[SOLVED] biometrics : fingerprinting and Debian ?

Herve5 · 05-28-2020, 05:26 AM

Hello all,
I'm finalizing the install of a new Debian Testing Xfce non-free on a new Lenovo thinkpad P53 and (sometimes thanks to this forum) things are going almost perfectly.
It happens the machine features a fingerprint reader, which is impressively efficient when booting Windows 10
(having always been sceptical on this kind of things, it really took time for me before admitting that yes, that is really faster than a log/pass and better than just nothing at wakeup ;-)

So, I had a look in Synaptic with 'biometric' as a keyword, and I found apparently a single development, by people I had not heard of till now, named UKUI, with real bits on github for thumbreaders etc.

So my questions would be :
- Are these UKUI guys honourably known, are there users here?
- If I install these drivers, am I at risk of importing ranges of dependencies which I may not manage to eliminate properly afterwards if things don't work? (I'm an autoremove real newbie ;-)
- Are there other drivers elsewhere that you would recommend?

Thank you!!
Hervé

shruggy · 05-28-2020, 06:18 AM

Quote:

Originally Posted by Herve5

Are there other drivers elsewhere that you would recommend

Never used it, but I can see at least one other module, fprintd:

Code:

$ axi-cache --all search \( authentication OR reader \) \( biometric OR fingerprint \)
50% libpam-biometric - Insertable authentication module for PAM
42% fprintd - D-Bus daemon for fingerprint reader access
40% libpam-fprintd - PAM module for fingerprint authentication through fprintd
$ apt show libpam-{biometric,fprintd} fprintd|grep -v '^[^PD ]'

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Package: libpam-biometric
Priority: optional
Depends: libc6 (>= 2.14), libgcc-s1 (>= 3.0), libpam0g (>= 0.99.7.1), libqt5core5a (>= 5.12.2), libqt5dbus5 (>= 5.0.2), libstdc++6 (>= 4.1.1)
Download-Size: 417 kB
Description: Insertable authentication module for PAM
 The indispensable part for biometric authentication in
 ukui desktop environment.
 This package contains a modules for PAM.

Package: libpam-fprintd
Priority: extra
Depends: fprintd (= 1.90.1-1ubuntu1), libpam-runtime (>= 1.1.3-2~), libc6 (>= 2.17), libpam0g (>= 0.99.7.1), libsystemd0 (>= 237)
Download-Size: 12,5 kB
Description: PAM module for fingerprint authentication through fprintd
 fprintd is a D-Bus daemon that offers libfprint functionality over the
 D-Bus interprocess communication bus. By adding this daemon layer above
 libfprint, various problems related to multiple applications simultaneously
 competing for fingerprint readers get solved.
 .
 This package provides a PAM module for fingerprint-based authentication
 via fprintd.

Package: fprintd
Priority: extra
Depends: dbus, policykit-1, libc6 (>= 2.4), libdbus-1-3 (>= 1.9.14), libdbus-glib-1-2 (>= 0.88), libfprint-2-2 (>= 1:1.90.1), libglib2.0-0 (>= 2.56), libpolkit-gobject-1-0 (>= 0.99)
Download-Size: 40,3 kB
Description: D-Bus daemon for fingerprint reader access
 fprintd is a D-Bus daemon that offers libfprint functionality over the
 D-Bus interprocess communication bus. By adding this daemon layer above
 libfprint, various problems related to multiple applications simultaneously
 competing for fingerprint readers get solved.

ondoho · 05-28-2020, 01:25 PM

+1 for fprintd.
Have it set up on my thinkpad, was surprisingly easy. Automatically integrates as a "pam module" (iirc) so I can use it for logging in & all sudo commands. Nifty.

Herve5 · 05-31-2020, 10:47 AM

Thank you Shruggy, Ondolo!

I just tried to install fprintd (on Debian Testing / Lenovo Thinkpad P53) but apparently when trying fprintd-verify or fprintd-demo, my fingerprint reader is not 'seen', although it is listed (06cb:00bd) on the list in https://fprint.freedesktop.org/supported-devices.html.

I'll try again later on; maybe I forgot something (or everything should have been run as root?)

Curiously, straight within the Debian distro I have a small 'Firmware' dashboard*, that does see the 'Prometheus' fingerprint reader, and this just disappears once I install fprintd. I MUST have missed something ;-)

(*) https://imgur.com/TSVS2zS.png

Herve5 · 06-11-2020, 09:33 AM

I come back to this some time later : it seems, after discussing with Lenovo, that the version of fprintd (and libfprint) that I have within the Debian-Testing repo is largely out of date (0.9 instead of 1.9 at least, and they start 2.x in parallel).
I didn't find a compiled version for 1.9 and am told it may be 'difficult to compile' : given my rather poor competence level, I may be bound to waiting for later upgrades...

