Mac/OS/Q/How does Touch ID for sudo (PAM) work?
How does Touch ID for sudo work (PAM on macOS)?
Answer
- AI/Response
sudo and PAM — On macOS, sudo authenticates through PAM (Pluggable Authentication Modules). The stack for sudo is defined under /etc/pam.d/sudo (and related includes). Each auth line is a module; PAM walks the stack according to the control flags (sufficient, required, etc.) to decide whether the user has proved their identity.- What Touch ID adds — Apple ships a PAM module, typically referenced as
pam_tid.so, that can satisfy an auth step by prompting for Touch ID (or another Local Authentication method you have enabled, such as Apple Watch approval on some setups). When that line is active and PAM reaches it with a sufficient (or similar) control, a successful biometric (or watch) check can count as authentication instead of typing your account password. - Why
sudo_local (macOS Sonoma 14+) — Older instructions edited /etc/pam.d/sudo directly; macOS updates could replace that file. From Sonoma onward, Apple’s default sudo PAM file can include a local file (/etc/pam.d/sudo_local) so administrators enable Touch ID in sudo_local (often by copying sudo_local.template and uncommenting the pam_tid.so line). That keeps the change in a file meant to persist across upgrades instead of re-editing the stock sudo stack after each update. Six Colors: In macOS Sonoma, Touch ID for sudo can survive updates · Apple: Enter administrator commands in Terminal on Mac (general sudo behavior; password vs Touch ID is configured locally via PAM) - Scope and caveats — Configuration is per machine under
/etc/pam.d/ (not something to store in a dotfile repo). Misconfiguring PAM can lock you out of sudo; treat edits as system-administration changes. Remote shells (e.g. SSH without a local console session) often cannot use Touch ID the same way, because the biometric prompt is tied to the local session and Secure Enclave–backed authentication.
Related