ThinkFinger

Use tf-tool to test ThinkFinger. You will have to run this as root because a direct access to the USB devices is needed. Run tf-tool --acquire to generate a file at /etc/pam_thinkfinger/test.bir and tf-tool --verify to see if it identifies you correctly. tf-tool --add-user <username> acquires and stores your fingerprint in , which is needed for an authentication with PAM.

Change the file to look like this if you want to use your fingerprint to authenticate yourself on logon:

Change this file to confirm the command with a finger-swipe:

/etc/pam.d/su

#%PAM-1.0
auth            sufficient      pam_rootok.so
auth		sufficient 	pam_thinkfinger.so
auth		required	pam_unix.so nullok_secure try_first_pass
account		required	pam_unix.so
session		required	pam_unix.so

Change this file to confirm the command with a finger-swipe:

XScreensaver is a bit tricky. First, configure PAM with a file containing:

This still will not work because Xscreensaver cannot read/write from and . A udev rule must be written to authorize a new group read/write access.

First, create a new group, let us say fingerprint:

# groupadd fingerprint

Add the user you want to be able to unlock Xscreensaver with the fingerprint reader to the group:

# gpasswd -a <user> fingerprint

Logout and login again for the changes to take effect.

Next, search for uinput and bus/usb in your udev rules directory:

Copy the lines you found with grep in the previous step to a new udev rules file:

/etc/udev/rules.d/99fingerprint.rules

KERNEL=="uinput",  NAME="misc/%k", SYMLINK+="%k", MODE="0660", GROUP="fingerprint"
SUBSYSTEM=="usb_device", ACTION=="add", PROGRAM="/bin/sh -c 'K=%k; K=${K#usbdev};printf bus/usb/%%03i/%%03i ${K%%%%.*} ${K#*.}'", NAME="%c", MODE="0664", GROUP="fingerprint"
SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", NAME="bus/usb/$env{BUSNUM}/$env{DEVNUM}", MODE="0664", GROUP="fingerprint"

The difference between the rules in /etc/udev/rules.d/99fingreprint.rules and those in should only be the addition of or at the end of the lines.

After adding the custom udev rules, you should give your user permissions to access their own fingerprint file:

As a last step, you need to remove the root setuid from , otherwise Xscreensaver will not be able to unlock with the fingerprint reader:

# chmod -s /usr/bin/xscreensaver

Edit and add the following line to the top:

Then modify auth required pam_unix.so to look like this:

Edit to look like this:

/etc/pam.d/xdm

#%PAM-1.0
auth            sufficient      pam_thinkfinger.so
auth            required        pam_unix.so use_first_pass nullok_secure
auth            required        pam_nologin.so
auth            required        pam_env.so
account         required        pam_unix.so
password        required        pam_unix.so
session         required        pam_unix.so
session         required        pam_limits.so