[Hardy Feature Request] Add support for biometric fingerprint reader

Platform support now available in my PPA:

deb http://ppa.launchpad.net/keybuk/ubuntu hardy main
deb-src http://ppa.launchpad.net/keybuk/ubuntu hardy main

apt-get install hal libpam-runtime libpam-thinkfinger thinkfinger-tools

(Updated HAL and libpam-runtime are needed to activate support for it)

Enroll your fingerprint (not as root):

  $ tf-tool --acquire

Check it:

  $ tf-tool --verify

Assuming that goes well, reboot. You'll now be able to use your fingerprint in places that you can use your password (gdm login, screensaver unlock, sudo prompts, gksudo prompts, PolicyKit authorisations) -- note that for gdm, you still need to enter your username first.

TODO (assuming the above works) - graphical version of tf-tool integrated into About Me

After realizing that this needs to be done with your thumb rather than any other finger, I got this to work for myself on an M09 system using the packages in the PPA. Works fairly well.

A few things stick out about this implementation:
 1) The login screen's new phrase "password or swipe finger" is too wide for the default theme
 2) gksudo doesn't indicate that you can swipe instead of type a password (although you can)
 3) The old "[sudo] password for $user:" prompt is missing the [sudo] prefix.

While you are discussing GUIs to frontend tf-tool: it would be convenient if you can enroll during oem-config and/or ubiquity's password screen in addition to the About Me panel.

You should be able to use any finger (I use my right middle, for example)

I've been thinking about this package for a while (you may have come
across my somewhat neglected PPA thinkfinger package), and I'd like to
point out that upstream has effectively died. I think the wiki
statement that "upstream believes thinkfinger is complete" is
inaccurate. Perhaps "upstream thinks thinkfinger's design is terrible
and has decided to restart from nearly scratch with fprint". Last I
knew, there were bugs and quirks in the upstream version that made the
system unpleasant, and the Debian maintainer was against fixing quirks
caused by gksudo. I shall try Scott's packages and see how they fare.

Justin Dugger

On Fri, Feb 22, 2008 at 6:02 PM, Scott James Remnant <email address hidden> wrote:
> You should be able to use any finger (I use my right middle, for
> example)
>
>
>
> --
> [Hardy Feature Request] Add support for biometric fingerprint reader
> https://bugs.launchpad.net/bugs/187130
> You received this bug notification because you are subscribed to
> thinkfinger in ubuntu.
>

Well, I can at least confirm that fprint works great with gnome / sudo / gksudo whatever ... someone just needs to package it.

It is a little awkward that gdm can not be configured to give you a normal login (via keyboard) and at the same time let you use fprint to authenticate ... AFAIK that is a pam issue ...

I should add now, that after testing Scott's packages, I found that everything was in working order. GDM, sudo, gksudo, gnome-screensaver, etc. There's probably still bugs lying around, but it at least works. Should I wait for this to move out of PPA and file bugs against thinkfinger then, or report them on this bug?

On Mon, 2008-02-25 at 09:41 +0000, Jörn Dreyer wrote:

> Well, I can at least confirm that fprint works great with gnome / sudo /
> gksudo whatever ... someone just needs to package it.
>
I was not able to get gksudo to work with the existing pam_fprint
module.

Scott
--
Scott James Remnant
<email address hidden>

I modified /etc/pam/common-auth:
<snip>
#fingerprint reader ... somwhat awkward ...
#auth sufficient pam_fprint.so
#auth sufficient pam_fprint.so
#auth sufficient pam_fprint.so
auth required pam_unix.so nullok_secure
</snip>

Sometimes fprint would not succeed the firt time so I use it three times. It works perfectly with sudo on the cmdline and I think gksudo works as well. They do of course not tell you something like "please identify via fingerprint reader". They just sit there and you can try to auth with your finger ...

As you can see above I disabled fprint ... pam lacking the flexibility to give you the choice of auth via fprint or passwort at the same time keeps me from using it. It is nice to hafe fprint auth ... but not at the cost of the way I used to auth.

Damn, I should not post to bugreports when I am obviously still asleep ...

The hal portion was uploaded recently:

hal (0.5.10-5ubuntu8) hardy; urgency=low

  [ Scott James Remnant ]
  * Add debian/patches/96_uinput_device_support.patch: This creates a HAL
    device for the uinput device, allowing us to set ACLs for it using
    PolicyKit/ConsoleKit.

