Use Touch ID for sudo on Mac

By  on  

The landscape of security is changing quite a bit. We've gone from basic username and password to 2FA, facial recognition, fingerprint recognition, and so on. Hell, my Mac unlocks simply when I have my Apple Watch near by. In the end, I probably use the Mac fingerprint key the most.

One functionality that still requires manually typing a password is using sudo from command line. Did you know, however, that you can instead require the fingerprint key instead of typing out your password?

# Open the sudo utility
sudo vi /etc/pam.d/sudo

# Add the following as the first line
auth sufficient pam_tid.so

Whether or not you'd prefer to type it out or simply use the fingerprint is obviously personal preference. Since you expect to be be typing in a command line, moving your finger to touch the key is probably not very efficient. If you do want to use fingerprint, however, here you go!

Recent Features

  • By
    Conquering Impostor Syndrome

    Two years ago I documented my struggles with Imposter Syndrome and the response was immense.  I received messages of support and commiseration from new web developers, veteran engineers, and even persons of all experience levels in other professions.  I've even caught myself reading the post...

  • By
    Interview with a Pornhub Web Developer

    Regardless of your stance on pornography, it would be impossible to deny the massive impact the adult website industry has had on pushing the web forward. From pushing the browser's video limits to pushing ads through WebSocket so ad blockers don't detect them, you have...

Incredible Demos

  • By
    Using Dotter for Form Submissions

    One of the plugins I'm most proud of is Dotter. Dotter allows you to create the typical "Loading..." text without using animated images. I'm often asked what a sample usage of Dotter would be; form submission create the perfect situation. The following...

  • By
    Unicode CSS Classes

    CSS class name structure and consistency is really important; some developers camelcase classnames, others use dashes, and others use underscores.  One thing I've learned when toying around by HTML and CSS class names is that you can actually use unicode symbols and icons as classnames.

Discussion

  1. Luka

    First you need to make the file writable (it is not by default). And you need to do this after every macOS update, because macOS updates reset the file content.

  2. Yohann Paris

    Nice trick. Unfortunately, on Big Sur, at least, it pops up the touch id alert to use it only when the session is terminated, so it’s not useful.

  3. Mehdi Abbassi

    But it is read-only!

  4. Robert Coggeshall

    As the co-author of sudo, I am amused :)

  5. No need to make it writable when editing it with vi, you just add a ! to the save and exit command (:wq!) and it will save it corectly – it will even preserve the read only state of the file.

    Works nicely on Big Sur for me, it pops up the touch id alert, I touch and sudo all the things =)

  6. Is there a way to make sudo work with the Apple Watch as well?

Wrap your code in <pre class="{language}"></pre> tags, link to a GitHub gist, JSFiddle fiddle, or CodePen pen to embed!