Friday, February 13, 2009

Setting up a fingerprint reader with ThinkFinger in Ubuntu 8.10

If your laptop has a fingerprint reader installed in it, there's a decent chance you can set it up very easily in Ubuntu to login and [gk]sudo. Since the manpage isn't particularly helpful, I'll guide you through setting it up with the ThinkFinger library, which is compatible with most popular readers installed in Lenovo/Thinkpads, Dells, and Toshibas.
  1. Install the necessary libraries: sudo apt-get install thinkfinger-tools libpam-thinkfinger
  2. Integrate thinkfinger with PAM (Pluggable Authentication Modules): sudo /usr/lib/pam-thinkfinger/pam-thinkfinger-enable
  3. Now acquire your fingerprint: run tf-tool --acquire. If you get an error here (not a failed swipe, you just need to swipe better), running it with sudo might be necessary. If you still get an error that thinkfinger can't interact with your reader, it probably isn't supported, sorry! Otherwise, keep swiping your finger until you get two successful swipes.
  4. Finally, make sure it worked: run tf-tool --verify and swipe your finger. Try this a few times, and if it doesn't have a good success rate, do another acquire (the previous step), perhaps slower and more intentionally.

Now you can log in by swiping your finger at the password prompt, and more usefully in my opinion, swipe your finger instead of entering the root password at terminal and graphical password prompts. This is one of those little things that, once you get used to it, is hard to ever live without. Check it out:


By the way, while there may be valid security concerns with fingerprint readers, don't listen to the critics who say you can just breathe on it to get a swipe. 2D fingerprint scanners may work this way, but laptop fingerprint readers take a reading in both space and time. Try using tf-tool --verify and finding out for yourself; you can blow and breathe on your fingerprint reader all day without getting it to even recognize a scan, let alone a failed one.

11 comments:

Anonymous said...

Hey that theme looks great, what's the name?

ryan said...

Dell's Ubuntu installations pre-configure this option, at least they did on my M1530.

Very slick.

crashsystems said...

While I don't know about the whole breathing thing, the gelatin finger trick should be sufficient to trick the sensor.

Of course, an attacker using such techniques is going to be more than just some random person who walks by your laptop and decided to mess with it. This means that they are after data on your laptop, and not having the fingerprint reader would not be a deterrent to them. Against such attacks, only good crypto can keep you safe, such as encrypted LVM or Jaunty's upcoming encfs encrypted home feature.

Mattias said...

The fedora people have put some work to get fprint (a dbus based fingerprint reader integration) to work well with Gnome. They have made some about-me integration aso. So it might be worth looking at that also.

Anonymous said...

I tried on a HP DV6000 and all I got was "Initializing...USB device not found"

When I ran "lsusb" I saw:
Bus 005 Device 002: ID 08ff:2580 AuthenTec, Inc. AES2501 Fingerprint Sensor


I guess this "thinkFinger" program only works with "Thomson Microelectronics". I hope someone will come up with a unified framework for these kinds of readers.

Aigarius said...

Most of those systems are easily fooled with a black and white printout of your fingerprint. Could you try it and see if it works?

Dread Knight said...

I just use the thing from BIOS that prompts me to swipe when i start tablet pc and i can also enter my password.
Works good in combination with auto-logic in my Kubuntu Jaunty :P

Michael said...

Anonmyous: the theme is Dust: https://wiki.ubuntu.com/Artwork/Incoming/DustTheme

Ryan: yeah, Dell is doing a pretty slick job of properly supporting Ubuntu. As a result I am on an M1330 right now (though not with Ubuntu pre-installed, this was a refurb).

crashsystems, Aigarius: if someone has a copy of my fingerprint, then they basically have a copy of my password. It wouldn't surprise me if that works. So does having a copy of your text password, which I could get much easier than a scan of your fingerprint, just by looking over your shoulder.

Dread Knight, that will take care of logging in via fingerprint, but won't help for those times when you have to type in your password once logged in, such as terminal and graphical sudos including updates. This is really the main feature IMO.

Chris said...

Clear, concise and it works! Many thanks.

Fingerprint readers said...

thanks for giving the steps in setting up the fingerprint readers.

Anonymous said...

My Lenovo T61 is Running Ubuntu 10.4 and thanks to your instructions swiping is now working smoothly!

Thanks so much, Jose.