[Req] Thinkfinger [Done]

Sigi · 2007-01-29 00:55:38

I'd like to package thinkfinger but I'm unable to compile it.
PKGBUILD prototype:

pkgname=thinkfinger
pkgver=0.2
pkgrel=1
pkgdesc="ThinkFinger is a driver for the SGS Thomson Microelectronics fingerprint reader found in most IBM/Lenovo ThinkPads"
url="http://thinkfinger.sourceforge.net/"
license="GPL"
depends=()
makedepends=()
provides=()
conflicts=()
replaces=()
backup=()
source=(http://dl.sourceforge.net/sourceforge/$pkgname/$pkgname-$pkgver.tar.bz2)
md5sums=('ea2a09d3e91a11e360870781aaee8f9f')

build() {
  cd $startdir/src/$pkgname-$pkgver
  ./configure --prefix=/usr
  make || return 1
  make DESTDIR=$startdir/pkg install
}

Error:

---------8><---------
Making all in tf-tool
make[1]: Entering directory `/var/abs/local/thinkfinger/src/thinkfinger-0.2/tf-tool'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/var/abs/local/thinkfinger/src/thinkfinger-0.2/tf-tool'
Making all in pam
make[1]: Entering directory `/var/abs/local/thinkfinger/src/thinkfinger-0.2/pam'
if gcc -DPACKAGE_NAME=\"thinkfinger\" -DPACKAGE_TARNAME=\"thinkfinger\" -DPACKAGE_VERSION=\"0.2\" -DPACKAGE_STRING=\"thinkfinger\ 0.2\" -DPACKAGE_BUGREPORT=\"thoenig@suse.de\" -DPACKAGE=\"thinkfinger\" -DVERSION=\"0.2\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DHAVE_UNISTD_H=1 -DHAVE_STRING_H=1 -DHAVE_STDIO_H=1 -DHAVE_STDLIB_H=1 -DHAVE_ERRNO_H=1 -DHAVE_USB_H=1 -DHAVE_SECURITY_PAM_APPL_H=1 -DHAVE_SECURITY_PAM_MODULES_H=1 -I. -I. -I../libthinkfinger   -march=i686 -O2 -pipe -Wall -fno-common -fPIC -Wchar-subscripts -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wcast-align -Wsign-compare -Wdeclaration-after-statement -march=i686 -O2 -pipe -Wall -fno-common -fPIC -Wchar-subscripts -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wcast-align -Wsign-compare -Wdeclaration-after-statement -MT pam_thinkfinger_so-pam_thinkfinger.o -MD -MP -MF ".deps/pam_thinkfinger_so-pam_thinkfinger.Tpo" -c -o pam_thinkfinger_so-pam_thinkfinger.o `test -f 'pam_thinkfinger.c' || echo './'`pam_thinkfinger.c; \
    then mv -f ".deps/pam_thinkfinger_so-pam_thinkfinger.Tpo" ".deps/pam_thinkfinger_so-pam_thinkfinger.Po"; else rm -f ".deps/pam_thinkfinger_so-pam_thinkfinger.Tpo"; exit 1; fi
pam_thinkfinger.c:33:30: error: security/pam_ext.h: No such file or directory
pam_thinkfinger.c: In function 'pam_prompt_thread':
pam_thinkfinger.c:115: warning: implicit declaration of function 'pam_prompt'
pam_thinkfinger.c:115: warning: nested extern declaration of 'pam_prompt'
make[1]: *** [pam_thinkfinger_so-pam_thinkfinger.o] Error 1
make[1]: Leaving directory `/var/abs/local/thinkfinger/src/thinkfinger-0.2/pam'
make: *** [all-recursive] Error 1
==> ERROR: Build Failed.  Aborting...

Would be great if someone could have a look at it!

