://www.kernel.org/pub/linux/libs/pam/)
+- the Linux-PAM, development files (http://www.kernel.org/pub/linux/libs/pam/)
- libusb, development files, version >= 0.1.12 (http://libusb.sourceforge.net/)
--8<---------------cut here---------------end--------------->8---
Thx, bye,
Gismo / Luca
[1] http://sourceforge.net/mailarchive/message.php?msg_id=37877511

[Luca Capello]

Hi Stephan!

Post by Stephan Berberig
I don't know why it's working for you.

[...]

Post by Stephan Berberig
I'm attaching a new patch as there were some references to
pam_keyring.

I tested both patches (old and new one) on another clean Debian etch
(still pam-0.79, but this time i386, while the first one was amd64)
and again the fingerprint reader worked without any problem (except
the already reported pam_sm_chauthtok).

Thx, bye,
Gismo / Luca

[Luca Capello]

Hello!

Some _very good_ news, so read below ;-)

Post by Stephan Berberig
I don't know why it's working for you.
Neither console nor GDM or sudo work here.

As discussed with Stephan on IRC (#***@irc.freenode.net),
we couldn't find the problem: I tested Stephan's patch on a clean
Ubuntu edgy and it worked. Then I installed all the packages Stephan
has installed and it still worked for me :-(

Post by Stephan Berberig
I'm attaching a new patch as there were some references to
pam_keyring.

[...]

Post by Stephan Berberig
+int
+pam_prompt(pam_handle_t *pamh, int style, const char *prompt, char **user_msg)

Are you sure that the variables are correctly declared?

With the patch applied to SVN revision 37, I got the following
warnings:

pam_thinkfinger.c: In function ‘pam_prompt_thread’:
pam_thinkfinger.c:150: warning: passing argument 3 of ‘pam_prompt’ \
from incompatible pointer type
pam_thinkfinger.c:150: warning: passing argument 4 of ‘pam_prompt’ \
from incompatible pointer type

Indeed, the pam_prompt() declaration from Linux-PAM [1] is different:

extern int PAM_FORMAT((printf, 4, 5)) PAM_NONNULL((1,4))
pam_prompt (pam_handle_t *pamh, int style, char **response,
const char *fmt, ...);

I tried to port the Linux-PAM_0.99.1.0 pam_vprompt() [2] and I
succeeded (see patch attached). But to be able to login with the
fingerprint only (i.e., without the need to type the password and
*then* swiping the fingerprint), I need the following order in
/etc/pam.d/common-auth:

auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure

With this order and the patch applied, I get the correct prompt
"Password or swipe finger: " in console and in GDM [3]. It works also
on Ubuntu edgy (with the latest edgy-updates).

BTW, the patch includes the fix for pam_sm_chauthok [4].

Comments, suggestions?

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/include/security/pam_ext.h?revision=1.7&view=markup
[2] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/pam_vprompt.c?revision=1.7&view=markup
[3] GDM is the only display manager where it's working, so it doesn't
in KDM, WDM or XDM
[4] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/25/focus=25

[Stephan Berberig]

Hi,

Luca, your patch works great here!!! No segfault!

Your mentioned order in common-auth is normal. That's also the way, it
works with pam-bioapi for the proprietary UPEK driver.

BUT I now have another issue:
Although I see "Password or swipe fingerprint", entering the password
doesn't work. I then get a new "Password:" prompt.


Best regards,
Stephan

Post by Luca Capello
Hello!
Some _very good_ news, so read below ;-)

Post by Stephan Berberig
I don't know why it's working for you.
Neither console nor GDM or sudo work here.

we couldn't find the problem: I tested Stephan's patch on a clean
Ubuntu edgy and it worked. Then I installed all the packages Stephan
has installed and it still worked for me :-(

Post by Stephan Berberig
I'm attaching a new patch as there were some references to
pam_keyring.

[...]

