Fingerprint GUI

Hi Wolfgang,

I'm using fingerprint-gui from the fingerprint-gui PPA in Debian testing since long ago and everything worked flawlessly (but without the possibility of logging in in SDDM and to unlock the screen by using the fingerprint reader) until the 1.08 update.

After I upgraded to v1.08 I left the laptop for some minute and the screen lock started: when I went back I was unable to unlock the screen since the password was always rejected; I killed the whole session and I discovered that it was impossible to login from SDDM: once I keyed in my password the password field of the DM remained grayed out and the session didn't start.

From the logs it seems that pam_fingerprint-gui.so v1.08 successfully spawns fingerprint-helper, but nothing showed up on the screen:

pam_fingerprint-gui[2997]: Got "debug" argument.
pam_fingerprint-gui[2997]: Pam_sm_authenticate was called with flags 0x0 (UNKNOWN).
pam_fingerprint-gui[2997]: Got no PAM_RHOST.
pam_fingerprint-gui[2997]: Got no SSH_CONNECTION.
pam_fingerprint-gui[2997]: Have no PAM_AUTHTOK.
pam_fingerprint-gui[2997]: PAM_SERVICE: sddm.
pam_fingerprint-gui[2997]: Have no PAM_TTY.
pam_fingerprint-gui[2997]: Have now XDisplay: "(null)" and XAuth: "(null)".
pam_fingerprint-gui[2997]: Have PAM username "mau".
pam_fingerprint-gui[2997]: Parent PID: 2997.
pam_fingerprint-gui[2997]: Child (helper) PID: 2998.
pam_fingerprint-gui[2997]: Wrote random string to fifo.
pam_fingerprint-gui[2997]: running not OPENPAM.
pam_fingerprint-gui[2997]: Prompting password returned PAM_SUCCESS.
fingerprint-helper[2998]: Got "debug" argument.
fingerprint-helper[2998]: Have username mau.
fingerprint-helper[2998]: Started.
fingerprint-helper[2998]: Arg0: fingerprint-helper.
fingerprint-helper[2998]: Arg1: 15.
fingerprint-helper[2998]: Arg2: 16.
fingerprint-helper[2998]: Arg3: .
fingerprint-helper[2998]: Arg4: sddm.
fingerprint-helper[2998]: Arg5: -d.
fingerprint-helper[2998]: Arg6: -user.
fingerprint-helper[2998]: Arg7: mau.
fingerprint-helper[2998]: Arg8: dUmMy4.
fingerprint-helper[2998]: Arg9: dUmMy5.
fingerprint-helper[2998]: Have pipe_r 15 and pipe_w 16.
fingerprint-helper[2998]: Have display=(null), XAUTHORITY=(null).

After a couple of minutes I tried to swipe my finger and in the logs appeared this:

pam_fingerprint-gui[2997]: Got password from helper via pipe.
pam_fingerprint-gui[2997]: Return 25 (PAM_IGNORE).

but the session still didn't start and I had to restart the whole SDDM; I'm wondering if the issue is that pam_fingerprint was unable to guess DISPLAY and/or XAUTHORITY.

The auth log of v1.07 at SDDM login, which didn't spawn fingerprint-helper:

pam_fingerprint-gui[8676]: Got "debug" argument.
pam_fingerprint-gui[8676]: Pam_sm_authenticate was called with flags 0x0 (UNKNOWN).
pam_fingerprint-gui[8676]: Got no PAM_RHOST.
pam_fingerprint-gui[8676]: Got no SSH_CONNECTION.
pam_fingerprint-gui[8676]: Have no PAM_AUTHTOK.
pam_fingerprint-gui[8676]: PAM_SERVICE: sddm.
pam_fingerprint-gui[8676]: Have no PAM_TTY.
pam_fingerprint-gui[8676]: Have now XDisplay: "(null)" and XAuth: "(null)".
pam_fingerprint-gui[8676]: Have PAM username "mau".
pam_fingerprint-gui[8676]: Parent PID: 8676.
pam_fingerprint-gui[8676]: Child (helper) PID: 8677.
pam_fingerprint-gui[8676]: Wrote random string to fifo.
pam_fingerprint-gui[8676]: running not OPENPAM.
pam_fingerprint-gui[8676]: Prompting password returned PAM_SUCCESS.
pam_fingerprint-gui[8676]: Got password by keyboard.
pam_fingerprint-gui[8676]: Return 25 (PAM_IGNORE).