Cheers Sigi

Last edited by Sigi (2007-01-30 01:02:28)

byte · 2007-01-29 02:01:54

Looks like our PAM is too old.

mutlu_inek · 2007-01-29 07:03:16

Byte is right. Thinkfinger needs PAM>0.81. There is quite some discussion on the sourceforge website. This includes a proposed patch for the very issue you have. You find the forum here:

http://sourceforge.net/mailarchive/foru … nger-devel

Sigi · 2007-01-29 11:27:07

Thanks a lot for your replies, byte and mutlu_inek. I'm a little busy this week but I think I'll take a look at that in a few days again.

Does anyone know why pam hasn't been updated yet?

Master One · 2007-01-29 15:26:31

Wow, this is great, I already wanted to go the former way by installing the UPEK closed source driver + bioapi + pam_bioapi, as descibed in thinkwiki.org

Any idea, how to solve that problem, if there is no newer pam package available for Arch?

Sigi, thumbs up, hopefully you can solve that issue, so I'll wait till you are able to report good news.

Sigi · 2007-01-29 16:43:26

I can't remember the exact reasons anymore but I was too stupid to get the whole bioapi thing working in the way I wanted it - so I kept typing in my passwords. I hope to solve the pam issues and be able to use slock and ThinkFinger soon.

Good to see other people interested in this as well ;-)

Master One · 2007-01-29 17:11:28

I had the bioapi + UPEK-driver + pam_bioapi stuff working nicely in Gentoo and Kubuntu, and I don't think I can live without fingerprint-replacing-my-too-long-root-passwd any more. I don't exactly know, what the difference to the new thinkfinger driver may be, except that it's open source (what should be prefered of course). Looks like the thinkfinger saves a complete step, because it's only driver+pam module, without the bioapi-framework.

I think that quite some ppl have a ThinkPad with fingerprint reader, so of course there is demand and interest in this, and I really appreciate your work on bringing it to Arch (on one hand I am not qualified to do it myself, and on the other hand, I just don't have the time, being just a user, and not a codergeek).

Does your ThinkPad have the hard-disc-protection-system as well? Because these are my essentials, to have the fingerpint-reader + hdaps + tp_smapi (for better battery support) working (it's all in thinkwiki.org, but I didn't proceed that far in Arch by now, means for hdaps the kernel has to be patched + hdapsd + hdaps-monitor, and for tp_smapi a kernel-module and hdaps-module-patch). The hdaps stuff is really *the* essential feature, I would never move my ThinkPad around without having hdaps working.

mutlu_inek · 2007-01-29 18:52:05

Well, I have a thinkpad, too (x60). It is not necessary for me to have it working, but I would not mind it, either.

Sigi wrote:

Does anyone know why pam hasn't been updated yet?

I am not quite sure about this, 0.81 is the current in Arch and seems in fact to be pam's stable release (dating from 2005-10-31), too, since "0.99" usually marks beta versions. If this is true, then it is being worked on pam 1.0 since over a year. Latest 'beta' would be 0.99.7.1. Most other distributions (Debian, Gentoo, ...) use even older versions of pam. Gentoo's stable version is 0.78-r3, but they do have the current 0.99.7.1 as a masked ebuild in their mirrors.

But a look at the pam mailing list (https://www.redhat.com/archives/pam-list/) reveals that every version since 0.99 has been officially released (latest: "Linux-PAM 0.99.7.1 released", https://www.redhat.com/archives/pam-lis … 0017.html). So I am really unsure about this.

However, it seems that there are a lot of security holes and Arch seems to not apply the (unlike Gentoo).

So we have three possibilities:

a) We could wait for pam 1.0. A look at the previous release steps shows that this could still take months, if not longer.
b) We could package it ourselves. The problem is the number of packages that depend on pam. But most of them are community, the only ones being in extra are pam_ldap and pam_mysql. So it seems feasible. Errors may lead to serious problems, though (no login, etc.)
c) We apply the patches from the thinkfinger forums and hope they work. This seems the least trouble.

I will not have time during the next about one and a half weeks, but if noone takes this up (Sigi?), I might try my luck.