Post by Stephan Berberig
+int
+pam_prompt(pam_handle_t *pamh, int style, const char *prompt, char **user_msg)

Are you sure that the variables are correctly declared?
With the patch applied to SVN revision 37, I got the following
pam_thinkfinger.c:150: warning: passing argument 3 of ‘pam_prompt’ \
from incompatible pointer type
pam_thinkfinger.c:150: warning: passing argument 4 of ‘pam_prompt’ \
from incompatible pointer type
extern int PAM_FORMAT((printf, 4, 5)) PAM_NONNULL((1,4))
pam_prompt (pam_handle_t *pamh, int style, char **response,
const char *fmt, ...);
I tried to port the Linux-PAM_0.99.1.0 pam_vprompt() [2] and I
succeeded (see patch attached). But to be able to login with the
fingerprint only (i.e., without the need to type the password and
*then* swiping the fingerprint), I need the following order in
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure
With this order and the patch applied, I get the correct prompt
"Password or swipe finger: " in console and in GDM [3]. It works also
on Ubuntu edgy (with the latest edgy-updates).
BTW, the patch includes the fix for pam_sm_chauthok [4].
Comments, suggestions?
Thx, bye,
Gismo / Luca
[1] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/include/security/pam_ext.h?revision=1.7&view=markup
[2] http://pam.cvs.sourceforge.net/pam/Linux-PAM/libpam/pam_vprompt.c?revision=1.7&view=markup
[3] GDM is the only display manager where it's working, so it doesn't
in KDM, WDM or XDM
[4] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/25/focus=25

[Luca Capello]

Hi Stephan!

Strangely enough, it seems that your reply never reached my inbox...
Anyway, nevermind!

Post by Stephan Berberig
Luca, your patch works great here!!! No segfault!

Finally another good news ;-)

Post by Stephan Berberig
Your mentioned order in common-auth is normal. That's also the way,
it works with pam-bioapi for the proprietary UPEK driver.

I guessed so, but I wasn't completely sure.

Post by Stephan Berberig
Although I see "Password or swipe fingerprint", entering the
password doesn't work. I then get a new "Password:" prompt.

This issue is still present on both Debian etch and Ubuntu edgy, too.

Does anyone using Linux-PAM_0.99.1.0 experience the same issue? If
yes, which distribution (thus I can install and test it)?

Thx, bye,
Gismo / Luca

[Luca Capello]

Hi Stephan!

It seems that lately I've only good news and another long mail ;-)

Post by Luca Capello

Post by Stephan Berberig
Although I see "Password or swipe fingerprint", entering the
password doesn't work. I then get a new "Password:" prompt.

This issue is still present on both Debian etch and Ubuntu edgy, too.
Does anyone using Linux-PAM_0.99.1.0 experience the same issue? If
yes, which distribution (thus I can install and test it)?

I solved this issue, too, which results in not being a pam_thinkfinger
problem. Reading [1], I modified /etc/pam.d/common-auth:

auth sufficient pam_thinkfinger.so
auth required pam_unix.so try_first_pass nullok_secure

And now I can login with the password at the "Password or swipe
finger: " prompt, in console, GDM, su and sudo.

About pam_unix.so options, you could use either try_first_pass or

[Timo Hoenig]

Hi Luca,

On Thu, 2007-01-25 at 03:47 +0100, Luca Capello wrote:

<snip/>

Post by Luca Capello
I tried to port the Linux-PAM_0.99.1.0 pam_vprompt() [2] and I
succeeded (see patch attached). But to be able to login with the
fingerprint only (i.e., without the need to type the password and
*then* swiping the fingerprint), I need the following order in
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure
With this order and the patch applied, I get the correct prompt
"Password or swipe finger: " in console and in GDM [3]. It works also
on Ubuntu edgy (with the latest edgy-updates).
BTW, the patch includes the fix for pam_sm_chauthok [4].

The patch looks good, I'd just change minor bits which can wait until we
have resolved the last issue (entering password without swipe does not
work) which Stephan raised in his reply.

Thanks,

Timo

[Luca Capello]

Hi Timo!