  [ Daniel T Chen ]
  * Add debian/patches/97_fix_power_info_via_sysfs.patch: Fix battery status
    reading from /sys. Patches taken from upstream GIT head.
    (LP: #194052, #194719)

  [ Martin Pitt ]
  * Add debian/patches/02_sysfs_battery_serial.patch: Get battery serial
    number from sysfs. Patch taken fro upstream GIT head.

 -- Martin Pitt <email address hidden> Mon, 03 Mar 2008 15:02:40 +0100

Wishlist:

Add support for the fingerprint reader to seahorse

Thinkfinger has been uploaded.

While this has some issues (it stores the fingerprint in the home directory), it's generally more stable then fprint at this point. Happily the fingerprint files are easy to migrate, so for 8.10 we could switch to an fprint-based solution and migrate the user across.

fprint packages have been available on a PPA for a few weeks now:
https://bugs.edge.launchpad.net/ubuntu/+bug/179923

Hopefully all this can be merged / carried over on one side or the other.

A comment on fprint's packaging bug report indicates think-finger does not support Authentec devices (present in Pavillion HP's and Lenovo v-series).

Just so this is accurate, this bug should be specific about models/brands it supports if it only tracks thinkfinger packages. Not sure how to go about this.

This has been implemented. It is not active by default though unless using an Ubuntu preload.

Mario, care to elaborate which package(s) or UI(s) implement this on Dells ? Ubuntu pre-loaded Dells don't come with fingerprint readers, so I am a bit puzzled by your comment. Plus I would think only Scott should mark this as "fix released" as its assigned to him, am I missing something ?

Fabián:
The parts to implement this in the Dell Factory process have been put in place for possible future offerings.

Why just for "Dell Factory process" ?
Couldn't we install it automatically if a fingerprint reader is detected ?
And is a graphical settings planned for 8.10 ;-)

There's a technical question of security that would need to be addressed, as well as manipulation of pam scripts to support it working out of box. Currently these are both left to the user and preloaders to decide.

PAM enabler script uploaded in libpam-thinkfinger package today

Please support (via thinkfinger or otherwise) the following (non Dell) device:
  UPEK, Inc. TouchChip TFM ESS ( 0x147E:0x2016 )

More info can be found here:
  http://www.qbik.ch/usb/devices/showdescr.php?id=4325
  http://www.qbik.ch/usb/devices/showdev.php?id=4325

This device is not detected properly in Hardy.
  $ lsusb|grep 147e
  Bus 002 Device 002: ID 147e:2016

this should result in something like
  Bus 002 Device 002: ID 147e:2016 UPEK, Inc. TouchChip TFM ESS
or at least
  Bus 002 Device 002: ID 147e:2016 UPEK, Inc.

Please contact me for futher details or testing support for this fingerprint reader.

On Fri, 2008-06-27 at 19:23 +0000, Pander wrote:

> Please support (via thinkfinger or otherwise) the following (non Dell) device:
> UPEK, Inc. TouchChip TFM ESS ( 0x147E:0x2016 )
>
Is this not supported already by thinkfinger (Hardy) or fprint
(Intrepid) ?

Scott
--
Scott James Remnant
<email address hidden>

http://www.reactivated.net/fprint/wiki/Unsupported_devices#UPEK_TouchStrip_device_variant has some documentation on the problem. This should really be another bug; LP Bug #243758 looks to be about the same subject and from the same user -- apparently someone's discovered the tactic of reporting new bugs inside existing bugs with substantial subscribers.

I easily got my Authentec working with the hardy backported libpam-fprint, but making it supported and accounted for by Ubuntu itself would be a great feature for Intrepid.

What I would like to see is a user-friendly enrollment application which modifies the pam-configuration upon completion.

Ideas for UI could be taken from HP Credential Manager (http://www.stevens-tech.edu/itwiki/cgi-bin/wiki/images/2/25/FPR3.jpg) and/or fprint_demo (http://www.novell.com/coolsolutions/img/20020-1.jpg)

I would love to have this.

The bug task for the somerville project has been removed by an automated script. This bug has been cloned on that project and is available here: https://bugs.launchpad.net/bugs/1306061