Thank you for your kind support!

Hervé

Herve5 · 11-01-2020, 03:01 AM

Continuing on this old but unsolved thread : Debia-Testing now incorporates far more recent fprintd an libfprint packages, that I updated, and in a terminal everything runs fine : I now can record fingerprints and test them!
But, I still didn't see how to integrate this within a lockscreen or a login (OK, it's rather a new question).
I'm on xfce (Debian testing) and the GUI for user handling is really minimal.
Could someone advise me on GUIs that would reasonably plug fingerprinting in?

For now I found Gnome's gnome-system-tools which doesn't weight too much and would support handling the creation of new users but I'm not sure yet that it'd also handle fingerprints.

Any advice would definitely be welcome!

ondoho · 11-03-2020, 12:25 AM

Quote:

Originally Posted by Herve5

I still didn't see how to integrate this within a lockscreen or a login (OK, it's rather a new question).

https://wiki.archlinux.org/index.php/Fprint
That's what helped me set it up on ArchLinux half a year ago. I found it fairly easy, and after that it worked for login, sudo requests etc.
I hope it helps you too.

Herve5 · 11-09-2020, 05:40 AM

Quote:

Originally Posted by ondoho

https://wiki.archlinux.org/index.php/Fprint
That's what helped me set it up on ArchLinux half a year ago. I found it fairly easy, and after that it worked for login, sudo requests etc.
I hope it helps you too.

Thank you Ondoho!

Your reference is very clear, indicating how to add one line
auth sufficient pam_fprintd.so
before the
auth include system-login

My worry is, this within ArchLinux lies in /etc/pam.d/system-local-login which is a file that just does not exist in my Xfce /etc/pam.d/

But thanks to you I never was so close to success!
I now must understand which language is expected and where for Xfce

Thanks again!!
Hervé

shruggy · 11-10-2020, 04:42 AM

Well, the package libpam-fprintd in Debian includes /usr/share/pam-configs/fprintd.amd64 which means it probably could be (re)configured through

Code:

dpkg-reconfigure libpam-runtime

Herve5 · 11-16-2020, 01:31 PM

Thank you Shruggy, very interesting indeed.
Knowing that I am quite the average user, can I launch this 'safely'? (I presume whatever happens, it only will concern fingerprints and not wreck other things?)

Thank you again!
Hervé

ondoho · 11-17-2020, 12:48 AM

^ You want a guarantee?
It "should work"(tm).

Quote:

Originally Posted by ondoho

That's what helped me set it up on ArchLinux half a year ago.

I have to correct myself there; I did in fact set it up on Debian:
https://dt.iki.fi/thinkpad-x250-linu...-reader-debian

Herve5 · 11-17-2020, 08:44 AM

Thank you Shruggy, Ondoho : thanks to you I managed to reach it. It seems the only command missing here was

Quote:

~$ sudo pam-auth-update --enable fprintd.amd64

I think I still have to check which fingerprints I have recorded, long ago, but at least I am asked to show one, and... sometimes... it works

[edit] it works really well in fact. It's just I am not used to put my finger on the little square when seeing an auth dialog, in fact...

ondoho · 11-18-2020, 12:44 AM

Quote:

Originally Posted by Herve5

and... sometimes... it works

I think it's better if it's picky. More convenience usually means laess safety.

Herve5 · 11-18-2020, 01:36 AM

Quote:

Originally Posted by ondoho

I think it's better if it's picky. More convenience usually means laess safety.

You are right.
Actually things work quite well, and I can see now the last glitch I have : fingerprint is detected in all circumstances (say, when launching Synaptic) SAVE at login.
At login, I ge the classical dialog with an added "use your right fingerprint" request but then, nothing happens until I get a timeout and can enter the normal password.
Maybe a part of the fingerprint recognition process isn't allowed to run before login, on hasn't the right privileges yet, or isn't part of the right group...

[edit] it does work at login. Only, one must both place the finger on the detector AND click on the "login" button.
This that may seem obvious isn't because all other fingerprint actions (like launching Synaptics for instance) auto-trigger just with the finger, no button needed.
So the naive beginner like me is bended into thinking finger always trigger all, which is OK everywhere but not at login ;-)