Use Touch ID for sudo on Mac

By  on  

The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so on. Hell, my Mac unlocks simply when I have my Apple Watch near by. In the end, I probably use the Mac fingerprint key the most.

One functionality that still requires manually typing a password is using sudo from command line. Did you know, however, that you can instead require the fingerprint key instead of typing out your password?

# Open the sudo utility
sudo vi /etc/pam.d/sudo

# Add the following as the first line
auth sufficient pam_tid.so

Whether or not you'd prefer to type it out or simply use the fingerprint is obviously personal preference. Since you expect to be be typing in a command line, moving your finger to touch the key is probably not very efficient. If you do want to use fingerprint, however, here you go!

Recent Features

  • By
    Facebook Open Graph META Tags

    It's no secret that Facebook has become a major traffic driver for all types of websites.  Nowadays even large corporations steer consumers toward their Facebook pages instead of the corporate websites directly.  And of course there are Facebook "Like" and "Recommend" widgets on every website.  One...

  • By
    Camera and Video Control with HTML5

    Client-side APIs on mobile and desktop devices are quickly providing the same APIs.  Of course our mobile devices got access to some of these APIs first, but those APIs are slowly making their way to the desktop.  One of those APIs is the getUserMedia API...

Incredible Demos

  • By
    dwImageProtector Plugin for jQuery

    I've always been curious about the jQuery JavaScript library. jQuery has captured the hearts of web designers and developers everywhere and I've always wondered why. I've been told it's easy, which is probably why designers were so quick to adopt it NOT that designers...

  • By
    Image Reflections with CSS

    Image reflection is a great way to subtly spice up an image.  The first method of creating these reflections was baking them right into the images themselves.  Within the past few years, we've introduced JavaScript strategies and CANVAS alternatives to achieve image reflections without...

Discussion

  1. Luka

    First you need to make the file writable (it is not by default). And you need to do this after every macOS update, because macOS updates reset the file content.

  2. Yohann Paris

    Nice trick. Unfortunately, on Big Sur, at least, it pops up the touch id alert to use it only when the session is terminated, so it’s not useful.

  3. Mehdi Abbassi

    But it is read-only!

  4. Robert Coggeshall

    As the co-author of sudo, I am amused :)

  5. No need to make it writable when editing it with vi, you just add a ! to the save and exit command (:wq!) and it will save it corectly – it will even preserve the read only state of the file.

    Works nicely on Big Sur for me, it pops up the touch id alert, I touch and sudo all the things =)

  6. Is there a way to make sudo work with the Apple Watch as well?

  7. You can also:
    *browse to the folder using finder,
    *edit the file with vscode, or any other code editor
    *save it to desktop
    *delete original file
    *and place the edited

  8. same with nano you don’t need to make it writable.

    sudo nano /etc/pam.d/sudo
    
  9. Thomas B

    You may want to update this for Sonoma – or simple add a pointer to https://0xmachos.com/2023-10-01-Touch-ID-sudo/

Wrap your code in <pre class="{language}"></pre> tags, link to a GitHub gist, JSFiddle fiddle, or CodePen pen to embed!