TouchID for sudo on touch-bar MBPs

November 19, 2019tips-and-tricks

A previously well known trick for Touch-ID enabled MacBookPros: to prevent having to type your password for sudo, you can simply enable touch-id for authentication in place of the password.

This authentication is configured in /etc/pam.d/sudo.
Thus, to enable Touch-ID for sudo, simply edit the file to incorporate the following line:

auth       sufficient     pam_tid.so

And the result looks something like as follows:

$ cat /etc/pam.d/sudo
# sudo: auth account password session
auth       sufficient     pam_smartcard.so
auth       sufficient     pam_tid.so
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so