Please tell me if there is something I can try in order to make v1.08 work, thank you in advance

Maurizio

I need to test it myself. What is your installed system?

W.U.

Current Debian testing; relevant versions:

- Plasma 5.6.4
- KDE Frameworks 5.22.0
- Qt 5.5.1
- SDDM 0.13.0
- libpam 1.1.8
- policykit-1 0.105
- polkit-kde-authentication-agent-1 installed but disabled

Thanks

Wolfgang, Maurizio,

I can report similar problems here!

I have been using fingerprint-gui for years (thank you Wolfgang !!) on Kubuntu 14.04

Since v1.08 update, I can only login with fingerprint, typing the password would freeze it. Once logged in, all authentication by password failed. On a Konsole, any sudo command would behave like a wrong password was entered (and I would be "reported"!! ) a bit like it got a failed password even before asking for it.

Didn't test much, but felt like non-kde application (synaptic for examples) behaved better than native kde (muon)

At the moment I've temporarily uninstalled fingerprint-gui, I hope you can fix this, please let me know if there is something I can do to help?

Jyves.

It's always the same with KDE developers: They don't read or don't want to understand the PAM ADG. See these (very old but always ignored) bug reports:
https://bugs.kde.org/show_bug.cgi?id=182623
https://bugs.kde.org/show_bug.cgi?id=105631
https://github.com/sddm/sddm/issues/284
The way they misuse PAM, alternative authentication methods _will_ _not_ _work_!
I'm not willing to make dirty hacks into fingerprint-gui to overcome this situation.
If someone wants to use fingerprints for sudo or console login he should disable fingerprints for sddm and screen unlock in PAM configuration. In current debian do it like follows (AFTER installing fingerprint-gui from PPA):
- make a copy of file /etc/pam.d/common-auth and name it /etc/pam.d/common-auth2;
- comment out or remove the line "auth [success=2 default=ignore] pam_fingerprint-gui.so try_first_identified debug" in /etc/pam.d/common-auth2;
- in file /etc/pam.d/sddm change the line "@include common-auth" to "@include common-auth2";
- do the same in file /etc/pam.d/other;
After reboot you will be able to login in sddm or unlock the screen only with password. Sudo and console login will work with fingerprints too.

W.U.

Wolfgang,

I had already read those old post about KDE developers and feel very sorry for you and understand your frustration.

However I would like to point out that everything was working fine with v1.07 ! Actually I have a second identical laptop still running v1.07, and I can login on KDM !

Is there a way to install v1.07 ? I can only see v1.08 on David Jurenka ppa ?

Thanks,

Jyves.

I'm pretty sure version 1.07 does not work with kdm too. You had to type at least one ENTER in the password field and could login with fingerprint then. This is a "random" behavior. Because of necessary workarounds I had to change something in the PAM module. So it doesn't work this way any more. The affected bugs/workarounds in question see these two threads:
http://home.ullrich-online.cc/fingerprint/Forum/topic.php?TopicId=485&Posts=7
http://home.ullrich-online.cc/fingerprint/Forum/topic.php?TopicId=535&Posts=6

I don't know how to get version 1.07 from PPA. But you can download the sources from homepage and then make and install 1.07 over 1.08.

W.U.

Thanks anyway Wolfgang. Frankly speaking, I refuse to apply such hacks to my system and I preferred to revert to v1.07, which I could find here:

https://launchpad.net/~fingerprint/+archive/ubuntu/fingerprint-gui/+builds?build_text=&build_state=built

I admit that such a situation - a bug open from 11 years because the developer refuses to collaborate - is a shame. Furthermore, I'm generally disappointed about how the development of KDE/Plasma etc. proceeds: despite what version numbers say, this DE is getting outdated while not being stable yet. It's undeniable that something is going (badly) wrong.

Thanks for your work!

Thank you very much! You solved my issue: http://askubuntu.com/questions/795890/kubuntu-14-04-kde-login-impossible-after-update/796146