Quick Tip: Enable Touch ID for Sudo (2020)

Around 2014, I read a security researcher&#x27;s article stating that biometrics should be used as an identifier at best, but never as a password. “You can change a password, but you cannot change your fingerprint”.<p>From that day on, I’ve never used biometrics system used as authentication.<p>With a increasing use of biometrics on phones, should I think differently in 2022?

Speaking from personal experience, don&#x27;t do this on a machine you&#x27;ll ever access remotely, because then you&#x27;re stuck waiting for the biometric check to time out before you can authenticate via another method.

I love using sudo with Touch ID and have been using this trick for years. The only inconvenience is that the PAM configuration always gets reverted by OS updates.<p>I wrote a small tool to mitigate this by configuring PAM on system startup: <a href="https:&#x2F;&#x2F;github.com&#x2F;YuriyGuts&#x2F;persistent-touch-id-sudo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;YuriyGuts&#x2F;persistent-touch-id-sudo</a>

Order matters. Lets say you already have a registered yubikey or similar smart card. The &#x2F;etc&#x2F;pam.d&#x2F;sudo file might look like this:<p><pre><code> # sudo: auth account password session auth sufficient pam_smartcard.so auth required pam_opendirectory.so account required pam_permit.so password required pam_deny.so session required pam_permit.so </code></pre> So if for some reason you want to have both Touch ID and the smart card authentication as options you might want to do this:<p><pre><code> # sudo: auth account password session auth sufficient pam_smartcard.so auth sufficient pam_tid.so ... </code></pre> It will ask for smart card first but if a smart card is unavailable or authentication fails the touch mechanism will be requested. If you invert those parameters the order also gets changed.

This is pretty neat.<p>But one annoyance is that on macOS Monterey, the authentication pop-up dialog doesn&#x27;t have focus when it appears. You first need to click on it before you can use Touch ID. That slows the whole process down to the point where it&#x27;s probably just quicker and easier to use your password.<p>Is there any way to make the pop-up automatically get focus, or is that itself a security risk somehow?<p>(Side note: the same module enables authentication by Apple Watch too! But again, having to take your hands off the keyboard to tap the Apple Watch to approve the request slows down the process so much that it&#x27;s hardly worth it)

For people complaining that this gets reset by macOS updates, I think this should work (I haven&#x27;t tested this on macOS, but it works for me on Arch Linux):<p>1. Copy &#x2F;etc&#x2F;pam.d&#x2F;sudo to &#x2F;etc&#x2F;pam.d&#x2F;customsudo and add &quot;auth sufficient pam_tid.so&quot; to that file instead.<p>2. Create the directory &#x2F;etc&#x2F;sudoers.d&#x2F; if it does not exist<p>3. Create the file &#x2F;etc&#x2F;sudoers.d&#x2F;customtouchid with the following content:<p><pre><code> Defaults pam_service=customsudo </code></pre> You may need to set the right permissions on &#x2F;etc&#x2F;sudoers.d&#x2F;customtouchid before sudo will accept it.

I lock my computer when not near it. If my computer is breached, having user level access of the one account permitted sudo is pretty much Crown Jewels. If you really wanted to privesc you could sniff X11 keystrokes or back door bashrc, but either way even user level access screws me so whatever do what you want after that.<p>As a result, I just enable passwordless sudo.

ITT: “Ackshully if your threat model includes James Bond level tradecraft this is a bad idea.”<p>Spoiler alert: Essentially nobody’s threat model includes that.

Does anyone know why Apple doesn’t make this standard? I’ve been using this on and off for many years and only stop because I get frustrated after an OS update reverts it. Are there licensing&#x2F;security&#x2F;compatibility reasons this may be the case? Seems like an easy fix.

If you want to do the same but auth with your Apple Watch, you can follow this[1] guide.<p>[1] <a href="https:&#x2F;&#x2F;akrabat.com&#x2F;add-apple-watch-authentication-to-sudo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;akrabat.com&#x2F;add-apple-watch-authentication-to-sudo&#x2F;</a>

For some reason, this only seems to accepts my Apple Watch as authentication, but not the fingerprint sensor... any idea why? (fingerprint works to authenticate in System Preferences, etc.)<p><pre><code> $ cat sudo # sudo: auth account password session auth sufficient pam_tid.so auth sufficient pam_smartcard.so auth required pam_opendirectory.so account required pam_permit.so password required pam_deny.so session required pam_permit.so</code></pre>

This is a similar project for WSL. I love it.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;nullpo-head&#x2F;WSL-Hello-sudo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nullpo-head&#x2F;WSL-Hello-sudo</a>

It’s very cool, but every update of mac OS resets it! After a while I didn’t bother to reactivate it…<p>Is there a permanent solution, that does not involve cron scripts or other hacks?