Last edited by mutlu_inek (2007-01-29 18:53:19)

Sigi · 2007-01-29 20:57:48

Impressive what a man with the ability to use the "Try-and-error-emthod(tm)", a cup of mint tea and too much free time is able to do... ;-)
In other words, I think there is some progress, although I haven't tested it out yet:

# Contributor: Christoph Siegenthaler <csi>
pkgname=thinkfinger-svn
pkgver=54
pkgrel=1
pkgdesc="ThinkFinger is a driver for the SGS Thomson Microelectronics fingerprint reader found in most IBM/Lenovo ThinkPads"
url="http://thinkfinger.sourceforge.net/"
license="GPL"
depends=(pam)
makedepends=('subversion')
conflicts=('thinkfinger')
provides=('thinkfinger')
source=(pam.patch)
md5sums=()

_svntrunk=https://thinkfinger.svn.sourceforge.net/svnroot/thinkfinger
_svnmod=thinkfinger

build() {
  cd $startdir/src
  
  svn co $_svntrunk --config-dir ./ -r $pkgver $_svnmod
  
  msg "SVN checkout done or server timeout"
  msg "Starting make..."
      
  cp -r $_svnmod $_svnmod-build
  cd $_svnmod-build
  
  patch -p0 -i ../pam.patch
  ./autogen.sh
  ./configure --prefix=/usr --with-securedir=/lib/security --with-birdir=/etc/pam_thinkfinger
  make || return 1
  make DESTDIR=$startdir/pkg install
}

edit:
This is pam.patch

Index: configure.in
===================================================================
--- configure.in (revision 43)
+++ configure.in (working copy)
@@ -33,6 +33,7 @@
 AC_PROG_CC
 AC_PROG_INSTALL
 AC_PROG_LIBTOOL
+AM_PROG_CC_C_O

 # Checks for header files.
 AC_CHECK_HEADERS([unistd.h string.h stdio.h stdlib.h errno.h usb.h])
Index: pam/pam_thinkfinger.c
===================================================================
--- pam/pam_thinkfinger.c (revision 43)
+++ pam/pam_thinkfinger.c (working copy)
@@ -26,9 +26,11 @@
 #include <unistd.h>
 #include <pthread.h>
 #include <libthinkfinger.h>
-#include <security/pam_ext.h>
+#include <security/pam_appl.h>
 #include <security/pam_modules.h>

+#include <utmp.h>
+
 #include <config.h>

 #define MAX_PATH 256
@@ -117,10 +113,22 @@
 static void pam_prompt_thread (void *data)
 {
 struct pam_thinkfinger_s *pam_thinkfinger = data;
- char *resp;

- pam_prompt (pam_thinkfinger->pamh, PAM_PROMPT_ECHO_OFF, &resp, "Password or swipe finger: ");
- pam_set_item (pam_thinkfinger->pamh, PAM_AUTHTOK, resp);
+ struct pam_response *response;
+ struct pam_message msg=
+ {
+ .msg_style=PAM_PROMPT_ECHO_OFF,
+ .msg="Password or swipe finger: "
+ };
+ const struct pam_message *msgp=&msg;
+
+ struct pam_conv *conv;
+ //get the pam_conv data from the Pam application
+ pam_get_item(pam_thinkfinger->pamh, PAM_CONV, ((const void**) ((void*) &conv))); //ignore type punning warning here
+ //Ask for the Password
+ conv->conv(1,&msgp,&response,conv->appdata_ptr);
+ //Save the Password as the Shared Password
+ pam_set_item (pam_thinkfinger->pamh, PAM_AUTHTOK, response->resp);
 pthread_mutex_lock (&pam_thinkfinger->retval_mutex);
 pam_thinkfinger->retval = PAM_SERVICE_ERR;
 pthread_mutex_unlock (&pam_thinkfinger->retval_mutex);
@@ -126,19 +136,128 @@

 pthread_exit (NULL);
 }
+/*
+ * local_login
+ * Check if the Current user is physical present
+ *
+ * Function is based on the function with same name from
+ * pam.c out of the http://www.pamusb.org project
+ *
+ * Thanks to Andrea Luzzardi <scox@ge...>
+ * the code was licensed under GPL.
+ *
+ * Only This Function:
+ * Copyright (c) 2003,2004,2005 Andrea Luzzardi <scox@ge...>
+ *
+ * Modifications:
+ * -Replaced the logging system with some simpler solution.
+ * -Replaced the usb specific parts.
+ * -Optimized, to use get by line instead of a while loop scanning in utmp
+ *
+ */
+#define DEBUGP(...)

