Hi,
honestly, the PAM stuff is kind of painful, and I don't remember how to
debug it. There is nothing interesting in the log, as far as I can
tell.
I would still expect a PAM misconfiguration of some sort. It should go
into pam_fprintd.so at some point, but e.g. I don't even have that
enabled locally right now. But, this is Fedora, and there it is
configured using authselect.
Benjamin
On Fri, 2024-03-22 at 16:53 +0100, Eric J.P.E. Davanture wrote:
>
> Greetings Benjamin,
>
> Thanks so much for the quick answer.
>
> Here are my answers to your questions (==> Like this):
>
> So, fprintd-verify and fprintd-enroll work, but pam not?
>
> ==> Yes Sir.
>
>
>
>
> Seems like something is broken in the PAM stack. It is hard to tell
> what though, as the only error form fprintd is that Release is called
> without first claiming the device, for which I have no explanation.
> Maybe auth log has more information?
>
> ==> There is no /var/log/auth.log on SuSE Linux so I checked
> /var/log/messages and found that when I lock the desktop and then try
> to unlock with the fingerprint and then the usual password after the
> "Unlocking failed" message:
>
> 2024-03-22T16:48:54.034464+01:00 HP-ZBook17-G8 plasmashell[12364]:
> 2024-03-22 16:48:54.033669 +0100 (0x00007f26f8787700) [info]
> [NetworkReachability] [Loop_0x7ffc65f9e490] network is reachable
> 2024-03-22T16:49:54.412170+01:00 HP-ZBook17-G8 plasmashell[12364]:
> 2024-03-22 16:49:54.411446 +0100 (0x00007f26f8787700) [info]
> [NetworkReachability] [Loop_0x7ffc65f9e490] network is reachable
> 2024-03-22T16:50:07.450723+01:00 HP-ZBook17-G8
> kscreenlocker_greet[22378]: Qt: Session management error:
> networkIdsList argument is NULL
> 2024-03-22T16:50:07.585346+01:00 HP-ZBook17-G8
> kscreenlocker_greet[22378]: kf.kirigami: Failed to find a Kirigami
> platform plugin
> 2024-03-22T16:50:07.840979+01:00 HP-ZBook17-G8
> kscreenlocker_greet[22378]: qt.virtualkeyboard.hunspell: Hunspell
> dictionary is missing for "en_GB" . Search paths
> ("/usr/share/qt5/qtvirtualkeyboard/hunspell", "/usr/share/hunspell",
> "/usr
> /share/myspell/dicts")
> 2024-03-22T16:50:10.078865+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> gkr-pam: stashed password to try later in open session
> 2024-03-22T16:50:10.079043+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_kwallet5(kde:auth): pam_kwallet5: pam_sm_authenticate
> 2024-03-22T16:50:10.079125+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_kwallet5(kde:auth): pam_kwallet5: we were already executed
> 2024-03-22T16:50:10.094460+01:00 HP-ZBook17-G8 unix_chkpwd[22397]:
> password check failed for user (DAV-LOCAL)
> 2024-03-22T16:50:10.094511+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_unix(kde:auth): authentication failure; logname= uid=1000
> euid=1000 tty= ruser= rhost= user=DAV-LOCAL
> 2024-03-22T16:50:18.479696+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> gkr-pam: stashed password to try later in open session
> 2024-03-22T16:50:18.479899+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_kwallet5(kde:auth): pam_kwallet5: pam_sm_authenticate
> 2024-03-22T16:50:18.479980+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_kwallet5(kde:auth): pam_kwallet5: we were already executed
> 2024-03-22T16:50:18.495403+01:00 HP-ZBook17-G8 kscreenlocker_greet:
> pam_kwallet5(kde:setcred): pam_kwallet5: pam_sm_setcred
> 2024-03-22T16:50:18.574872+01:00 HP-ZBook17-G8 kwin_x11[2882]:
> kwin_core: XCB error: 3 (BadWindow), sequence: 43501, resource id:
> 9437268, major code: 129 (SHAPE), minor code: 6 (Input)
> I am lost at this stage.
>
>
>
>
> Also, does it even prompt you for a fingerprint on the console?
>
> ==> No. When it was working fine, I had to stike <Enter> key and then
> put my finger on the fingerprint and that was all. Now, if I strike
> <Enter>, login screen is scrambling a little bit and I immediately
> after have the message "Unlocking failed".