Post by Timo Hoenig

Post by Luca Capello
I tried to port the Linux-PAM_0.99.1.0 pam_vprompt() [2] and I
succeeded (see patch attached). But to be able to login with the
fingerprint only (i.e., without the need to type the password and
*then* swiping the fingerprint), I need the following order in
auth sufficient pam_thinkfinger.so
auth required pam_unix.so nullok_secure
With this order and the patch applied, I get the correct prompt
"Password or swipe finger: " in console and in GDM [3]. It works
also on Ubuntu edgy (with the latest edgy-updates).

I forgot to mention that su and sudo works with the fingerprint as
well. Strangely, gnome-screensaver didn't work, even if:
=====
***@gismo:~$ cat /etc/pam.d/gnome-screensaver
@include common-auth
***@gismo:~$
=====

Moreover, the "Password or swipe finger: " prompt is showed only if
the user has the fingerprint in /etc/pam_thinkfinger/$USER.bir.

It would be nice to have the support for passwd, too, i.e. adding or
changing the stored fingerprint from passwd.

Post by Timo Hoenig

Post by Luca Capello
BTW, the patch includes the fix for pam_sm_chauthok [4].

The patch looks good, I'd just change minor bits which can wait
until we have resolved the last issue (entering password without
swipe does not work) which Stephan raised in his reply.

Apart from this issue, I'd like to add pam_syslog(), too, in order to
completely mimic Linux-PAM_0.99.1.0's behavior. I'll try to
investigate on it :-)

As I said in another post [1] (and [2] for the relevant Timo's reply),
I think it would be a good thing to know when pam_thinkfinger is used,
but we need to implement pam_sm_[open|close]_session().

Thx, bye,
Gismo / Luca

Footnotes:
[1] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/14/focus=26
[2] http://thread.gmane.org/gmane.linux.drivers.thinkfinger/28/focus=28

[Timo Hoenig]

Post by Luca Capello
I forgot to mention that su and sudo works with the fingerprint as
=====
@include common-auth
=====

Yes, I observed the same. gnomesu however works in some way; it just
doesn't close its own window.

Post by Luca Capello
Moreover, the "Password or swipe finger: " prompt is showed only if
the user has the fingerprint in /etc/pam_thinkfinger/$USER.bir.

That is on purpose. It does not make sense to request a swipe if we do
not have a stored a biometric identification record for the user who is
about to authenticate.

Post by Luca Capello
It would be nice to have the support for passwd, too, i.e. adding or
changing the stored fingerprint from passwd.

Yes. That's already on my mind.

Post by Luca Capello
Apart from this issue, I'd like to add pam_syslog(), too, in order to
completely mimic Linux-PAM_0.99.1.0's behavior. I'll try to
investigate on it :-)

OK.

Post by Luca Capello
As I said in another post [1] (and [2] for the relevant Timo's reply),
I think it would be a good thing to know when pam_thinkfinger is used,
but we need to implement pam_sm_[open|close]_session().

What do you want to implement there? As mentioned before, adding the
functions as placeholder/stubs should not hurt.

Timo

[Luca Capello]

Hi Timo!

Post by Timo Hoenig

Post by Luca Capello
I forgot to mention that su and sudo works with the fingerprint as
=====
@include common-auth
=====

Yes, I observed the same. gnomesu however works in some way; it just
doesn't close its own window.

Mmm, it doesn't seem to work on Debian etch with gksu or starting
Desktop -> Administration -> Users and Groups. Anyway, this is a
minor issue IMHO.

Post by Timo Hoenig

Post by Luca Capello
Moreover, the "Password or swipe finger: " prompt is showed only if
the user has the fingerprint in /etc/pam_thinkfinger/$USER.bir.

That is on purpose. It does not make sense to request a swipe if we do
not have a stored a biometric identification record for the user who is
about to authenticate.

Blame me, I should have remembered to carefully read the README...

Post by Timo Hoenig

Post by Luca Capello
It would be nice to have the support for passwd, too, i.e. adding or
changing the stored fingerprint from passwd.

Yes. That's already on my mind.

Good to know!

Post by Timo Hoenig

Post by Luca Capello
As I said in another post [1] (and [2] for the relevant Timo's reply),
I think it would be a good thing to know when pam_thinkfinger is used,
but we need to implement pam_sm_[open|close]_session().