+static int local_login (pam_handle_t *pamh)
+{
+ struct utmp *utent = NULL;
+ struct utmp ut;
+ char *tty = NULL;
+ int i = 0;
+
+ //TODO: this should be configured somewhere ?
+ char *local_devs[]={
+ "/dev/vc",
+ "/dev/tty",
+ NULL
+ };
+ char *local_host[]={
+ ":",
+ NULL
+ };
+
+ if (pam_get_item (pamh, PAM_RHOST, (const void **) ((void*) &tty)) != PAM_SUCCESS) {<br /> + DEBUGP ("Cannot retrieve remote host\n");
+ return 0;
+ }
+ if (tty)
+ return 0; //we have a rhost --> nonlocal
+
+
+ if (pam_get_item (pamh, PAM_TTY, (const void **) ((void*) &tty)) != PAM_SUCCESS) {
+
+ DEBUGP ("Cannot retrieve tty name\n");
+ return 0;
+ }
+
+ if (!tty) {
+ DEBUGP("PAM_TTY was empty, rejecting.\n");
+ return 0;
+ }
+ while (local_devs[i]) {
+ if (!strncmp (tty, local_devs[i], strlen(local_devs[i]))) {
+ DEBUGP ("Authentication request from local console (%s)\n", tty);
+ return 1;
+ }
+
+ ++i;
+ }
+ i = 0;
+
+ setutent(); //rewind
+
+ DEBUGP ("Searching the utmp entry for tty %s...\n", tty);
+
+ //Search Filter
+ memset(&ut,0,sizeof(ut));
+ strcpy(ut.ut_line,tty);
+ //Search
+ utent=getutline(&ut);
+ //close wtmp
+ endutent();
+
+ if (utent == NULL) {
+ DEBUGP ("Cannot retrieve the utmp entry\n");
+ return 0;
+ }
+
+ DEBUGP ("Authentication request from %s (%s)\n", tty, utent->ut_host);
+
+ //No host --> seems to be local
+ if (!strlen(utent->ut_host))
+ return 1;
+
+ while (local_host[i]) {
+ if (!strncmp (utent->ut_host, local_host[i], strlen(local_host[i]))) {
+ return 1;
+ }
+
+ ++i;
+ }
+
+
+ return 0;
+}
+
 PAM_EXTERN
 int pam_sm_authenticate (pam_handle_t *pamh,int flags, int argc, const char **argv)
 {
 struct pam_thinkfinger_s pam_thinkfinger;
 struct termios term_attr;
 _Bool tty = false;
 -
+
 tty = isatty (STDIN_FILENO);
 if (tty)
 tcgetattr (STDIN_FILENO, &term_attr);

 pam_thinkfinger.retval = PAM_SERVICE_ERR;
+ //check for Remote User
+
+ if (!local_login(pamh))
+ {
+ //TODO: do additional check here, perhaps its an intrusion??
+ goto out;
+ }
+
 pam_get_user (pamh, &pam_thinkfinger.user, NULL);
 if (pam_thinkfinger_check_user (pam_thinkfinger.user))
 goto out;
@@ -167,17 +289,19 @@
 return PAM_SUCCESS;
 }

+/* Password Management API's */
+PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
+ int argc, const char **argv)
+{
+ return PAM_SUCCESS;
+}

 #ifdef PAM_STATIC

 struct pam_module _pam_thinkfinger_modstruct = {
- "pam_thinkfinger",
- pam_sm_authenticate,
- pam_sm_setcred,
- NULL,
- NULL,
- NULL,
- pam_sm_chauthtok
+ .name="pam_thinkfinger",
+ .pam_sm_authenticate=pam_sm_authenticate,
+ .pam_sm_setcred=pam_sm_setcred
 };

 #endif

edit2: added configure options...

