Overview

This article describes how to enable Touch ID on your Mac to authenticate you for sudo access instead of a password because chances are you’re not the “owner” of your computer.

The concept sudo originated on *nix OSes and is quite similar to an admin account on Windows, loosely speaking. In fact, it stands for SUper user DO as in executing as a root user and normally elevated with a password.

Through this tutorial, you can takes a step further and utilises macOS Touch ID to elevate necessary privileges without typing your password every single time.

Enable elevating privileges using Touch ID

$ sudo vim /etc/pam.d/sudo
auth       sufficient     pam_tid.so
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
...

1. Open your favorite terminal emulator, usually Terminal.app or iTerm.app and open /etc/pam.d/sudo with any command line editors such as vim or nano
2. Append the line auth sufficient pam_tid.so space-separated to the sudo file
3. Hit Save (:wq! for vim or ⌃-x then y for nano) to apply all changes

Enable elevating privileges using TouchID via Vim editor on terminal. Adding pam_tid.so to sudo configuration to elevate privileges using Touch ID.

Alternatively, navigate through Finder with ⌘-⇧-G keystrokes then type in the address /etc/pam.d/sudo.

1. Right-click and select Get Info
2. In Sharing & Permissions section, unlock using your password and grant Read & Write access so you can open it
3. Open the file in any editor and append auth sufficient pam_tid.so
4. Save and revert Step 2 to ensure the file is Read-only

Results

In a new terminal tab/window, whenever executing sudo, it will automatically prompt for Touch ID if you have successfully configured following the previous steps.

Enabled Touch ID allows quick elevation

(Optional) Tmux Setup

The previous result won’t be the same within a Tmux session and require further installation of fabianishere / pam_reattach.

1. Install the pam_reattach module with brew
2. Similar to previous, append auth optional pam_reattach.so to the sudo authentication file

brew install fabianishere/personal/pam_reattach
sudo vim /etc/pam.d/sudo
auth       optional       pam_reattach.so
auth       sufficient     pam_tid.so
auth       sufficient     pam_smartcard.so
...

Troubleshooting (Extra)

• Issues with iTerm2 not working

Make sure that you have enabled successfully, also try built-in Terminal.app to verify it, otherwise open iTerm2 Preferences (⌘-,) → Advanced → Allow sessions to survive logging out and back in and set it to No.

Acknowledgement

This tutorial is based on the answers from this StackExchange thread ↗.