What do you want to implement there? As mentioned before, adding the
functions as placeholder/stubs should not hurt.

FWIW, with pam_unix2 I get some warnings:

login[8705]: PAM unable to resolve symbol: pam_sm_open_session
login[8705]: PAM unable to resolve symbol: pam_sm_close_session
login[8705]: PAM unable to resolve symbol: pam_sm_open_session
login[8705]: PAM unable to resolve symbol: pam_sm_close_session

Thus it seems that implementing them in pam_thinkfinger is very low
priority.

Thx, bye,
Gismo / Luca

[Luca Capello]

Hello!

Post by Luca Capello

Post by Stephan Berberig
I tried to adopt pam_thinkfinger to be compatible with PAM <=
0.81. I used pam_keyring [1] as an example.

[...]

Post by Luca Capello

Post by Stephan Berberig
PAM unable to resolve symbol: pam_sm_chauthtok

I've the same message on my /var/log/auth.log

I think the problem is the missing declaration for `pam_sm_chauthok`
in pam/pam_thinkfinger.c.

The attached patch at least removes the error message from my
/var/log/auth.log, while the authentication still works.

--8<---------------cut here---------------start------------->8---
Index: pam_thinkfinger.c
===================================================================
--- pam_thinkfinger.c (revision 21)
+++ pam_thinkfinger.c (working copy)
@@ -165,7 +165,13 @@
return PAM_SUCCESS;
}

+PAM_EXTERN
+int pam_sm_chauthtok (pam_handle_t *pamh, int flags,int argc, const char **argv)
+{
+ return PAM_SUCCESS;
+}

+
#ifdef PAM_STATIC

struct pam_module _pam_thinkfinger_modstruct = {
--8<---------------cut here---------------end--------------->8---

Anyway, I don't have any pam_thinkfinger information in
/var/log/auth.log and /var/log/syslog neither. Is it the intended
behavior?

Thx, bye,
Gismo / Luca

[Timo Hoenig]

Post by Luca Capello
I think the problem is the missing declaration for `pam_sm_chauthok`
in pam/pam_thinkfinger.c.
The attached patch at least removes the error message from my
/var/log/auth.log, while the authentication still works.
--8<---------------cut here---------------start------------->8---
Index: pam_thinkfinger.c
===================================================================
--- pam_thinkfinger.c (revision 21)
+++ pam_thinkfinger.c (working copy)
@@ -165,7 +165,13 @@
return PAM_SUCCESS;
}
+PAM_EXTERN
+int pam_sm_chauthtok (pam_handle_t *pamh, int flags,int argc, const char **argv)
+{
+ return PAM_SUCCESS;
+}
+
#ifdef PAM_STATIC
struct pam_module _pam_thinkfinger_modstruct = {
--8<---------------cut here---------------end--------------->8---
Anyway, I don't have any pam_thinkfinger information in
/var/log/auth.log and /var/log/syslog neither. Is it the intended
behavior?

What would you expect to show up at these places?

Stephan: Does Luca's patch solved the unresolved symbols/crashes for
you?

Timo

[Luca Capello]

Hi Timo!

Post by Timo Hoenig

Post by Luca Capello
Anyway, I don't have any pam_thinkfinger information in
/var/log/auth.log and /var/log/syslog neither. Is it the intended
behavior?

What would you expect to show up at these places?

Shouldn't there be a message similar to pam_unix below?

Jan 22 11:38:19 tora login[3459]: \
(pam_unix) session opened for user luca by (uid=0)

I'm not a PAM expert, but I guess this is the output for the following
line in /etc/pam.d/common-auth:

auth required pam_unix.so nullok_secure

In case I'm completely wrong, please discard my thoughts :-)

Post by Timo Hoenig
Stephan: Does Luca's patch solved the unresolved symbols/crashes for
you?

In a private mail to whom I replied to the list, Stephan wrote me that
nothing changed with my patch...