Last edited by Sigi (2007-01-30 01:01:43)

Sigi · 2007-01-29 22:08:22

It now seems to build fine and tf-tool acquires and verifies well. I followed the README and created a /etc/pam.d/common-auth file.
Anyway, it doesn't ask me to swipe my finger on login. Is the way pam is installed on Arch somehow different than it is is other Distros?

edit: In Arch, I think one has to change /etc/pam.d/others
After changing it, I have this error message in /var/log/auth.log:

Jan 30 00:09:33 arch login[2997]: PAM unable to dlopen(/lib/security/pam_thinkfinger.so)
Jan 30 00:09:33 arch login[2997]: PAM [dlerror: /lib/security/pam_thinkfinger.so: undefined symbol: pam_prompt]
Jan 30 00:09:33 arch login[2997]: PAM adding faulty module: /lib/security/pam_thinkfinger.so

Last edited by Sigi (2007-01-29 23:19:57)

Sigi · 2007-01-30 00:19:00

It's in the AUR!

Check out the wiki Page!

Last edited by Sigi (2007-01-30 01:01:08)

mutlu_inek · 2007-01-30 01:40:22

Wow! Impressive work. Even a wiki page. Thank you very much, Sigi! I will try it out some time next week.

Sigi · 2007-01-30 21:10:44

Thanks! Just as an update:
I've uploaded thinkfinger-svn-55-1 today and changed the wiki to reflect a few changes made in the newest PKGBUILD. It works fine here, which means that I'm able to "login" and "su" with my password or with my fingerprint. There are a lot of things I haven't tested yet (such as kdm etc) and which I probably never will test due to lack of time, interest or both.
I'll make some changes to the PKGBUILD in a few days and take a "more official" patch to fix the pam<=0.81 issue. The one used now works perfectly but there are some enhancements in other patches.
Secondly I'm going to make a PKGBUILD for slock asap. Slock is an app to lock your screen and I found a patch to use (dwm,) slock and thinkfinger together. I'll keep you up to date...

edit: I knew that I'll forget that punbb changed smiley syntax as well...

Last edited by Sigi (2007-01-30 21:13:10)

Sigi · 2007-01-31 19:57:25

Sigi wrote:

I'll make some changes to the PKGBUILD in a few days and take a "more official" patch to fix the pam<=0.81 issue. The one used now works perfectly but there are some enhancements in other patches.

Done, thinkfinger-svn-55-2 is in the AUR.

Master One · 2007-01-31 21:27:26

Sigi, you are a machine... (I wish I had time to test it right away, but this will have to wait most likely till the weekend).

P.S. Any comment on the mentioned harddisc protection system (or do you have no need for that functionality)?

Sigi · 2007-01-31 23:17:04

No I'm an idiot. I'm doing things like this instead of learning for an exam I'm going to write fridays...

About hdaps: I haven't got it working right now and it is also something I'd like to have running asap. I'll first have to visit thinkwiki.org and read a little about it, I think.

Master One · 2007-01-31 23:37:39

As mentioned, setting up hdaps & also tp_smapi is pretty easy, made it work in Kubuntu several times, I just didn't try on Arch by now (being still an Arch newbie, and always that lack of time). ThinkWiki is your friend, the explaination there is really straight-forward.

hacosta · 2007-02-04 21:46:11

i dont have a thinkpad, but i do have a toshiba that has a Thompson Microelectronics blah
followed the wiki, but if i use the /etc/pam.d/su file as provided in the wiki, when i type su i get an immidiate
su: incorrect password what can be causing this?

hacosta · 2007-02-04 21:54:46

oh i needed to do a tf-tool --add-user root (:

Sigi · 2007-02-04 23:23:04

hacosta wrote:

oh i needed to do a tf-tool --add-user root (:

Changed the wiki accordingly, thanks for letting us now!

hacosta · 2007-02-05 04:31:49

actually i think theres a slight error on the pam configuration, one should be able to su to a normal user without being asked to put a password.
cant figure the rules out though

mutlu_inek · 2007-02-08 05:28:54

Well, it does not seem to work for me. Installation went fine, but tf-tool automatically registers a failed swipe after about 1 to 2 seconds, whether I touch the fingerprint reader or not. Swiping my finger does not result in any effect on tf-tool. This is the (not very helpful) output:

$ sudo tf-tool --acquire --verbose

ThinkFinger 0.2.2 (http://thinkfinger.sourceforge.net/)
Copyright (C) 2006, 2007 Timo Hoenig <thoenig@suse.de>

Running in verbose mode.

