A screenshot of the fingerprint sensor window in Linux.
When I wrote earlier about support for the IBM Thinkpad's hard drive accelerometer in Linux (which, incidentally, has now become a part of the official kernel), I mentioned in passing that UPEK, maker of the fingerprint scanner found on more recent Thinkpads (including most of the models in the T43 and X41 series), had committed to making Linux compatible drivers. I soon forgot about UPEK. After I switched to Linux again, I also forgot about my fingerprint sensor, only noticing it when smug Mac users pointed out that it did not work under Linux (their smugness disappeared, at least for a couple of seconds, when I brought up the fact that Powerbooks do not even have biometric authentication yet).

Sometime early this morning, I was browsing the excellent ThinkWiki. I was considering whether installing the SMAPI kernel module or trying to upgrade the BIOS were risks worth taking, when I read, "Version 1.0 (final) of the BSP for the UPEK fingerprint sensor released." I downloaded it immediately.

ThinkWiki's "How to enable the fingerprint reader" is a far more comprehensive HOWTO than one I could create. If you have a compatible Thinkpad and want fingerprint authentication to work, that document is essential reading. Since it is a wiki, you could edit it if you find mistakes.

Alas, my build of Firefox is suffering from a strange bug that truncates textboxes at 4096 characters, which can be annoying and embarassing when editing long pages. As a result, my notes on the process must reside here. Please note that I am running Gentoo, and compiled everything from source - this may have colored my process; I am not sure.

  1. To enroll fingerprints in Linux, you need to run the SAMPLE program. Note that there is a SAMPLE program which is installed with the bioapi package; this did not seem to work for enrolling fingerprints. Unfortunately, the code for compiling the SAMPLE program in the final version of the UPEK driver seemed to have a multitude of errors. As a result, I grabbed a pre-compiled version of SAMPLE from the second beta of the UPEK driver.

  2. In order to use the fingerprint sensor for authentication, you have to edit your PAM files. On the current version of the wiki, it is suggested to use /etc/pam.d/common-auth instead of /etc/pam.d/system-auth if you are running Gentoo, in order to avoid "account expired" errors. I found that using common-auth did not work, since no other PAM configuration files referenced it. I also did not get any errors when using system-auth as originally suggested on the wiki.

    Either way, I only wanted to use the fingerprint sensor upon login, so I put the fingerprint settings into /etc/pam.d/bioapi and added one line to /etc/pam.d/gdm: auth include bioapi

I made two small movies of what the fingerprint authentication process looks like. Since I failed to bring my digital camera home from school, I used my cell phone, which only outputs video in 3GP format. If you are using Windows or a Mac with a recent version of QuickTime, you should be fine. If you are on Linux, I trust you know what you are doing.

Movie #1 (221 KB)
Movie #2 (243 KB)