Thx, bye,
Gismo / Luca

[Timo Hoenig]

Hi Luca,

Post by Luca Capello

Post by Timo Hoenig
What would you expect to show up at these places?

Shouldn't there be a message similar to pam_unix below?
Jan 22 11:38:19 tora login[3459]: \
(pam_unix) session opened for user luca by (uid=0)
I'm not a PAM expert, but I guess this is the output for the following
auth required pam_unix.so nullok_secure
In case I'm completely wrong, please discard my thoughts :-)

The above log message is owned by pam_unix (pam_sm_open_session). This
function is being called if your PAM configuration includes a like
statement:

session required pam_unix.so

I just talked to a PAM expert and he told me that it is likely to be a
configuration issue if unresolved symbols show up.

For a PAM module it is *not* mandatory to define the functions for
session management (pam_sm_{open,close}_session. pam_sm_chauthtok is
optional, too.

I suppose it won't hurt if I add stubs for those function.

Post by Luca Capello
In a private mail to whom I replied to the list, Stephan wrote me that
nothing changed with my patch...

OK, it would be nice if someone using PAM < 0.81 could solve the issue.
Once done, I'm happy to commit a patch to provide support for PAM <
0.81.

Timo

[Luca Capello]

Hi Stephan!

I included the thinkfinger-devel mailing list in this reply, maybe
someone other can help better than me.

your patch also removes the error message here. But I have still a
segmentation fault.
Could you tell me which gcc version you use?

Sure, as I already said I tested on both an i386 and an amd64 Debian
etch, but the GCC version is the same:
=====
***@gismo:~$ gcc -v
Using built-in specs.
Target: x86_64-linux-gnu
Configured with: ../src/configure -v \
--enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr \
--enable-shared --with-system-zlib --libexecdir=/usr/lib \
--without-included-gettext --enable-threads=posix --enable-nls \
--program-suffix=-4.1 --enable-__cxa_atexit --enable-clocale=gnu \
--enable-libstdcxx-debug --enable-mpfr --enable-checking=release \
x86_64-linux-gnu
Thread model: posix
gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)
***@gismo:~$
=====

pam_thinkfinger.c:120: warning: implicit declaration of function
‘pam_prompt’
pam_thinkfinger.c:120: warning: nested extern declaration of ‘pam_prompt’
compat.c:17: warning: no previous prototype for ‘pam_syslog’
compat.c:33: warning: implicit declaration of function ‘vasprintf’
compat.c:33: warning: nested extern declaration of ‘vasprintf’
compat.c:57: warning: no previous prototype for ‘pam_prompt’
I don't know how to solve it.

Well, I've the same warnings, but there's no problem afterwards.

BTW, I'm gismo on [irc.freenode.net|irc.oftc.net] in case you want to
discuss in real-time mode :-)

Thx, bye,
Gismo / Luca

[Timo Hoenig]

Hi Stephan,

Sorry for the lag.

Post by Stephan Berberig
I tried to adopt pam_thinkfinger to be compatible with PAM <= 0.81. I
used pam_keyring [1] as an example.
Attached is my patch. But it's NOT working.

Hey, at least it is a start :-)

Post by Stephan Berberig
PAM unable to resolve symbol: pam_sm_chauthtok

Does the module work with PAM < 0.81 if you adjust
_pam_thinkfinger_modstruct?

171 struct pam_module _pam_thinkfinger_modstruct = {
172 "pam_thinkfinger",
173 pam_sm_authenticate,
174 pam_sm_setcred,
175 NULL,
176 NULL,
177 NULL,
178 pam_sm_chauthtok
179 };

->

171 struct pam_module _pam_thinkfinger_modstruct = {
172 "pam_thinkfinger",
173 pam_sm_authenticate,
174 pam_sm_setcred,
175 NULL,
176 NULL,
177 NULL,
178 NULL
179 };

Post by Stephan Berberig
But perhaps, it helps someone who is more familiar with PAM.

I guess we're still missing a PAM expert on the list :-)

Thanks again for the work. Once we agree on a clean solution which does
not crash I am happy to commit that to SVN.

Timo