I think it&#x27;s a much better guide with iterm support: <a href="https:&#x2F;&#x2F;austencam.com&#x2F;posts&#x2F;using-touchid-with-sudo-in-terminal-or-iterm" rel="nofollow">https:&#x2F;&#x2F;austencam.com&#x2F;posts&#x2F;using-touchid-with-sudo-in-termi...</a>

Am I the only one that things I write my password faster than putting my finger in the Touch ID?

This is what I&#x27;m trying to do but under Windows and Debian + preferably with a mechanical keyboard. Well the mechanical keyboard w&#x2F; fingerprint reader is the bigger ask cause there aren&#x27;t many choices. There is a decently good one with Cherry MX switches from Taiwan but pretty much impossible to order one to Europe (they sell their other keyboards but not the one with fingerprint reader) <a href="https:&#x2F;&#x2F;www.i-rocks.com&#x2F;web&#x2F;product&#x2F;product_in.jsp?pd_no=PD1550820469030&amp;lang=en" rel="nofollow">https:&#x2F;&#x2F;www.i-rocks.com&#x2F;web&#x2F;product&#x2F;product_in.jsp?pd_no=PD1...</a>

Am I the only one who actually finds it faster to type a password than to remove my hand from the keyboard and perform Touch ID auth?

For whatever reason, this resulted in me being prompted to first type my password, then also authenticate with Touch ID.

I tried this a couple of years ago but it would be reset after every system upgrades. Is it still a case now?

Is there any way to do this as a 2nd factor, so that both my password and my fingerprint are needed for sudo?

Unfortunately, this resets after every macOS update, which is very frustrating, and also absolutely ridiculous.

If you&#x27;re like me and you got the order wrong, this will completely break your PAM configuration. To fix it, I had to temporarily enable the actual root user[1].<p>[1]: <a href="https:&#x2F;&#x2F;superuser.com&#x2F;a&#x2F;1357253" rel="nofollow">https:&#x2F;&#x2F;superuser.com&#x2F;a&#x2F;1357253</a>

Surely very convenient but idk, I still feel a li&#x27;l icky using my fingerprint for authorization. What if one day the fingerprint sensor acts up a little, as can always happen with such sensitive hardware? Then you &#x27;re just completely screwed?

Not lead pipe safe, don&#x27;t think touch ID cares if your hand is attached to your body.<p>might still do it.

So I&#x27;ve run into issues with this in the past, which seems to relate to using DisplayLink. Seems to be in how MacOS treats the DisplayLink driver, and can&#x27;t be fixed unless Apple makes some changes in the OS level

Fingerprints are usernames, not passwords -<p>related discussion (from 2013!) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6477505" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6477505</a>

Call me old fashion, but I love the feel of entering my sudo pw. It’s the rumbling to my v8 engine. I mean M1 Mac.

I&#x27;ve tried this multiple times over the years and it doesn&#x27;t seem to work, at least not with tmux.

1Password forces users to enter the master password at least every 2 weeks, super annoying and insecure. Eg my master password is super hard to enter, even more on smartphones, so I’m considering moving to a less secure one to avoid the PITA. All this technical innovation with Touch Id is great but then companies keep reverting to old annoying approaches when facing innovation…

Shortcut:<p>echo &#x27;auth sufficient pam_tid.so&#x27; | sudo tee -a &#x2F;etc&#x2F;pam.d&#x2F;sudo

reminder: biometrics are not protected by the fifth amendment. use strong passphrases.<p><a href="https:&#x2F;&#x2F;www.eff.org&#x2F;dice" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;dice</a>

idk if the pam module used to be around but i remember building a modified sudo binary to accomplish this on my MBP pro a few years ago.

Doesn&#x27;t this block ssh (headless) access ?

Title should mention &quot;mac tip&quot;