* Mode: acquire
* Biometric identification record file: '/tmp/test.bir'

Initializing... done.
tf-tool: TF_STATE_SWIPE_0 (2)
Please swipe your finger (successful swipes 0/3, failed swipes: 0)...tf-tool: TF_STATE_SWIPE_FAILED (6)
Please swipe your finger (successful swipes 0/3, failed swipes: 1)...

At this point I have to exit the program with Ctrl-C.

The logfiles do not provide for any clues.

Master One · 2007-02-08 16:53:42

Sigi, it works as advertised here on my ThinPad T42p!

One addition for the wiki-page: To be able to login on a virtual console using a fingerprint, I had to modifiy /etc/pam.d/login. I have no clue, what /etc/pam.d/other is used for.

Sigi · 2007-02-08 17:55:14

Master One wrote:

Sigi, it works as advertised here on my ThinPad T42p!

Good

Master One wrote:

One addition for the wiki-page: To be able to login on a virtual console using a fingerprint, I had to modifiy /etc/pam.d/login. I have no clue, what /etc/pam.d/other is used for.

Good luck wikis are open to be edited by everybody

mutlu_inek: I never experienced anything similiar. It would be great if you could explain your problem on the thinkfinger-devel Mailing List. Timo and Luca are really helpful developers!

ratur · 2007-02-08 18:40:36

Dawm that rocks !

Thank you very much

Arch Linux

#1 2007-01-29 00:55:38

[Req] Thinkfinger [Done]

#2 2007-01-29 02:01:54

Re: [Req] Thinkfinger [Done]

#3 2007-01-29 07:03:16

Re: [Req] Thinkfinger [Done]

#4 2007-01-29 11:27:07

Re: [Req] Thinkfinger [Done]

#5 2007-01-29 15:26:31

Re: [Req] Thinkfinger [Done]

#6 2007-01-29 16:43:26

Re: [Req] Thinkfinger [Done]

#7 2007-01-29 17:11:28

Re: [Req] Thinkfinger [Done]

#8 2007-01-29 18:52:05

Re: [Req] Thinkfinger [Done]

#9 2007-01-29 20:57:48

Re: [Req] Thinkfinger [Done]

#10 2007-01-29 22:08:22

Re: [Req] Thinkfinger [Done]

#11 2007-01-30 00:19:00

Re: [Req] Thinkfinger [Done]

#12 2007-01-30 01:40:22

Re: [Req] Thinkfinger [Done]

#13 2007-01-30 21:10:44

Re: [Req] Thinkfinger [Done]

#14 2007-01-31 19:57:25

Re: [Req] Thinkfinger [Done]

#15 2007-01-31 21:27:26

Re: [Req] Thinkfinger [Done]

#16 2007-01-31 23:17:04

Re: [Req] Thinkfinger [Done]

#17 2007-01-31 23:37:39

Re: [Req] Thinkfinger [Done]

#18 2007-02-04 21:46:11

Re: [Req] Thinkfinger [Done]

#19 2007-02-04 21:54:46

Re: [Req] Thinkfinger [Done]

#20 2007-02-04 23:23:04

Re: [Req] Thinkfinger [Done]

#21 2007-02-05 04:31:49

Re: [Req] Thinkfinger [Done]

#22 2007-02-08 05:28:54

Re: [Req] Thinkfinger [Done]

#23 2007-02-08 16:53:42

Re: [Req] Thinkfinger [Done]

#24 2007-02-08 17:55:14

Re: [Req] Thinkfinger [Done]

#25 2007-02-08 18:40:36

Re: [Req] Thinkfinger [Done]

Board footer