/usr/bin/pwn

ThinkFinger is a utility to enable the fingerprint reader on IBM/Lenovo ThinkPad laptops, allowing you to use the fingerprint reader to authenticate yourself in the command prompt and for sudo. But getting it put together can be tricky, and working with GNOME for login and for unlocking the screen at least used to be impossible. So here's a quick, maybe 10 or 15 minute guide at getting it all working so that you can use your fingerprint almost exclusively for authentication in Ubuntu 8.04 "Hardy Heron" for authentication.

1. Install ThinkFinger-related packages via Synaptic or the command line. You only need three packages: libthinkfinger0, thinkfinger-tools, and libpam-thinkfinger. Let's work in a sudo shell just to simplify things.

   ~$ sudo -s
   ~# apt-get install libthinkfinger thinkfinger-tools libpam-thinkfinger

2. In the file /etc/pam.d/common-auth, add try-first-pass to the end of the line

   auth requisite pam_unix.so nullok_secure

   and above that line add the line

   auth sufficient pam_thinkfinger.so

   The file should now look like this:

    #
    # /etc/pam.d/common-auth - authentication settings common to all services
    #
    # This file is included from other service-specific PAM config files,
    # and should contain a list of the authentication modules that define
    # the central authentication scheme for use on the system
    # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
    # traditional Unix authentication mechanisms.
    #
   auth sufficient pam_thinkfinger.so
   auth requisite pam_unix.so nullok_secure try_first_pass
   auth optional pam_smbpass.so migrate missingok

3. Save the following as /etc/udev/rules.d/60-thinkfinger.rules:

    #
    # udev rules file for the thinkfinger fingerprint scanner
    #
    # gives access to the fingerprint reader to those in the "fingerprint" group
    #
    # Taken from:
    # <http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader_with_ThinkFinger<
    # which was taken and modified from:
    # <http://article.gmane.org/gmane.linux.drivers.thinkfinger/329>
    #
    
    # SGS Thomson Microelectronics Fingerprint Reader
   SYSFS{idVendor}=="0483", SYSFS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"
    
    # the also-needed uinput device
   KERNEL=="uinput", MODE="0660", GROUP="fingerprint"

   This fixes the common problem that used to prevent the user from being able to use the fingerprint reader to unlock the screen from the screensaver: the user being unable to gain control of the reader. What this file does is tells the kernel to allow users in the fingerprint group to access the fingerprint reader. So, naturally, we need to...

4. Add the fingerprint group and add yourself to it:

   ~# addgroup fingerprint
   ~# adduser jbhannah fingerprint

   obviously replacing jbhannah with your own username ($USERNAME returns root in a sudo shell, which we don't want).

5. Reload all udev triggers:

   ~$ udevtrigger

6. Exit the sudo shell and acquire fingerprint information:

   ~# exit
   ~$ tf-tool --acquire

   If you get the following error message:

   Warning: usb_bulk_read expected to read 0x40 (read 0x38 bytes)

   or something similar, just ^C (read: "Control-C") a few times until the prompt comes back, or close the terminal and try again. It may take a few tries, but after doing this for me on the first try it worked on the second.

7. Change the ownership of the file ~/.thinkfinger.bir to $USERNAME:root:

   ~$ sudo chown $USERNAME:root ~/.thinkfinger.bir

You should now be able to lock your screen and then use the fingerprint reader to unlock it, as well as login to GNOME and provide authentication for programs that require administrative (gksu or PolicyKit) authentication. Compiled from information at Luke's Ubuntu on ThinkPad X60 Tablet guide and ThinkWiki.