>
>
> Librement vôtre / Libremente suyo / Freely yours,
> Eric J.P.E. Davanture - eric.davant...@orange.fr
> Mobile: +33-607.08.01.78
> Approximate location: Planet Earth < Solar System < Milky Way Galaxy
> < Local Group < Virgo Cluster < Laniakea Supercluster < known
> Universe
> - There are 10 types of people in this world: those who understand
> binary and those who don't
> - There is NO CLOUD, just other people's computers
> - There is NO INTELLIGENCE in AI, just huge knowledge and deep
> statistics
>
>
>
> -------- Forwarded Message -------- Subject: Re: fprint on HP ZBook
> 17 G8 Fury running SuSE Linux Enterprise Desktop 15 SP5
> Date: Fri, 22 Mar 2024 16:19:11 +0100
> From: Benjamin Berg <benja...@sipsolutions.net>
> To: Eric J.P.E. Davanture <eric.davant...@orange.fr>,
> fprint@lists.freedesktop.org
>
>
>
> Hi,
>
>
>
>
> On Fri, 2024-03-22 at 15:52 +0100, Eric J.P.E. Davanture wrote:
>
> >
> >
> >
> > Greetings,
> >
> >
> >
> > I have SuSE Linux Enterprise Desktop (SLED) 15 SP5 and I use KDE
> > Plasma X11 with fprintd package installed (v 1.94.2-bp155.2.3.1) to
> > unlock the desktop using the integrated fingerprint reader of an HP
> > ZBook 17 G8 Fury (lsusb says: "Bus 003 Device 003: ID 06cb:00f0
> > Synaptics, Inc." which is supported by fprint).
> >
> >
> >
> > It worked fine for some weeks but after some SLED 15 SP5 updates
> > (using zypper up), something broke fprintd package and SuSE
> > Technical Support does not find what :-(
> >
> >
> >
> > I can't unlock anymore the desktop with my fingerprint. I get
> > "Unlocking failed" error message and I have to enter the password
> > with the keyboard as before.
> >
> >
> >
> > A few commands I tested:
> >
> >
> >
> > └─# journalctl -u fprintd.service
> > Mar 22 11:13:57 HP-ZBook17-G8 systemd[1]: Starting Fingerprint
> > Authentication Daemon...
> > Mar 22 11:13:58 HP-ZBook17-G8 systemd[1]: Started Fingerprint
> > Authentication Daemon.
> > Mar 22 11:14:57 HP-ZBook17-G8 systemd[1]: fprintd.service:
> > Deactivated successfully.
> > Mar 22 15:23:50 HP-ZBook17-G8 systemd[1]: Starting Fingerprint
> > Authentication Daemon...
> > Mar 22 15:23:50 HP-ZBook17-G8 systemd[1]: Started Fingerprint
> > Authentication Daemon.
> > Mar 22 15:23:53 HP-ZBook17-G8 fprintd[18155]: Authorization denied
> > to :1.375 to call method 'Release' for device 'Synaptics Sensors':
> > Device was not claimed before use
> >
> >
> >
> > └─# fprintd-enroll
> > Using device /net/reactivated/Fprint/Device/0
> > Enrolling right-index-finger finger.
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-retry-scan
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-retry-scan
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-stage-passed
> > Enroll result: enroll-retry-scan
> > Enroll result: enroll-completed
> >
> > └─# fprintd-verify
> > Using device /net/reactivated/Fprint/Device/0
> > Listing enrolled fingers:
> > - #0: right-index-finger
> > Verify started!
> > Verifying: right-index-finger
> > Verify result: verify-no-match (done)
> >
>
>
>
>
> So, fprintd-verify and fprintd-enroll work, but pam not?
>
>
>
>
> Seems like something is broken in the PAM stack. It is hard to tell
> what though, as the only error form fprintd is that Release is called
> without first claiming the device, for which I have no explanation.
> Maybe auth log has more information?
>
>
>
>
> Also, does it even prompt you for a fingerprint on the console?
>
>
>
>
> Benjamin
>
>
>
>
> >
> >
> >
> >
> >
> > Any idea on how to investigate this problem would be very much
> > appreciated.
> >
> >
> >
> > Thanks a lot by now.
> >
> >
> >
> >
> >
> >
> >
> >
> > Librement vôtre / Libremente suyo / Freely yours,
> > Eric J.P.E. Davanture - eric.davant...@orange.fr
> > Mobile: +33-607.08.01.78
> > Approximate location: Planet Earth < Solar System < Milky Way
> > Galaxy < Local Group < Virgo Cluster < Laniakea Supercluster <
> > known Universe
> > - There are 10 types of people in this world: those who understand
> > binary and those who don't
> > - There is NO CLOUD, just other people's computers
> > - There is NO INTELLIGENCE in AI, just huge knowledge and deep
> > statistics
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>
>
